rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-52016 
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component wlg_adv.cgi via the apmode_dns1_pri and apmode_dns1_sec parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52017 
Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52018 
Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at genie_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52019 
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52020 
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at wiz_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52021 
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at bsw_fix.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52022 
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlg_adv.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52023 
Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe2.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52024 
Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at wizpppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52025 
Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at geniepppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52026 
Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at bsw_pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52028 
Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at wiz_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52029 
Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at genie_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52030 
Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at ru_wan_flow.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-52032 Private channel names leaking when Elasticsearch is enabled
Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Adrian (thiefmaster)
Published: 2024-11-09T17:19:35.639Z
CVE-2024-52033 
Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote unauthenticated attacker may obtain information of the other devices connected through the Wi-Fi.
Problem types: cwe_id: CWE-497
description: Exposure of sensitive system information to an unauthorized control sphere
Affected products: vendor: Rakuten Mobile, Inc.
product: Rakuten Turbo 5G
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2024-11-20T07:29:44.727Z
CVE-2024-52034 mySCADA myPRO OS Command Injection
An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: mySCADA
product: myPRO Manager
default_status: unaffected
vendor: mySCADA
product: myPRO Runtime
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2024-11-22T22:15:57.162Z
CVE-2024-52035 
An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: catdoc
product: catdoc
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Credits: lang: en
value: Discovered by a member of Cisco Talos.
Published: 2025-06-02T15:00:17.160Z
CVE-2024-52043 User enumeration in HubHub
Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects all released HumHub versions: through 1.16.2.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: HumHub GmbH & Co. KG
product: HumHub
default_status: affected
Credits: lang: en
value: Erez Kalman
Published: 2024-11-06T07:51:17.483Z
CVE-2024-52046 Apache MINA: MINA applications using unbounded deserialization may allow RCE
The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process
incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows
attackers to exploit the deserialization process by sending specially crafted malicious serialized data,
potentially leading to remote code execution (RCE) attacks.



					


				


			


		


	
This issue affects MINA core versions 2.0.X, 2.1.X and 2.2.X, and will be fixed by the releases 2.0.27, 2.1.10 and 2.2.4.





It's also important to note that an application using MINA core library will only be affected if the IoBuffer#getObject() method is called, and this specific method is potentially called when adding a ProtocolCodecFilter instance using the ObjectSerializationCodecFactory class in the filter chain. If your application is specifically using those classes, you have to upgrade to the latest version of MINA core library.




Upgrading will  not be enough: you also need to explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance, using one of the three new methods:




    /**

     * Accept class names where the supplied ClassNameMatcher matches for

     * deserialization, unless they are otherwise rejected.

     *

     * @param classNameMatcher the matcher to use

     */

    public void accept(ClassNameMatcher classNameMatcher)




    /**

     * Accept class names that match the supplied pattern for

     * deserialization, unless they are otherwise rejected.

     *

     * @param pattern standard Java regexp

     */

    public void accept(Pattern pattern) 





    /**

     * Accept the wildcard specified classes for deserialization,

     * unless they are otherwise rejected.

     *

     * @param patterns Wildcard file name patterns as defined by

     *                  {@link org.apache.commons.io.FilenameUtils#wildcardMatch(String, String) FilenameUtils.wildcardMatch}

     */

    public void accept(String... patterns)







By default, the decoder will reject *all* classes that will be present in the incoming data.







Note: The FtpServer, SSHd and Vysper sub-project are not affected by this issue.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache MINA
default_status: unaffected
Credits: lang: en
value: The initial report was submitted by Bofei Chen, with all the necessary bits to reproduce the RCE
Published: 2024-12-25T10:06:23.887Z
CVE-2024-52047 
A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Apex One
vendor: Trend Micro, Inc.
product: Trend Micro Apex One as a Service
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2024-12-31T16:09:28.937Z
CVE-2024-52048 
A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerability is similar to, but not identical to CVE-2024-52049.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: cwe_id: CWE-266
description: CWE-266: Incorrect Privilege Assignment
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Apex One
cpes: cpe:2.3:a:trendmicro:apexone_op:14.0.0.13121:p3:*:*:*:*:*:*
vendor: Trend Micro, Inc.
product: Trend Micro Apex One as a Service
cpes: cpe:2.3:a:trendmicro:apexone_saas:14.0.0.14026:ga:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2024-12-31T16:11:41.737Z
CVE-2024-52049 
A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerability is similar to, but not identical to CVE-2024-52048.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: cwe_id: CWE-266
description: CWE-266: Incorrect Privilege Assignment
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Apex One
cpes: cpe:2.3:a:trendmicro:apexone_op:14.0.0.13121:p3:*:*:*:*:*:*
vendor: Trend Micro, Inc.
product: Trend Micro Apex One as a Service
cpes: cpe:2.3:a:trendmicro:apexone_saas:14.0.0.14026:ga:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2024-12-31T16:13:12.794Z
CVE-2024-52050 
A LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Apex One
cpes: cpe:2.3:a:trendmicro:apexone_op:14.0.0.13121:p3:*:*:*:*:*:*
vendor: Trend Micro, Inc.
product: Trend Micro Apex One as a Service
cpes: cpe:2.3:a:trendmicro:apexone_saas:14.0.0.14026:ga:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2024-12-31T16:13:49.837Z
CVE-2024-52052 Stream Target Remote Code Execution in Wowza Streaming Engine
Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution.
Problem types: cwe_id: CWE-646
description: CWE-646: Reliance on File Name or Extension of Externally-Supplied File
Affected products: vendor: Wowza
product: Streaming Engine
default_status: unaffected
Published: 2024-11-21T22:20:15.758Z
CVE-2024-52053 Stored Cross-Site Scripting in Wowza Streaming Engine
Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript into the web dashboard to automatically hijack admin accounts.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wowza
product: Streaming Engine
default_status: unaffected
Published: 2024-11-21T22:31:31.947Z
CVE-2024-52054 Application Creation Path Traversal in Wowza Streaming Engine
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the file system.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Wowza
product: Streaming Engine
default_status: unaffected
Published: 2024-11-21T22:46:45.265Z
CVE-2024-52055 Application Copy Path Traversal in Wowza Streaming Engine
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target directory contains an XML definition file.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Wowza
product: Streaming Engine
default_status: unaffected
Published: 2024-11-21T22:54:39.390Z
CVE-2024-52056 Application Delete Path Traversal in Wowza Streaming Engine
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the target directory contains an XML definition file.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Wowza
product: Streaming Engine
default_status: unaffected
Published: 2024-11-21T22:59:40.509Z
CVE-2024-52057 Potential arbitrary SQL query execution in Queuing Service while parsing malicious remote commands or configuration files
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0, from 6.1.0 before 6.1.2.17, from 6.0.0 before 6.0.*, from 5.2.0 before 5.3.*.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: RTI
product: Connext Professional
default_status: unaffected
Published: 2024-12-13T10:12:32.502Z
CVE-2024-52058 Potential arbitrary command execution in System Designer while parsing malicious HTTP/REST requests
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext Professional (System Designer) allows OS Command Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.19.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: RTI
product: Connext Professional
default_status: unaffected
Published: 2024-12-13T10:17:25.490Z
CVE-2024-52059 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows Overflow Variables and Tags.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.17.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: RTI
product: Connext Professional
default_status: unaffected
Published: 2024-12-13T10:18:35.943Z
CVE-2024-52060 Potential stack overflow when using XML configuration file referencing environment variables
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service, Cloud Discovery Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.1.45.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: RTI
product: Connext Professional
default_status: unaffected
Published: 2024-12-13T10:19:22.641Z
CVE-2024-52061 Potential stack buffer overflow when parsing an XML type
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Service, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: RTI
product: Connext Professional
default_status: unaffected
Published: 2024-12-13T10:20:13.392Z
CVE-2024-52062 Potential stack buffer write overflow in Connext applications while parsing malicious XML types document
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: RTI
product: Connext Professional
default_status: unaffected
Published: 2024-12-13T10:20:49.069Z
CVE-2024-52063 Potential stack buffer write overflow in Connext applications while parsing malicious XML types document
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: RTI
product: Connext Professional
default_status: unaffected
Published: 2024-12-13T10:21:25.292Z
CVE-2024-52064 Potential stack buffer write overflow in Connext applications while parsing malicious license file
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: RTI
product: Connext Professional
default_status: unaffected
Published: 2024-12-13T10:21:58.790Z