Dunateo/VulnDesc_CWE_Mapping huggingface dataset:
plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MKV file, possibly involving an integer overflow and out-of-bounds read or heap-based buffer overflow, or an uncaught exception.  NOTE: the vendor disputes the severity and claimed vulnerability type of this issue, stating "This PoC crashes VLC, indeed, but does nothing more... this is not an integer overflow error, but an uncaught exception and I doubt that it is exploitable. This uncaught exception makes VLC abort, not execute random code, on my Linux 64bits machine." A PoC posted by the original researcher shows signs of an attacker-controlled out-of-bounds read, but the affected instruction does not involve a register that directly influences control flow
Weakness: CWE-125 Out-of-bounds Read
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.
Weakness: CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation.
Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
Weakness: CWE-352 Cross-Site Request Forgery (CSRF)
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.
Weakness: CWE-20 Improper Input Validation
By sending specific queries to the resolver, an attacker can cause named to crash.
Weakness: CWE-613 Insufficient Session Expiration
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Weakness: CWE-416 Use After Free
Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via a Virtual Network Function (VNF) descriptor. An attacker may be able execute code to change the normal execution of the OSM components, retrieve confidential information, or gain access other parts of a Telco Operator infrastructure other than OSM itself.
Weakness: CWE-286 Incorrect User Management
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.
Weakness: CWE-284 Improper Access Control
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to command execution. NOTE: the vendor's position is that this is "very obviously a feature not an issue and if you don't like that feature it is very obvious how to disable it."
Weakness: CWE-434 Unrestricted Upload of File with Dangerous Type
Microsoft Outlook for Mac Spoofing Vulnerability
Weakness: CWE-290 Authentication Bypass by Spoofing
An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cmm_open() and cm4000_detach().
Weakness: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Secure Boot Security Feature Bypass Vulnerability
Weakness: CWE-863 Incorrect Authorization
Windows Boot Manager Security Feature Bypass Vulnerability
Weakness: CWE-863 Incorrect Authorization
Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware.
Weakness: CWE-798 Use of Hard-coded Credentials
In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depending on whether the email address is associated with any account. This allows remote attackers to enumerate accounts via a series of requests.
Weakness: CWE-203 Observable Discrepancy
The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no private-key file exists. Thus, this hardcoded key is likely to be used by default.
Weakness: CWE-259 Use of Hard-coded Password
Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. NOTE: this is disputed by the vendor because an admin is intentionally allowed to upload new executable PHP code, such as a theme that was obtained from a trusted source or was developed for their own website. Only an admin can upload such code, not someone else in an "attacker" role.
Weakness: CWE-863 Incorrect Authorization
Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and could allow privilege escalation from a low-privileged read-only user to a high-privileged user.
Weakness: CWE-284 Improper Access Control
Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.
Weakness: CWE-502 Deserialization of Untrusted Data
An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role via UserWSUserManager.
Weakness: CWE-284 Improper Access Control
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note: The project owner believes this is intended behavior of the application as it only allows authenticated admins to upload files.
Weakness: CWE-434 Unrestricted Upload of File with Dangerous Type
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the video description parameter.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Windows ALPC Elevation of Privilege Vulnerability
Weakness: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Weakness: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Windows Mark of the Web Security Feature Bypass Vulnerability
Weakness: CWE-863 Incorrect Authorization
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
Weakness: CWE-823 Use of Out-of-range Pointer Offset
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single_employee.php.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The CapsuleIFWUSmm driver does not check the return value from a method or function. This can prevent it from detecting unexpected states and conditions.
Weakness: CWE-252 Unchecked Return Value
Revenue Collection System v1.0 was discovered to contain a SQL injection vulnerability at step1.php.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer.While a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow.  This insufficient bounds checking could lead to kernel memory corruption.On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Improper access control for some Intel(R) Thunderbolt driver software before version 89 may allow an authenticated user to potentially enable escalation of privilege via local access.
Weakness: CWE-284 Improper Access Control
Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. NOTE: the vendor's perspective is that the behavior is as intended
Weakness: CWE-862 Missing Authorization
In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting (XSS) attack on /file.bootloader.upload.html. The application fails to sanitize the parameter filename, in a POST request to /file.bootloader.upload.html for a system update, thus allowing one to inject HTML and/or JavaScript on the page that will then be processed and stored by the application. Any subsequent requests to pages that retrieve the malicious content will automatically exploit the vulnerability on the victim's browser. This also happens because the tag is loaded in the function innerHTML in the page HTML.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be done using the 'isis.prototyping.h2-console.web-allow-remote-access' configuration property
Weakness: CWE-306: Missing Authentication for Critical Function
OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate user from a VNC session. A remote attacker with network access to the proxy server could leverage this vulnerability to connect to VNC servers protected by the proxy server without providing any authentication credentials. Exploitation of this issue requires that the proxy server is currently accepting connections for the target VNC server.
Weakness: CWE-287 Improper Authentication
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow the execution of specific command injections on selected binaries in the ADB daemon shell service. The attacker must have physical USB access to the device in order to exploit this vulnerability.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Windows DNS Server Remote Code Execution Vulnerability
Weakness: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Skype for Business and Lync Spoofing Vulnerability
Weakness: CWE-290 Authentication Bypass by Spoofing
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attacker must have shell access to the device in order to exploit this vulnerability.
Weakness: CWE-20 Improper Input Validation
LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability
Weakness: CWE-35: Path Traversal: '.../...//'
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.5. Processing a maliciously crafted tiff file may lead to arbitrary code execution.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
An issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the device. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
Weakness: CWE-400 Uncontrolled Resource Consumption
An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. This affects Nuki Smart Lock 3.0 before 3.3.5 and 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
An issue was discovered on certain Nuki Home Solutions devices. There is a buffer overflow over the encrypted token parsing logic in the HTTP service that allows remote code execution. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
Weakness: CWE-121 Stack-based Buffer Overflow
An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to this JTAG port may be able to connect to the device and bypass both hardware and software security protections. This affects Nuki Keypad before 1.9.2 and Nuki Fob before 1.8.1.
Weakness: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials.
Weakness: CWE-284 Improper Access Control
An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by booting into Safe Mode. This allows a file to be exchanged outside the laptop/system. Safe Mode can be launched by any user (even without admin rights). Data exfiltration can occur, and also malware might be introduced onto the system. NOTE: the vendor's position is "it's not a vulnerability in our product."
Weakness: CWE-288 Authentication Bypass Using an Alternate Path or Channel
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-121 Stack-based Buffer Overflow
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Weakness: CWE-787 Out-of-bounds Write
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Weakness: CWE-426 Untrusted Search Path
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
Weakness: CWE-276 Incorrect Default Permissions
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur
Weakness: CWE-122 Heap-based Buffer Overflow
D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSettings.php
Weakness: CWE-1052 Excessive Use of Hard-Coded Literals in Initialization
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
Weakness: CWE-256 Plaintext Storage of a Password
In the Linux kernel, the following vulnerability has been resolved:ASoC: codecs: wcd938x: fix incorrect used of portidMixer controls have the channel id in mixer->reg, which is not sameas port id. port id should be derived from chan_info array.So fix this. Without this, its possible that we could corruptstruct wcd938x_sdw_priv by accessing port_map array out of rangewith channel id instead of port id.
Weakness: CWE-400 Uncontrolled Resource Consumption
In the Linux kernel, the following vulnerability has been resolved:firmware: arm_scmi: Harden accesses to the reset domainsAccessing reset domains descriptors by the index upon the SCMI driversrequests through the SCMI reset operations interface can potentiallylead to out-of-bound violations if the SCMI driver misbehave.Add an internal consistency check before any such domains descriptorsaccesses.
Weakness: CWE-125 Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved:block: Fix wrong offset in bio_truncate()bio_truncate() clears the buffer outside of last block of bdev, howevercurrent bio_truncate() is using the wrong offset of page. So it canreturn the uninitialized data.This happened when both of truncated/corrupted FS and userspace (viabdev) are trying to read the last of bdev.
Weakness: CWE-908 Use of Uninitialized Resource
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.
Weakness: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved:fsdax: Fix infinite loop in dax_iomap_rw()I got an infinite loop and a WARNING report when executing a tail commandin virtiofs.  WARNING: CPU: 10 PID: 964 at fs/iomap/iter.c:34 iomap_iter+0x3a2/0x3d0  Modules linked in:  CPU: 10 PID: 964 Comm: tail Not tainted 5.19.0-rc7  Call Trace:  <TASK>  dax_iomap_rw+0xea/0x620  ? __this_cpu_preempt_check+0x13/0x20  fuse_dax_read_iter+0x47/0x80  fuse_file_read_iter+0xae/0xd0  new_sync_read+0xfe/0x180  ? 0xffffffff81000000  vfs_read+0x14d/0x1a0  ksys_read+0x6d/0xf0  __x64_sys_read+0x1a/0x20  do_syscall_64+0x3b/0x90  entry_SYSCALL_64_after_hwframe+0x63/0xcdThe tail command will call read() with a count of 0. In this case,iomap_iter() will report this WARNING, and always return 1 which casuingthe infinite loop in dax_iomap_rw().Fixing by checking count whether is 0 in dax_iomap_rw().
Weakness: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
In the Linux kernel, the following vulnerability has been resolved:bnxt: prevent skb UAF after handing over to PTP workerWhen reading the timestamp is required bnxt_tx_int() handsover the ownership of the completed skb to the PTP worker.The skb should not be used afterwards, as the worker mayrun before the rest of our code and free the skb, leadingto a use-after-free.Since dev_kfree_skb_any() accepts NULL make the loss ofownership more obvious and set skb to NULL.
Weakness: CWE-416 Use After Free
In the Linux kernel, the following vulnerability has been resolved:net: bridge: vlan: fix memory leak in __allowed_ingressWhen using per-vlan state, if vlan snooping and stats are disabled,untagged or priority-tagged ingress frame will go to check pvid state.If the port state is forwarding and the pvid state is notlearning/forwarding, untagged or priority-tagged frame will be droppedbut skb memory is not freed.Should free skb when __allowed_ingress returns false.
Weakness: CWE-400 Uncontrolled Resource Consumption
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13. An app may be able to break out of its sandbox.
Weakness: CWE-284 Improper Access Control
The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled old_tf_topic_name and/or new_tf_topic_name parameter. NOTE: the vendor's position is "it is the responsibility of the programmer to make sure that only known and required parameters are set and unexpected parameters are not."
Weakness: CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)