Dunateo/VulnDesc_CWE_Mapping huggingface dataset:
Cross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the /WebSet/DlgGridSet.html component.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single quotes are not used when sending a list of app IDs and titles via the environment.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Weakness: CWE-121 Stack-based Buffer Overflow
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1
Weakness: CWE-352 Cross-Site Request Forgery (CSRF)
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.
Weakness: CWE-347 Improper Verification of Cryptographic Signature
Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-863 Incorrect Authorization
Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the Endpoint Protector and Unify agent in the way that the EasyLock dependency is acquired from the server. An attacker with administrative access to the Endpoint Protector or Unify server can cause a client to acquire and execute a malicious file resulting in remote code execution.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4.
Weakness: CWE-1246 Improper Write Handling in Limited-write Non-Volatile Memories
An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
A stack overflow vulnerability was found in version 1.18.0 of rhai. The flaw position is: (/ SRC/rhai/SRC/eval/STMT. Rs in rhai: : eval: : STMT: : _ $LT $impl $u20 $rhai.. engine.. Engine$GT$::eval_stmt::h3f1d68ce37fc6e96). Due to the stack overflow is a recursive call/SRC/rhai/SRC/eval/STMT. Rs file eval_stmt_block function.
Weakness: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes (which run with the environment and permissions of the Zammad user).
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.
Weakness: CWE-288 Authentication Bypass Using an Alternate Path or Channel
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function.
Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.
Weakness: CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
An invalid pointer in the modbus_receive() function of libmodbus v3.1.6 allows attackers to cause a Denial of Service (DoS) via a crafted message sent to the unit-test-server.
Weakness: CWE-400 Uncontrolled Resource Consumption
Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-276 Incorrect Default Permissions
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-284 Improper Access Control
TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.
Weakness: CWE-798 Use of Hard-coded Credentials
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on the Splunk platform Instance.
Weakness: CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.
Weakness: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allow a remote unauthenticated attacker to execute an arbitrary OS command, obtain and/or alter sensitive information, and be able to cause a denial of service (DoS) condition.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer protocol.
Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
An arbitrary memory write vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4.
Weakness: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
In the Linux kernel, the following vulnerability has been resolved:drm/vmwgfx: Fix invalid reads in fence signaled eventsCorrectly set the length of the drm_event to the size of the structurethat's actually used.The length of the drm_event was set to the parent structure instead ofto the drm_vmw_event_fence which is supposed to be read. drm_readuses the length parameter to copy the event to the user space thusresuling in oob reads.
Weakness: CWE-125 Out-of-bounds Read
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance.
Weakness: CWE-285 Improper Authorization
The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution vulnerability due to the way an archive obtained from the Endpoint Protector or Unify server is extracted on the endpoint. An attacker who is able to modify the archive on the server could obtain remote code execution as an administrator on an endpoint.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-284 Improper Access Control
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.
Weakness: CWE-502 Deserialization of Untrusted Data
eLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform an authorization check which can lead to card duplication and other attacks.
Weakness: CWE-285 Improper Authorization
Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, unintended operations may be performed on the PC.
Weakness: CWE-798 Use of Hard-coded Credentials
In the Linux kernel, the following vulnerability has been resolved:USB: core: Fix access violation during port device removalTesting with KASAN and syzkaller revealed a bug in port.c:disable_store():usb_hub_to_struct_hub() can return NULL if the hub that the port belongs tois concurrently removed, but the function does not check for thispossibility before dereferencing the returned value.It turns out that the first dereference is unnecessary, since hub->intfdevis the parent of the port device, so it can be changed easily.  Adding acheck for hub == NULL prevents further problems.The same bug exists in the disable_show() routine, and it can be fixed thesame way.
Weakness: CWE-476 NULL Pointer Dereference
In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()Extend a critical section to prevent chan from early freeing.Also make the l2cap_connect() return type void. Nothing is using thereturned value but it is ugly to return a potentially freed pointer.Making it void will help with backports because earlier kernels did usethe return value. Now the compile will break for kernels where thispatch is not a complete fix.Call stack summary:[use]l2cap_bredr_sig_cmd  l2cap_connect  ┌ mutex_lock(&conn->chan_lock)
Weakness: CWE-416: Use After Free
In the Linux kernel, the following vulnerability has been resolved:uio_hv_generic: Don't free decrypted memoryIn CoCo VMs it is possible for the untrusted host to causeset_memory_encrypted() or set_memory_decrypted() to fail such that anerror is returned and the resulting memory is shared. Callers need totake care to handle these errors to avoid returning decrypted (shared)memory to the page allocator, which could lead to functional or securityissues.The VMBus device UIO driver could free decrypted/shared pages ifset_memory_decrypted() fails. Check the decrypted field in the gpadlto decide whether to free the memory.
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
An improper input validation allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request.
Weakness: CWE-665 Improper Initialization
SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitive information and cause other impacts via `pk_isotope::saveData` and `pk_isotope::removeData` methods.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
In the Linux kernel, the following vulnerability has been resolved:powerpc/pseries/iommu: LPAR panics during boot up with a frozen PEAt the time of LPAR boot up, partition firmware provides Open Firmwareproperty ibm,dma-window for the PE. This property is provided on the PCIbus the PE is attached to.There are execptions where the partition firmware might not provide thisproperty for the PE at the time of LPAR boot up. One of the scenario iswhere the firmware has frozen the PE due to some error condition. ThisPE is frozen for 24 hours or unless the whole system is reinitialized.Within this time frame, if the LPAR is booted, the frozen PE will bepresented to the LPAR but ibm,dma-window property could be missing.Today, under these circumstances, the LPAR oopses with NULL pointerdereference, when configuring the PCI bus the PE is attached to.  BUG: Kernel NULL pointer dereference on read at 0x000000c8  Faulting instruction address: 0xc0000000001024c0  Oops: Kernel access of bad area, sig: 7 [#1]  LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries  Modules linked in:  Supported: Yes  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-150600.9-default #1  Hardware name: IBM,9043-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_023) hv:phyp pSeries  NIP:  c0000000001024c0 LR: c0000000001024b0 CTR: c000000000102450  REGS: c0000000037db5c0 TRAP: 0300   Not tainted  (6.4.0-150600.9-default)  MSR:  8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE>  CR: 28000822  XER: 00000000  CFAR: c00000000010254c DAR: 00000000000000c8 DSISR: 00080000 IRQMASK: 0  ...  NIP [c0000000001024c0] pci_dma_bus_setup_pSeriesLP+0x70/0x2a0  LR [c0000000001024b0] pci_dma_bus_setup_pSeriesLP+0x60/0x2a0  Call Trace:    pci_dma_bus_setup_pSeriesLP+0x60/0x2a0 (unreliable)    pcibios_setup_bus_self+0x1c0/0x370    __of_scan_bus+0x2f8/0x330    pcibios_scan_phb+0x280/0x3d0    pcibios_init+0x88/0x12c    do_one_initcall+0x60/0x320    kernel_init_freeable+0x344/0x3e4    kernel_init+0x34/0x1d0    ret_from_kernel_user_thread+0x14/0x1c
Weakness: CWE-476 NULL Pointer Dereference
FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to use the debug function logs in to the product, the debug function may be used and an arbitrary OS command may be executed.
Weakness: CWE-489 Active Debug Code
Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logging component of the Endpoint Protector and Unify server application which allows an unauthenticated remote attacker to send a malicious request, resulting in the ability to execute system commands with root privileges.
Weakness: CWE-779 Logging of Excessive Data
An SMM callout vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4.
Weakness: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.
Weakness: CWE-259 Use of Hard-coded Password
LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for IIS Web Server and SiteMinder Web Agent for Domino Web Server. As a result, an attacker can execute arbitrary Javascript code in a client browser.
Weakness: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.
Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules). An unauthenticated user can post crafted data to the interface that triggers a stack buffer overflow, and may lead to arbitrary remote code execution on a BMC.
Weakness: CWE-121 Stack-based Buffer Overflow
An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.
Weakness: CWE-193 Off-by-one Error
Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the shadowing component of the Endpoint Protector and Unify agent which allows an attacker with administrative access to the Endpoint Protector or Unify server to overwrite sensitive configuration and subsequently execute system commands with SYSTEM/root privileges on a chosen client endpoint.
Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_data_received_cb, and Service.remove. A user can modify a service name in a ~/.linuxmint/mintUpload/services/service file.
Weakness: CWE-20 Improper Input Validation
In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
Weakness: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this vulnerability is exploited, the system may be rebooted or suspended by receiving a specially crafted packet.
Weakness: CWE-908 Use of Uninitialized Resource
An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router's pin.
Weakness: CWE-316 Cleartext Storage of Sensitive Information in Memory
In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method `Lcp::saveTranslations()` suffer of a white writer that can inject PHP code into a PHP file.
Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')
In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Atom Integrated System Info v2_2 for DCN35New request from KMD/VBIOS in order to support new UMA carveoutmodel. This fixes a null dereference from accessingCtx->dc_bios->integrated_info while it was NULL.DAL parses through the BIOS and extracts the necessaryintegrated_info but was missing a case for the new BIOSversion 2.3.
Weakness: CWE-476 NULL Pointer Dereference
Improper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier. If this vulnerability is exploited, arbitrary code may be executed on the PC where the product is installed.
Weakness: CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.
Weakness: CWE-253 Incorrect Check of Function Return Value
TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action wizard_ipv6 with a sufficiently long reboot_type key.
Weakness: CWE-121 Stack-based Buffer Overflow
In the Linux kernel, the following vulnerability has been resolved:Drivers: hv: vmbus: Track decrypted status in vmbus_gpadlIn CoCo VMs it is possible for the untrusted host to causeset_memory_encrypted() or set_memory_decrypted() to fail such that anerror is returned and the resulting memory is shared. Callers need totake care to handle these errors to avoid returning decrypted (shared)memory to the page allocator, which could lead to functional or securityissues.In order to make sure callers of vmbus_establish_gpadl() andvmbus_teardown_gpadl() don't return decrypted/shared pages toallocators, add a field in struct vmbus_gpadl to keep track of thedecryption status of the buffers. This will allow the callers toknow if they should free or leak the pages.
Weakness: CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information
OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product.
Weakness: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')