rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-52479 HTTP.jl vulnerable to CR/LF Injection in URIs
HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise escaped or protected, this can lead to a CRLF injection attack. Users of HTTP.jl should upgrade immediately to HTTP.jl v1.10.17, and users of URIs.jl should upgrade immediately to URIs.jl v1.6.0. The check for valid URIs is now in the URI.jl package, and the latest version of HTTP.jl incorporates that fix. As a workaround, manually validate any URIs before passing them on to functions in this package.
Problem types: cwe_id: CWE-93
description: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
cwe_id: CWE-113
description: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Affected products: vendor: JuliaWeb
product: HTTP.jl
Published: 2025-06-25T16:06:45.402Z
CVE-2025-52480 Registrator.jl Argument Injection Vulnerability
Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), an argument injection is possible in the `gettreesha()` function. This can then lead to a potential remote code execution. Users should upgrade immediately to v1.9.5 to receive a patch. All prior versions are vulnerable. No known workarounds are available.
Problem types: cwe_id: CWE-88
description: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: JuliaRegistries
product: Registrator.jl
Published: 2025-06-25T16:37:32.944Z
CVE-2025-52482 Chamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.php
Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: chamilo
product: chamilo-lms
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
version: 3.1
Published: 2026-03-02T14:39:50.143Z
CVE-2025-52483 Registrator.jl Vulnerable to Argument Injection and Command Injection
Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the `withpasswd` function. Alternatively, an argument injection is possible in the `gettreesha `function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: JuliaRegistries
product: Registrator.jl
Published: 2025-06-25T16:39:45.707Z
CVE-2025-52484 RISC Zero zkVM Underconstrained Vulnerability
RISC Zero is a general computing platform based on zk-STARKs and the RISC-V microarchitecture. Due to a missing constraint in the rv32im circuit, any 3-register RISC-V instruction (including remu and divu) in risc0-zkvm 2.0.0, 2.0.1, and 2.0.2 are vulnerable to an attack by a malicious prover. The main idea for the attack is to confuse the RISC-V virtual machine into treating the value of the rs1 register as the same as the rs2 register due to a lack of constraints in the rv32im circuit. Rust applications using the risc0-zkvm crate at versions 2.0.0, 2.0.1, and 2.0.2 should upgrade to version 2.1.0. Smart contract applications using the official RISC Zero Verifier Router do not need to take any action: zkVM version 2.1 is active on all official routers, and version 2.0 has been disabled. Smart contract applications not using the verifier router should update their contracts to send verification calls to the 2.1 version of the verifier.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: risc0
product: risc0
Published: 2025-06-20T17:21:28.392Z
CVE-2025-52485 DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue has been patched in version 10.0.1.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: dnnsoftware
product: Dnn.Platform
Published: 2025-06-21T02:40:38.257Z
CVE-2025-52486 DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been patched in version 10.0.1.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: dnnsoftware
product: Dnn.Platform
Published: 2025-06-21T02:42:47.816Z
CVE-2025-52487 DNN.PLATFORM possibly allows bypass of IP Filters
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request or proxy to be created that could bypass the design of DNN Login IP Filters allowing login attempts from IP Addresses not in the allow list. This issue has been patched in version 10.0.1.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: dnnsoftware
product: Dnn.Platform
Published: 2025-06-21T02:44:58.636Z
CVE-2025-52488 DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: dnnsoftware
product: Dnn.Platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-06-21T02:51:25.252Z
CVE-2025-52490 
An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2025-52491 
Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Akamai
product: CloudTest
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Published: 2025-06-30T00:00:00.000Z
CVE-2025-52492 
A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy of the firmware can extract these credentials. This could allow the attacker to gain unauthorized access to the associated Twilio account, leading to information disclosure, potential service disruption, and unauthorized use of the Twilio services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-07T00:00:00.000Z
CVE-2025-52493 
PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present in the page source and can be revealed by simply modifying the input field type from "password" to "text" using browser developer tools. This vulnerability is exploitable by administrative users who have access to the configuration page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-10T00:00:00.000Z
CVE-2025-52494 
Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes during connection initialization. When a client initiates an HTTPS connection, the server performs the SSL handshake before assigning the connection to a processing slot. However, there is no specific timeout set for this phase, and the server uses the default socket timeout, which is effectively infinite. An attacker can exploit this by sending a malformed TLS ClientHello message with incorrect length values. This causes the server to wait indefinitely for data that never arrives, blocking the worker thread (Line) handling the connection. By opening multiple such connections, up to the server's maximum limit, the attacker can exhaust all available working threads, preventing the server from handling new, legitimate requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-03T00:00:00.000Z
CVE-2025-52496 
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.
Problem types: cwe_id: CWE-733
description: CWE-733 Compiler Optimization Removal or Modification of Security-critical Code
Affected products: vendor: Mbed
product: mbedtls
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Published: 2025-07-04T00:00:00.000Z
CVE-2025-52497 
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
Problem types: cwe_id: CWE-193
description: CWE-193 Off-by-one Error
Affected products: vendor: Mbed
product: mbedtls
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Published: 2025-07-04T00:00:00.000Z
CVE-2025-52512 
An issue was discovered in Samsung Mobile Processor Exynos 2400, 1580, 2500. A race condition in the HTS driver results in out-of-bounds memory access, leading to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-04T00:00:00.000Z
CVE-2025-52513 
An issue was discovered in Samsung Mobile Processor Exynos 2400, 1580, 2500. A race condition in the HTS driver results in an out-of-bounds write, leading to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-04T00:00:00.000Z
CVE-2025-52515 
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the issimian device driver results in an out-of-bounds access, leading to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-05T00:00:00.000Z
CVE-2025-52516 
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalid kernel address dereference in the issimian device driver leads to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-05T00:00:00.000Z
CVE-2025-52517 
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the issimian device driver results in a double free, leading to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-05T00:00:00.000Z
CVE-2025-52519 
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Improper validation of user-space input in the issimian device driver leads to information disclosure and a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-05T00:00:00.000Z
CVE-2025-52520 Apache Tomcat: DoS via integer overflow in multipart file upload
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions 
may also be affected.


Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: Saravana Kumar
Published: 2025-07-10T19:05:41.637Z
CVE-2025-52521 
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
Problem types: cwe_id: CWE-64
description: CWE-64: Windows Shortcut Following (.LNK)
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Security (Consumer)
cpes: cpe:2.3:a:trendmicro:maximum_security_2023:17.8:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2025-07-10T18:57:25.462Z
CVE-2025-52532 
A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler could be exploited by an attacker to trigger a heap-based buffer overflow, potentially resulting in denial-of-service within the vulnerable system context.
Problem types: cwe_id: CWE-367
description: CWE-367  Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: AMD
product: AMD Radeon™ PRO V620
default_status: affected
vendor: AMD
product: AMD Radeon™ PRO V710
default_status: affected
vendor: AMD
product: AMD Instinct™ MI250
default_status: affected
vendor: AMD
product: AMD Instinct™ MI308X
default_status: affected
vendor: AMD
product: AMD Instinct™ MI300A
default_status: affected
vendor: AMD
product: AMD Instinct™ MI300X
default_status: affected
vendor: AMD
product: AMD Instinct™ MI325X
default_status: affected
vendor: AMD
product: AMD Instinct™ MI210
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T02:59:46.954Z
CVE-2025-52534 
Improper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integrity.
Problem types: cwe_id: CWE-1284
description: CWE-1284  Improper Validation of Specified Quantity in Input
Affected products: vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
Published: 2026-02-10T19:12:52.004Z
CVE-2025-52536 
Improper Prevention of Lock Bit Modification in SEV firmware could allow a privileged attacker to downgrade firmware potentially resulting in a loss of integrity.
Problem types: cwe_id: CWE-1231
description: CWE-1231  Improper Prevention of Lock Bit Modification
Affected products: vendor: AMD
product: AMD EPYC™ 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 8004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 8004 Series Processors
default_status: affected
Published: 2026-02-10T19:09:04.084Z
CVE-2025-52538 
Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability.
Problem types: cwe_id: CWE-190
description: CWE-190  Integer Overflow or Wraparound
Affected products: vendor: AMD
product: Xilinx Run Time (XRT)
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
baseScore: 8
baseSeverity: HIGH
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2025-11-24T20:38:06.450Z
CVE-2025-52539 
A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability.
Problem types: cwe_id: CWE-121
description: CWE-121  Stack-based Buffer Overflow
Affected products: vendor: AMD
product: Xilinx Run Time (XRT)
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2025-11-24T19:42:46.919Z
CVE-2025-52540 
An improper input validation vulnerability within the AMD Platform Management Framework (PMF) Driver can allow a local attacker to write Out-of-Bounds, potentially resulting in privilege escalation.
Problem types: cwe_id: CWE-787
description: CWE-787  Out-of-bounds Write
Affected products: vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:51:25.234Z
CVE-2025-52541 
A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Problem types: cwe_id: CWE-427
description: CWE-427  Uncontrolled Search Path Element
Affected products: vendor: AMD
product: Vivado™ Installation (Windows)
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
Published: 2026-02-11T14:43:01.995Z
CVE-2025-52543 Login to the application services using only the password hash
E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.
Problem types: cwe_id: CWE-836
description: CWE-836 Use of Password Hash Instead of Password for Authentication
Affected products: vendor: Copeland LP
product: E3 Supervisory Control
default_status: affected
Credits: lang: en
value: Armis Labs
Published: 2025-09-02T11:24:32.443Z
CVE-2025-52544 Arbitrary read file from the filesystem
E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Copeland LP
product: E3 Supervisory Control
default_status: affected
Credits: lang: en
value: Armis Labs
Published: 2025-09-02T11:25:01.106Z
CVE-2025-52545 Privilege escalation in the application services
E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Copeland LP
product: E3 Supervisory Control
default_status: affected
Credits: lang: en
value: Armis Labs
Published: 2025-09-02T11:25:22.792Z
CVE-2025-52546 Stored XSS by uploading a specially crafted floor plan file
E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Copeland LP
product: E3 Supervisory Control
default_status: affected
Credits: lang: en
value: Armis Labs
Published: 2025-09-02T11:25:39.864Z
CVE-2025-52547 DoS to the application services
E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Copeland LP
product: E3 Supervisory Control
default_status: affected
Credits: lang: en
value: Armis Labs
Published: 2025-09-02T11:25:54.718Z