stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2024-30083 (severity: HIGH, weakness: CWE-121)
Windows Standards-Based Storage Management Service Denial of Service Vulnerability
CVE-2024-30084 (severity: HIGH, weakness: CWE-367)
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-30085 (severity: HIGH, weakness: CWE-122)
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2024-30086 (severity: HIGH, weakness: CWE-416)
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2024-30087 (severity: HIGH, weakness: CWE-20)
Win32k Elevation of Privilege Vulnerability
CVE-2024-30088 (severity: HIGH, weakness: CWE-367)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-30089 (severity: HIGH, weakness: CWE-416)
Microsoft Streaming Service Elevation of Privilege Vulnerability
CVE-2024-3009 (severity: HIGH, weakness: CWE-77)
A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-30090 (severity: HIGH, weakness: CWE-822)
Microsoft Streaming Service Elevation of Privilege Vulnerability
CVE-2024-30091 (severity: HIGH, weakness: CWE-122)
Win32k Elevation of Privilege Vulnerability
CVE-2024-30092 (severity: HIGH, weakness: CWE-20)
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2024-30093 (severity: HIGH, weakness: CWE-59)
Windows Storage Elevation of Privilege Vulnerability
CVE-2024-30094 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30095 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30096 (severity: MEDIUM, weakness: CWE-200)
Windows Cryptographic Services Information Disclosure Vulnerability
CVE-2024-30097 (severity: HIGH, weakness: CWE-415)
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
CVE-2024-30098 (severity: HIGH, weakness: CWE-327)
Windows Cryptographic Services Security Feature Bypass Vulnerability
CVE-2024-30099 (severity: HIGH, weakness: CWE-367)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-3010 (severity: HIGH, weakness: CWE-121)
A vulnerability was found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this issue is the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-30100 (severity: HIGH, weakness: CWE-426)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-30101 (severity: HIGH, weakness: CWE-416)
Microsoft Office Remote Code Execution Vulnerability
CVE-2024-30102 (severity: HIGH, weakness: CWE-416)
Microsoft Office Remote Code Execution Vulnerability
CVE-2024-30103 (severity: HIGH, weakness: CWE-184)
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-30104 (severity: HIGH, weakness: CWE-59)
Microsoft Office Remote Code Execution Vulnerability
CVE-2024-30105 (severity: HIGH, weakness: CWE-400)
.NET and Visual Studio Denial of Service Vulnerability
CVE-2024-30106 (severity: MEDIUM, weakness: CWE-200)
HCL Connections is vulnerable to an information disclosure vulnerability, due to an IBM WebSphere Application Server error, which could allow a user to obtain sensitive information they are not entitled to due to the improper handling of request data.
CVE-2024-30107 (severity: LOW, weakness: CWE-284)
HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.
CVE-2024-30109 (severity: LOW, weakness: CWE-1021)
HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended.
CVE-2024-3011 (severity: HIGH, weakness: CWE-121)
A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258297 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-30110 (severity: LOW, weakness: CWE-20)
HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system which can cause the system to behave in unexpected ways.
CVE-2024-30111 (severity: LOW, weakness: CWE-1326)
HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due to which malicious users can gain unauthorized access to the rooted devices, compromising security and potentially leading to data breaches or other malicious activities.
CVE-2024-30112 (severity: MEDIUM, weakness: CWE-79)
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.
CVE-2024-30113 (severity: MEDIUM, weakness: CWE-79)
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
CVE-2024-30114 (severity: LOW, weakness: CWE-79)
Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.
CVE-2024-30115 (severity: MEDIUM, weakness: CWE-79)
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
CVE-2024-30117 (severity: MEDIUM, weakness: CWE-427)
A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.
CVE-2024-30118 (severity: MEDIUM, weakness: CWE-200)
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to because of improperly handling the request data.
CVE-2024-30119 (severity: LOW, weakness: CWE-522)
HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data during redirection.
CVE-2024-3012 (severity: HIGH, weakness: CWE-121)
A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been declared as critical. This vulnerability affects the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258298 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-30120 (severity: LOW, weakness: CWE-563)
HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application.
CVE-2024-30122 (severity: MEDIUM, weakness: CWE-922)
HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers.
CVE-2024-30124 (severity: MEDIUM, weakness: CWE-1188)
HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.
CVE-2024-30125 (severity: MEDIUM, weakness: CWE-918)
HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.
CVE-2024-30126 (severity: MEDIUM, weakness: CWE-79)
HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target website in a frame or iframe, tricking users into performing actions on the target website without their knowledge.
CVE-2024-30127 (severity: LOW, weakness: CWE-524)
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
CVE-2024-30128 (severity: HIGH, weakness: CWE-441)
HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may enable an attacker to trick the user into exposing sensitive information.
CVE-2024-30129 (severity: MEDIUM, weakness: CWE-644)
The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address.
CVE-2024-3013 (severity: MEDIUM, weakness: CWE-285)
A vulnerability was found in FLIR AX8 up to 1.46.16. It has been rated as critical. This issue affects some unknown processing of the file /tools/test_login.php?action=register of the component User Registration. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258299. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-30130 (severity: LOW, weakness: CWE-525)
HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.
CVE-2024-30132 (severity: LOW, weakness: CWE-922)
HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors.
CVE-2024-30133 (severity: MEDIUM, weakness: CWE-670)
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
CVE-2024-30134 (severity: MEDIUM, weakness: CWE-295)
The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application.
CVE-2024-30135 (severity: LOW, weakness: CWE-200)
HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken.
CVE-2024-3014 (severity: HIGH, weakness: CWE-89)
A vulnerability classified as critical has been found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file Actions.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258300.
CVE-2024-30140 (severity: MEDIUM, weakness: CWE-601)
HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the web cache and provide back to users being served the page.
CVE-2024-30141 (severity: MEDIUM, weakness: CWE-209)
HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement information or expose information about its environment, users, or associated data.
CVE-2024-30142 (severity: LOW, weakness: CWE-614)
HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel.
CVE-2024-30143 (severity: MEDIUM, weakness: CWE-22)
HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing it to resolve to a location beyond the restricted directory. Potential exploits can completely disrupt or takeover the application or the computer where the application is running.
CVE-2024-30145 (severity: MEDIUM, weakness: CWE-79)
Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.
CVE-2024-30146 (severity: MEDIUM, weakness: CWE-284)
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.
CVE-2024-30147 (severity: MEDIUM, weakness: CWE-79)
Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.
CVE-2024-30148 (severity: MEDIUM, weakness: CWE-284)
Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.
CVE-2024-30149 (severity: MEDIUM, weakness: CWE-295)
HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable.
CVE-2024-3015 (severity: HIGH, weakness: CWE-89)
A vulnerability classified as critical was found in SourceCodester Simple Subscription Website 1.0. Affected by this vulnerability is an unknown functionality of the file manage_plan.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258301 was assigned to this vulnerability.
CVE-2024-30150 (severity: MEDIUM, weakness: CWE-269)
HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery (SSRF) and Denial of Service(DOS) attacks from unauthenticated users.
CVE-2024-30152 (severity: MEDIUM, weakness: CWE-327)
HCL SX v21 is affected by usage of a weak cryptographic algorithm. An attacker could exploit this weakness to gain access to sensitive information, modify data, or other impacts.
CVE-2024-30154 (severity: MEDIUM, weakness: CWE-352)
HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVE-2024-30155 (severity: MEDIUM, weakness: CWE-1275)
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
CVE-2024-30156 (severity: HIGH, weakness: CWE-770)
Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.
CVE-2024-30157 (severity: HIGH, weakness: CWE-89)
A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.
CVE-2024-30158 (severity: HIGH, weakness: CWE-89)
A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.
CVE-2024-30159 (severity: MEDIUM, weakness: CWE-79)
A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.
CVE-2024-3016 (severity: CRITICAL, weakness: CWE-912)
NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticated user.
CVE-2024-30160 (severity: MEDIUM, weakness: CWE-79)
A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.
CVE-2024-30161 (severity: MEDIUM, weakness: CWE-416)
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
CVE-2024-30162 (severity: HIGH, weakness: CWE-345)
Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users (with the toolbar_manage permission) to write arbitrary PHP files into that directory, leading to execution of arbitrary PHP code in the context of the web server user.
CVE-2024-30163 (severity: CRITICAL, weakness: CWE-89)
Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries. This can be exploited by unauthenticated attackers to carry out Blind SQL Injection attacks.
CVE-2024-30164 (severity: MEDIUM, weakness: CWE-120)
Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions. This is resolved in 3.11.1 on Windows, 3.9.1 on macOS, and 3.12.1 on Linux. NOTE: although the macOS resolution is the same as for CVE-2024-30165, this vulnerability on macOS is not the same as CVE-2024-30165.
CVE-2024-30165 (severity: HIGH, weakness: CWE-120)
Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE-2024-30164.
CVE-2024-30166 (severity: CRITICAL, weakness: CWE-121)
In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read (of less than 256 bytes) in a TLS 1.3 server via a TLS 3.1 ClientHello.
CVE-2024-3017 (severity: MEDIUM, weakness: CWE-119)
In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor (RCP) causes the OpenThread Border Router(OTBR) application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service.
CVE-2024-30170 (severity: HIGH, weakness: CWE-400)
PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,
CVE-2024-30171 (severity: MEDIUM, weakness: CWE-203)
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.
CVE-2024-30172 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
CVE-2024-30176 (severity: MEDIUM, weakness: CWE-203)
In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets.
CVE-2024-30177 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons Exclusive Addons Elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through 2.6.8.
CVE-2024-30178 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patrick Posner Simply Static allows Stored XSS.This issue affects Simply Static: from n/a through 3.1.3.
CVE-2024-30179 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 4.7.6.
CVE-2024-3018 (severity: HIGH, weakness: CWE-502)
The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the "Login | Register Form" widget (disabled by default). This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVE-2024-30180 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Social Feed allows Stored XSS.This issue affects Easy Social Feed: from n/a through 6.5.3.
CVE-2024-30181 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plainware Locatoraid Store Locator allows Stored XSS.This issue affects Locatoraid Store Locator: from n/a through 3.9.30.
CVE-2024-30182 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Mega allows Stored XSS.This issue affects HT Mega: from n/a through 2.4.3.
CVE-2024-30183 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for WPBakery Page Builder allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through 3.7.
CVE-2024-30184 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Looking Forward Software Incorporated. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 4.2.6.
CVE-2024-30185 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.
CVE-2024-30186 (severity: MEDIUM, weakness: CWE-79)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.1.