rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-54429 WordPress Aphorismus plugin <= 1.2.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ivan-ovsyannikov Aphorismus aphorismus allows Stored XSS.This issue affects Aphorismus: from n/a through <= 1.2.0.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: ivan-ovsyannikov
product: Aphorismus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:47.199Z
CVE-2024-54430 WordPress EELV Newsletter  plugin <= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Cross Site Request Forgery.This issue affects EELV Newsletter: from n/a through <= 4.8.2.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Europe Ecologie Les Verts
product: EELV Newsletter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: thiennv | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:46.585Z
CVE-2024-54431 WordPress Admin Customization plugin <= 2.2 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in phpdevp Admin Customization wpp-customization allows Stored XSS.This issue affects Admin Customization: from n/a through <= 2.2.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: phpdevp
product: Admin Customization
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:45.998Z
CVE-2024-54432 WordPress WP Flipkart Importer plugin <= 1.4 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik WP Flipkart Importer wp-flipkart-importer allows Stored XSS.This issue affects WP Flipkart Importer: from n/a through <= 1.4.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Shambhu Patnaik
product: WP Flipkart Importer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:45.399Z
CVE-2024-54433 WordPress Simple Booking – Widget plugin <= 1.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Marcel CL Simple Booking Widget simple-booking-widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through <= 1.1.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Marcel CL
product: Simple Booking Widget
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:44.784Z
CVE-2024-54434 WordPress phZoom plugin <= 1.2.92 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through <= 1.2.92.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: BenJemin
product: phZoom
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:44.178Z
CVE-2024-54435 WordPress Onlywire Multi Autosubmitter plugin <= 1.2.4 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Onlywire Multi Autosubmitter onlywire-multi-autosubmitter allows Stored XSS.This issue affects Onlywire Multi Autosubmitter: from n/a through <= 1.2.4.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Thomas Hoefter
product: Onlywire Multi Autosubmitter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:43.580Z
CVE-2024-54436 WordPress Jet Footer Code plugin <= 1.4 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in milordk Jet Footer Code jet-footer-code allows Stored XSS.This issue affects Jet Footer Code: from n/a through <= 1.4.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: milordk
product: Jet Footer Code
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:42.979Z
CVE-2024-54437 WordPress jCarousel for WordPress plugin <= 1.0 - CSRF to Stored XSS vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in koolkatwebdesigns jCarousel jcarousel-for-wordpress allows Stored XSS.This issue affects jCarousel: from n/a through <= 1.0.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: koolkatwebdesigns
product: jCarousel
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:42.402Z
CVE-2024-54438 WordPress Gaxx Keywords plugin <= 0.2 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in gaxx Gaxx Keywords gaxx-keywords allows Stored XSS.This issue affects Gaxx Keywords: from n/a through <= 0.2.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: gaxx
product: Gaxx Keywords
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:41.814Z
CVE-2024-54439 WordPress Amazon Product Price plugin <= 1.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Price: from n/a through <= 1.1.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Alok Tiwari
product: Amazon Product Price
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:41.224Z
CVE-2024-54440 WordPress WP-Ban-User plugin <= 1.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n/a through <= 1.0.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: blueskyy
product: WP-Ban-User
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2024-12-16T14:13:40.623Z
CVE-2024-54441 WordPress Utech World Time Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time utech-world-time-for-wp allows Stored XSS.This issue affects Utech World Time: from n/a through <= 1.0.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Meini
product: Utech World Time
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: 0xd4rk5id3 | Patchstack Bug Bounty Program
Published: 2024-12-16T14:14:16.769Z
CVE-2024-54442 WordPress Better WP Login Page plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cortesfrau Better WP Login Page better-wp-login-page allows Stored XSS.This issue affects Better WP Login Page: from n/a through <= 1.1.2.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: cortesfrau
product: Better WP Login Page
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: l8BL | Patchstack Bug Bounty Program
Published: 2024-12-16T14:14:16.152Z
CVE-2024-54443 WordPress Advanced Data Table For Elementor plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Advanced Data Table For Elementor advanced-data-table-for-elementor allows Stored XSS.This issue affects Advanced Data Table For Elementor: from n/a through <= 1.0.0.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: PluginsCafe
product: Advanced Data Table For Elementor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abu Hurayra | Patchstack Bug Bounty Program
Published: 2024-12-16T14:14:15.536Z
CVE-2024-54444 WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.25.10.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Elementor
product: Elementor Website Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: stealthcopter | Patchstack Bug Bounty Program
Published: 2025-02-25T14:17:49.943Z
CVE-2024-54445 Blind SQLi in Login
Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: LogicalDOC
product: LogicalDOC Community
default_status: unaffected
vendor: LogicalDOC
product: LogicalDOC Enterprise
default_status: unaffected
Credits: lang: en
value: Matthew Hogg
Published: 2025-03-14T17:49:44.090Z
CVE-2024-54446 Blind SQLi in Document History
Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: LogicalDOC
product: LogicalDOC Community
default_status: affected
vendor: LogicalDOC
product: LogicalDOC Enterprise
default_status: affected
Credits: lang: en
value: Matthew Hogg
Published: 2025-03-14T17:53:01.300Z
CVE-2024-54447 Blind SQLi in Saved Search
Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: LogicalDOC
product: LogicalDOC Community
default_status: unaffected
vendor: LogicalDOC
product: LogicalDOC Enterprise
default_status: unaffected
Credits: lang: en
value: Matthew Hogg
Published: 2025-03-14T17:57:26.356Z
CVE-2024-54448 Remote Code Execution (RCE) via Automation Scripting
The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: LogicalDOC
product: LogicalDOC Community
default_status: unaffected
vendor: LogicalDOC
product: LogicalDOC Enterprise
default_status: unaffected
Credits: lang: en
value: Matthew Hogg
Published: 2025-03-14T18:01:25.311Z
CVE-2024-54449 Remote Code Execution (RCE) via Arbitrary File Write In Document API
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate RCE. An account with ‘read’ and ‘write’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: LogicalDOC
product: LogicalDOC Community
default_status: unaffected
vendor: LogicalDOC
product: LogicalDOC Enterprise
default_status: unaffected
Credits: lang: en
value: Matthew Hogg
Published: 2025-03-14T18:04:20.149Z
CVE-2024-54450 
An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the (possibly forged) IP address mentioned in that header rather than the real IP address that the user logged in from. This fake IP address can later be displayed in the My Account popup that shows the IP address that was used to log in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-27T00:00:00.000Z
CVE-2024-54451 
A cross-site scripting (XSS) vulnerability in the graphicCustomization.do page in Kurmi Provisioning Suite before 7.9.0.38, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15 allows remote attackers (authenticated as system administrators) to inject arbitrary web script or HTML via the COMPONENT_fields(htmlTitle) field, which is rendered in other pages of the application for all users (if the graphical customization has been activated by a super-administrator).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-27T00:00:00.000Z
CVE-2024-54452 
An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35 and 7.10.x through 7.10.0.18. A Directory Traversal and Local File Inclusion vulnerability in the logsSys.do page allows remote attackers (authenticated as administrators) to trigger the display of unintended files. Any file accessible to the Kurmi user account could be displayed, e.g., configuration files with information such as the database password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-27T00:00:00.000Z
CVE-2024-54453 
An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. A path traversal vulnerability in the DocServlet servlet allows remote attackers to retrieve any file from the Kurmi web application installation folder, e.g., files such as the obfuscated and/or compiled Kurmi source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-27T00:00:00.000Z
CVE-2024-54454 
An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable Response Discrepancy vulnerability in the sendPasswordReinitLink action of the unlogged.do page allows remote attackers to test whether a username is valid or not. This allows confirmation of valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-27T00:00:00.000Z
CVE-2024-54455 accel/ivpu: Fix general protection fault in ivpu_bo_list()
In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Fix general protection fault in ivpu_bo_list()

Check if ctx is not NULL before accessing its fields.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2025-01-11T12:35:42.392Z
CVE-2024-54456 NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()

name is char[64] where the size of clnt->cl_program->name remains
unknown. Invoking strcat() directly will also lead to potential buffer
overflow. Change them to strscpy() and strncat() to fix potential
issues.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2025-02-27T02:18:08.143Z
CVE-2024-54457 
Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to enable telnet service.
Problem types: cwe_id: CWE-1242
description: Inclusion of undocumented features or chicken bits
Affected products: vendor: FXC Inc.
product: AE1021
vendor: FXC Inc.
product: AE1021PE
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: 2024-12-18T06:37:11.912Z
CVE-2024-54458 scsi: ufs: bsg: Set bsg_queue to NULL after removal
In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: bsg: Set bsg_queue to NULL after removal

Currently, this does not cause any issues, but I believe it is necessary to
set bsg_queue to NULL after removing it to prevent potential use-after-free
(UAF) access.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2025-02-27T02:18:08.616Z
CVE-2024-54461 Unsanitized Filenames in Flutter package file_selector_android Allow File Overwrites
The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.5.1+12. It is recommended to update to the latest version of file_selector_android that contains the changes to address this vulnerability.
Problem types: cwe_id: CWE-23
description: CWE-23
Affected products: vendor: Flutter
product: file_selector_android
default_status: unaffected
Published: 2025-01-29T11:51:04.255Z