Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38880 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-08-02T17:54:39.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup<date>.sql" (e.g. "opensisBackup07-20-2023.sql"), i.e. can easily be guessed. This file can be accessed by any unauthenticated actor and contains a dump of the whole database including password hashes. Additional Analyst Notes: - CVE Program Container: Ref
contains a dump of the whole database including password hashes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic - https://www.os4ed.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38880
CVE ID: CVE-2023-38881 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-08-02T17:54:39.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id', 'school_date', 'month' or 'year' parameters in 'CalendarModal.php'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic - https://www.os4ed.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CV
hub.com/OS4ED/openSIS-Classic - https://www.os4ed.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38881
CVE ID: CVE-2023-38882 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-08-02T17:54:39.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php' Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic - https://www.os4ed.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38882
CVE ID: CVE-2023-38883 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-08-02T17:54:39.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in 'ParentLookup.php'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic - https://www.os4ed.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38883
CVE ID: CVE-2023-38884 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-08-02T17:54:39.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/<studentId>-<filename>' Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic - https://www.os4ed.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38884
CVE ID: CVE-2023-38885 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-10-21T14:17:29.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OS4ED/openSIS-Classic - https://www.os4ed.com/ - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38885
CVE ID: CVE-2023-38886 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-25T15:04:39.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://dolibarr.com - https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38886_Dolibarr_RCE-1.pdf
CVE ID: CVE-2023-38887 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-24T20:37:41.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://dolibarr.com - https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38887_Dolibarr_AFU.pdf
CVE ID: CVE-2023-38888 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-25T15:02:28.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://dolibarr.com - https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38888_Dolibarr_XSS.pdf
CVE ID: CVE-2023-38889 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T13:04:46.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Alluxio/alluxio/issues/17766
CVE ID: CVE-2023-38890 State: PUBLISHED Published: 2023-08-18T00:00:00 Last Updated: 2024-10-07T19:41:34.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling SQL Injection attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/akshadjoshi/CVE-2023-38890
CVE ID: CVE-2023-38891 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T20:23:04.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://code.vtiger.com/vtiger/vtigercrm/-/blob/master/modules/Reports/ReportRun.php#L395 - https://github.com/jselliott/CVE-2023-38891
CVE ID: CVE-2023-38894 State: PUBLISHED Published: 2023-08-16T00:00:00 Last Updated: 2024-10-08T19:24:49.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://tree-kit.com - https://github.com/cronvel/tree-kit - https://www.code-intelligence.com/blog/treekit-prototype-pollution-cve-2023-38894
CVE ID: CVE-2023-38896 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T13:02:11.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hwchase17/langchain/issues/5872 - https://github.com/hwchase17/langchain/pull/6003 - https://twitter.com/llm_sec/status/1668711587287375876
CVE ID: CVE-2023-38898 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:56:57.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there are no common scenarios in which an adversary can call _asyncio._swap_current_task but does not already have the ability to call arbitrary functions; and (3) there are no common scenarios in which sensitive information, which is not already accessible to
rary functions; and (3) there are no common scenarios in which sensitive information, which is not already accessible to an adversary, becomes accessible through this bug. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/issues/105987
CVE ID: CVE-2023-38899 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-21T19:44:08.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in berkaygediz O_Blog v.1.0 allows a local attacker to escalate privileges via the secure_file_priv component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://o.com - https://github.com/berkaygediz/O_Blog - https://github.com/berkaygediz/O_Blog/issues - https://github.com/berkaygediz/O_Blog/issues/2
CVE ID: CVE-2023-38902 State: PUBLISHED Published: 2023-08-17T00:00:00 Last Updated: 2024-10-08T14:50:58.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field. Additional Analyst Notes: - CVE Program Container:
nding a POST request to /cgi-bin/luci/api/cmd via the remoteIp field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/ZIKH26/18693c67ee7d2f8d2c60231b19194c37
CVE ID: CVE-2023-38904 State: PUBLISHED Published: 2023-08-16T00:00:00 Last Updated: 2024-10-08T20:01:30.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51576
CVE ID: CVE-2023-38905 State: PUBLISHED Published: 2023-08-17T00:00:00 Last Updated: 2024-10-08T14:36:43.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jeecgboot/jeecg-boot/issues/4737 - https://gist.github.com/wealeson1/e24fc8575f4e051320d69e9a75080642
CVE ID: CVE-2023-38906 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-08-02T17:54:39.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the authentication code for the UDP message. Additional Analyst Notes: - CVE Program Container: References: - https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1 - https://arxiv.org/abs/2308.09019 - https://www.scitepress.org/Papers/2023/120929/120929.pdf - https://www.dmi.unict.it/giamp/smart
xiv.org/abs/2308.09019 - https://www.scitepress.org/Papers/2023/120929/120929.pdf - https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
CVE ID: CVE-2023-38907 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-08-02T17:54:39.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to replay old messages encrypted with a still valid session key. Additional Analyst Notes: - CVE Program Container: References: - https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1 - https://arxiv.org/abs/2308.09019 - https://www.scitepress.org/Papers/2023/120929/120929.pdf - https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackinto
ttps://www.scitepress.org/Papers/2023/120929/120929.pdf - https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
CVE ID: CVE-2023-38908 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-08-02T17:54:39.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the TSKEP authentication function. Additional Analyst Notes: - CVE Program Container: References: - https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1 - https://arxiv.org/abs/2308.09019 - https://arxiv.org/pdf/2308.09019.pdf - https://www.scitepress.org/Papers/2023/120929/120929.pdf - https://www.dmi.u
19 - https://arxiv.org/pdf/2308.09019.pdf - https://www.scitepress.org/Papers/2023/120929/120929.pdf - https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
CVE ID: CVE-2023-38909 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-08-02T17:54:39.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function. Additional Analyst Notes: - CVE Program Container: References: - https://www.scitepress.org/PublicationsDetail.aspx?ID=X/auBv7JrSo=&t=1 - https://arxiv.org/abs/2308.09019 - https://arxiv.org/pdf/2308.09019.pdf - https://www.scitepress.org/Papers/2023/120929/120929.pdf - https:/
s/2308.09019 - https://arxiv.org/pdf/2308.09019.pdf - https://www.scitepress.org/Papers/2023/120929/120929.pdf - https://www.dmi.unict.it/giamp/smartbulbscanbehackedtohackintoyourhousehold/
CVE ID: CVE-2023-38910 State: PUBLISHED Published: 2023-08-18T00:00:00 Last Updated: 2024-10-07T19:41:01.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing our carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/desencrypt/CVE/blob/main/CVE-2023-38910/Readme.md
CVE ID: CVE-2023-38911 State: PUBLISHED Published: 2023-08-18T00:00:00 Last Updated: 2024-10-07T19:37:53.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/desencrypt/CVE/blob/main/CVE-2023-38911/Readme.md
CVE ID: CVE-2023-38912 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T20:19:42.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/173302/Super-Store-Finder-PHP-Script-3.6-SQL-Injection.html - https://codecanyon.net/item/super-store-finder/3630922
CVE ID: CVE-2023-38914 State: REJECTED Published: N/A Last Updated: 2023-11-24T12:50:49.526350 Description: No description available.
CVE ID: CVE-2023-38915 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-09T14:22:29.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wolf-leo/EasyAdmin8/issues/1
CVE ID: CVE-2023-38916 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:29:51.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Mohammad-Ajazuddin/eVotingSytem-PHP/issues/1
CVE ID: CVE-2023-38920 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-18T19:18:27.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the adminname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/amanahmed000/Cyber-Cafe-Management-System-XSS-Advisory/blob/main/CVE-2023-38920.md
CVE ID: CVE-2023-38921 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T14:13:52.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear WG302v2 v5.2.9 and WAG302v2 v5.1.19 were discovered to contain multiple command injection vulnerabilities in the upgrade_handler function via the firmwareRestore and firmwareServerip parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/FirmRec/IoT-Vulns/tree/main/netgear/upgrade_handler
CVE ID: CVE-2023-38922 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T14:15:52.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the update_auth function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_auth/README.md
CVE ID: CVE-2023-38924 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T13:50:24.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear DGN3500 1.1.00.37 was discovered to contain a buffer overflow via the http_password parameter at setup.cgi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_password_create_smb_cfg/README.md
CVE ID: CVE-2023-38925 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T13:49:14.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear DC112A 1.0.0.64, EX6200 1.0.3.94 and R6300v2 1.0.4.8 were discovered to contain a buffer overflow via the http_passwd parameter in password.cgi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_smb_pass/README.md
CVE ID: CVE-2023-38926 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T13:47:16.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear EX6200 v1.0.3.94 was discovered to contain a buffer overflow via the wla_temp_ssid parameter at acosNvramConfig_set. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/nvram_ssid/README.md
CVE ID: CVE-2023-38928 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T13:24:29.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usb_remote_invite.cgi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/FirmRec/IoT-Vulns/tree/main/netgear/usb_remote_invite_password
CVE ID: CVE-2023-38929 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-11T13:20:13.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda 4G300 v1.01.42 was discovered to contain a stack overflow via the page parameter at /VirtualSer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/VirtualSer/README.md
CVE ID: CVE-2023-38930 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-15T19:35:44.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC7 V1.0,V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0,V15.03.06.28, AC9 V3.0,V15.03.06.42_multi and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/addWifiMacFilter/README.md
CVE ID: CVE-2023-38931 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-17T13:55:25.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and FH1203 V2.0.1.6 were discovered to contain a stack overflow via the list parameter in the setaccount function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirmRec/IoT-Vulns/blob/main/tenda/cloudv2_setaccount/README.md