rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-41164 BIG-IP MPTCP vulnerability
When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
vendor: F5
product: BIG-IP Next CNF
default_status: unknown
vendor: F5
product: BIG-IP Next SPK
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2024-08-14T14:32:31.623Z
CVE-2024-41165 
A library injection vulnerability exists in Microsoft Word 16.83 for macOS. A specially crafted library can leverage Word's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.
Problem types: cwe_id: CWE-347
description: CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: Microsoft
product: Word
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Francesco Benvenuto of Cisco Talos.
Published: 2024-12-18T22:39:44.528Z
CVE-2024-41166 
Stack-based buffer overflow in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Problem types: description: Denial of Service
cwe_id: CWE-121
description: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2025-02-12T21:20:07.730Z
CVE-2024-41167 
Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) Server Board M10JNP2SB Family
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-11-13T21:10:47.672Z
CVE-2024-41168 
Use after free in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Problem types: description: Denial of Service
cwe_id: CWE-416
description: Use After Free
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.4
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2025-02-12T21:58:41.096Z
CVE-2024-41169 Apache Zeppelin: raft directory listing and file read
The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.

This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.
Problem types: cwe_id: CWE-664
description: CWE-664 Improper Control of a Resource Through its Lifetime
Affected products: vendor: Apache Software Foundation
product: Apache Zeppelin
default_status: unaffected
Credits: lang: en
value: SuperX <superxyyang@gmail.com>
Published: 2025-07-12T16:22:35.724Z
CVE-2024-41170 
A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0015), Tecnomatix Plant Simulation V2404 (All versions < V2404.0004). The affected applications contain a stack based overflow vulnerability while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Siemens
product: Tecnomatix Plant Simulation V2302
default_status: unknown
vendor: Siemens
product: Tecnomatix Plant Simulation V2404
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-09-10T09:36:44.999Z
CVE-2024-41171 
A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access restrictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated local attacker to escalate their privileges in the underlying system.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Siemens
product: SINUMERIK 828D V4
default_status: unknown
vendor: Siemens
product: SINUMERIK 828D V5
default_status: unknown
vendor: Siemens
product: SINUMERIK 840D sl V4
default_status: unknown
vendor: Siemens
product: SINUMERIK ONE
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 8.8
baseSeverity: HIGH
Published: 2024-09-10T09:36:46.244Z
CVE-2024-41172 Apache CXF: Unrestricted memory consumption in CXF HTTP clients
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory

Problem types: cwe_id: CWE-401
description: CWE-401 Missing Release of Memory after Effective Lifetime
Affected products: vendor: Apache Software Foundation
product: Apache CXF
default_status: unaffected
Published: 2024-07-19T08:50:43.766Z
CVE-2024-41173 Beckhoff: Local authentication bypass in the IPC-Diagnostics package included in TwinCAT/BSD
The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Beckhoff
product: IPC Diagnostics package
default_status: unaffected
vendor: Beckhoff
product: TwinCAT/BSD
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Nozomi Networks
lang: en
value: Andrea Palanca
Published: 2024-08-27T08:00:47.054Z
CVE-2024-41174 Beckhoff: Improper input neutralization vulnerability in the IPC-Diagnostics package in TwinCAT/BSD
The IPC-Diagnostics package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Beckhoff
product: IPC Diagnostics package
default_status: unaffected
vendor: Beckhoff
product: TwinCAT/BSD
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Nozomi Networks
lang: en
value: Andrea Palanca
Published: 2024-08-27T08:01:09.810Z
CVE-2024-41175 Beckhoff: Local Denial-of-Service vulnerability in TwinCAT/BSD and the IPC-Diagnostics package
The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Beckhoff
product: IPC Diagnostics package
default_status: unaffected
vendor: Beckhoff
product: TwinCAT/BSD
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-08-27T08:01:31.499Z
CVE-2024-41176 Beckhoff: Local Denial of Service issue in package MDP included in TwinCAT/BSD
The MPD package included in TwinCAT/BSD allows an authenticated, low-privileged local
attacker to induce a Denial-of-Service (DoS) condition on the daemon and execute code in
the context of user “root” via a crafted HTTP request.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Beckhoff
product: MDP package
default_status: unaffected
vendor: Beckhoff
product: TwinCAT/BSD
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Nozomi Networks
lang: en
value: Andrea Palanca
Published: 2024-08-27T08:01:57.443Z
CVE-2024-41177 Apache Zeppelin: XSS in the Helium module
Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin.

This issue affects Apache Zeppelin: before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Apache Software Foundation
product: Apache Zeppelin
default_status: unaffected
Credits: lang: en
value: H Ming
Published: 2025-08-03T10:09:43.302Z
CVE-2024-41178 Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files
Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. 

On certain error conditions, the logs may contain the OIDC token passed to  AssumeRoleWithWebIdentity https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html . This allows someone with access to the logs to impersonate that identity, including performing their own calls to AssumeRoleWithWebIdentity, until the OIDC token expires. Typically OIDC tokens are valid for up to an hour, although this will vary depending on the issuer.

Users are recommended to use a different AWS authentication mechanism, disable logging or upgrade to version 0.10.2, which fixes this issue.

Details:

When using AWS WebIdentityTokens with the object_store crate, in the event of a failure and automatic retry, the underlying reqwest error, including the full URL with the credentials, potentially in the parameters, is written to the logs. 

Thanks to Paul Hatcherian for reporting this vulnerability
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: Apache Software Foundation
product: Apache Arrow Rust Object Store
default_status: unaffected
Credits: lang: en
value: Paul Hatcherian
Published: 2024-07-23T16:50:10.093Z
CVE-2024-41183 
Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges.
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro VPN (consumer)
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2024-10-22T18:26:51.474Z
CVE-2024-41184 
In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record might not be worthwhile because an empty ipset name must be configured by the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-18T00:00:00.000Z
CVE-2024-41195 
An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-41196 
An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-41197 
An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-41198 
An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-41199 
An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-41200 
A segmentation fault in KMPlayer v4.2.2.65 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-05T00:00:00.000Z
CVE-2024-41206 
A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disclosure via a crafted TS video file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-14T00:00:00.000Z
CVE-2024-41209 
A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted MOV video file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-14T00:00:00.000Z
CVE-2024-41217 
A heap-based buffer overflow in tsMuxer version nightly-2024-05-10-02-00-45 allows attackers to cause Denial of Service (DoS) via a crafted MKV video file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-14T00:00:00.000Z
CVE-2024-41226 
A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. The payload is being injected in the http Response from the client-side, so the owner of the Response and payload is the end user in this case. They contend that the server's security controls have no impact or role to play in this situation and therefore this is not a valid vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-06T00:00:00.000Z
CVE-2024-41228 
A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-23T00:00:00.000Z
CVE-2024-41236 
A SQL injection vulnerability in /smsa/admin_login.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter of the Admin Login Page
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-41237 
A SQL injection vulnerability in /smsa/teacher_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41238 
A SQL injection vulnerability in /smsa/student_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-08T00:00:00.000Z
CVE-2024-41239 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "class_name" parameter field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41240 
A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/teacher_login.php" in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via the "error" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41241 
A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/admin_login.php" in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "error" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41242 
A Reflected Cross Site Scripting (XSS) vulnerability was found in /smsa/student_login.php in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "error" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41243 
An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view MARKS details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41244 
An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view CLASS details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41245 
An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view TEACHER details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41246 
An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view administrator dashboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41247 
An Incorrect Access Control vulnerability was found in /smsa/add_class.php and /smsa/add_class_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to add a new class entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41248 
An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to add a new subject entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41249 
An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view SUBJECT details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41250 
An Incorrect Access Control vulnerability was found in /smsa/view_students.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view STUDENT details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41251 
An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view and approve Teacher registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41252 
An Incorrect Access Control vulnerability was found in /smsa/admin_student_register_approval.php and /smsa/admin_student_register_approval_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view and approve student registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41253 
goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-31T00:00:00.000Z
CVE-2024-41254 
An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-31T00:00:00.000Z