rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-41255 
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-31T00:00:00.000Z
CVE-2024-41256 
Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-31T00:00:00.000Z
CVE-2024-41258 
An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-31T00:00:00.000Z
CVE-2024-41259 
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-01T00:00:00.000Z
CVE-2024-41260 
A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-01T00:00:00.000Z
CVE-2024-41262 
mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to intercept communications via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-31T00:00:00.000Z
CVE-2024-41264 
An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-01T00:00:00.000Z
CVE-2024-41265 
A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-01T00:00:00.000Z
CVE-2024-41270 
An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-06T00:00:00.000Z
CVE-2024-41276 
A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their login credentials. However, the request limiting mechanism can be easily bypassed, enabling attackers to perform a brute force attack to guess the correct PIN and gain unauthorized access to the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-01T00:00:00.000Z
CVE-2024-41281 
Linksys WRT54G v4.21.5 has a stack overflow vulnerability in get_merge_mac function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-19T00:00:00.000Z
CVE-2024-41285 
A stack overflow in FAST FW300R v1.3.13 Build 141023 Rel.61347n allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted file path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-41290 
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-02T00:00:00.000Z
CVE-2024-41304 
An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-41305 
A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-41308 
An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41309 
An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41310 
AndServer 2.1.12 is vulnerable to Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-41311 
In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lead to an out-of-bounds read and write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-41314 
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z
CVE-2024-41315 
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z
CVE-2024-41316 
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z
CVE-2024-41317 
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z
CVE-2024-41318 
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z
CVE-2024-41319 
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-23T00:00:00.000Z
CVE-2024-41320 
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the get_apcli_conn_info function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z
CVE-2024-41332 
Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-level privileges to arbitrarily delete categories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-09T00:00:00.000Z
CVE-2024-41333 
A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the uname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-06T00:00:00.000Z
CVE-2024-41334 
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to not utilize certificate verification, allowing attackers to upload crafted APPE modules from non-official servers, leading to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-41335 
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to utilize insecure versions of the functions strcmp and memcmp, allowing attackers to possibly obtain sensitive information via timing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-41336 
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to store passwords in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-41338 
A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to cause a Denial of Service (DoS) via a crafted DHCP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-41339 
An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload a crafted kernel module, allowing for arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-41340 
An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-41344 
A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-41345 
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41346 
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41347 
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41348 
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41349 
unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41350 
bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41351 
bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41353 
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-41354 
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-41355 
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-41356 
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-41357 
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-41358 
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41361 
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41364 
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41366 
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41367 
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41368 
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41369 
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41370 
Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41371 
Organizr v1.90 is vulnerable to Cross Site Scripting (XSS) via api.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41372 
Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-41373 
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-41374 
ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-41375 
ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-41376 
dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-05T00:00:00.000Z
CVE-2024-41380 
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-05T00:00:00.000Z
CVE-2024-41381 
microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-05T00:00:00.000Z
CVE-2024-41432 
An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can bypass account lockout mechanisms during attempts to log into admin accounts, spoof IP addresses in requests sent to the server, and impersonate IP addresses that have logged into user accounts, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-07T00:00:00.000Z
CVE-2024-41433 
PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component expression.ExplainExpressionList. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. NOTE: PingCAP maintains that the actual reproduction of this issue did not cause the security impact of service interruption to other users. They argue that this is a complex query bug and not a DoS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-41434 
PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal. This allows attackers to cause a Denial of Service (DoS) via a crafted input to the 'RemoveUnnecessaryFirstRow', it will check the expression between 'Agg' and 'GroupBy', but does not check the return type. NOTE: PingCAP disputes this, arguing that reproduction did not cause the security impact of service interruption to other users. They maintain it is a complex query bug in the product but not a DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-41435 
YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-41436 
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-41437 
A heap buffer overflow in the function cp_unfilter() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-41438 
A heap buffer overflow in the function cp_stored() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-41439 
A heap buffer overflow in the function cp_block() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-41440 
A heap buffer overflow in the function png_quantize() of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-41443 
A stack overflow in the function cp_dynamic() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-41444 
SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-41445 
Library MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread via a crafted mdf4 file is parsed using the ReadData function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-25T00:00:00.000Z
CVE-2024-41446 
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-21T00:00:00.000Z
CVE-2024-41447 
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2024-41453 
A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z