Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
which is then passed to the vulnerable system API call. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8409 State: PUBLISHED Published: 2019-07-02T19:09:08 Last Updated: 2024-08-05T16:34:22.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstorms
onal Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8410 State: PUBLISHED Published: 2019-07-02T19:46:07 Last Updated: 2024-08-05T16:34:22.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this resul
ing sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html -
raq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8411 State: PUBLISHED Published: 2019-07-02T18:44:18 Last Updated: 2024-08-05T16:34:23.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains th
function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x00023BCC which calls the "Send_mail" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8412 State: PUBLISHED Published: 2019-07-02T20:08:17 Last Updated: 2024-08-05T16:34:23.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in
g file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8413 State: PUBLISHED Published: 2019-07-02T20:19:08 Last Updated: 2024-08-05T16:34:23.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that handles comman
sent from any device in "main" function. One path in the function traverses towards a block of code that handles commands to be executed on the device. The custom protocol created by D-Link follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111. If a packet is received with the packet type being "S" or 0x53 then the string passed in the "C" parameter is base64 decoded and then executed by passing into a System API. We can see at address 0x00009B44 that the string received in packet type subtracts 0x31 or "1" from the packet type and is compared against 0x22 or "double quotes". If that is the cas
cket type subtracts 0x31 or "1" from the packet type and is compared against 0x22 or "double quotes". If that is the case, then the packet is sent towards the block of code that executes a command. Then the value stored in "C" parameter is extracted at address 0x0000A1B0. Finally, the string received is base 64 decoded and passed on to the system API at address 0x0000A2A8 as shown below. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding. Additi
ecute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8414 State: PUBLISHED Published: 2019-07-02T19:56:23 Last Updated: 2024-08-05T16:34:23.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f" and stores it on the stack. Since there is no length check, this results in corrupting the registers for the function sub_A098 which results in memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https:/
on sub_A098 which results in memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8415 State: PUBLISHED Published: 2019-07-02T20:13:08 Last Updated: 2024-08-05T16:34:22.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password an
t. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string "admin" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8416 State: PUBLISHED Published: 2019-07-02T20:26:13 Last Updated: 2024-08-05T16:34:23.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that processing of
sent from any device in "main" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution
flowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dl
k-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8417 State: PUBLISHED Published: 2019-07-02T20:03:13 Last Updated: 2024-08-05T16:34:23.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process
s and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device's password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_s
mand-Injection-CSRF-Stack-Overflow.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf
CVE ID: CVE-2017-8418 State: PUBLISHED Published: 2017-05-02T14:00:00Z Last Updated: 2024-09-16T18:18:03.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/05/01/14 - https://github.com/bbatsov/rubocop/issues/4336
CVE ID: CVE-2017-8419 State: PUBLISHED Published: 2017-05-02T14:00:00Z Last Updated: 2024-09-16T17:48:06.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file, as demonstrated by mishandling of num_channels. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/lame/bugs/458/
CVE ID: CVE-2017-8420 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T16:34:22.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFTools 2013-04-09-1007 on Windows has a "Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x0000000000003e71" issue. This issue can be triggered by a malformed TTF file that is mishandled by font2swf. Attackers could exploit this issue for DoS (Access Violation). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-8420
CVE ID: CVE-2017-8421 State: PUBLISHED Published: 2017-05-02T17:00:00 Last Updated: 2024-08-05T16:34:23.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=21440 - https://security.gentoo.org/glsa/201709-02
CVE ID: CVE-2017-8422 State: PUBLISHED Published: 2017-05-17T14:00:00 Last Updated: 2024-08-05T16:34:22.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038480 - https://www.exploit-db.com/exploits/42053/ - https://www.kde.org/info/security/advisory-20170510-1.txt - https://bugzilla.redhat.com/show_bug.cgi?id=1449647 - http://www.securityfocus.com/bid/98412 - https://security.gentoo.org/glsa/201706-29 - https://cgit.kde.org/kde
1449647 - http://www.securityfocus.com/bid/98412 - https://security.gentoo.org/glsa/201706-29 - https://cgit.kde.org/kdelibs.git/commit/?id=264e97625abe2e0334f97de17f6ffb52582888ab - http://www.debian.org/security/2017/dsa-3849 - https://cgit.kde.org/kauth.git/commit/?id=df875f725293af53399f5146362eb158b4f9216a - http://www.openwall.com/lists/oss-security/2017/05/10/3 - https://access.redhat.com/errata/RHSA-2017:1264
CVE ID: CVE-2017-8438 State: PUBLISHED Published: 2017-06-05T14:00:00 Last Updated: 2024-08-05T16:34:22.961Z Vendors: Elastic Products: X-Pack Security Problem Types: CWE-284 Description: Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user specified in a run_as request. If a role has been created using a template that contains the _user properties, the behavior of run_as will be incorrect. Additionally if the run_as user specified does not exist, the transition will not happen. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic
n will not happen. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 - https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released - https://www.elastic.co/community/security
CVE ID: CVE-2017-8439 State: PUBLISHED Published: 2017-06-05T14:00:00 Last Updated: 2024-08-05T16:34:23.050Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released - https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 - https://www.elastic.co/community/security
CVE ID: CVE-2017-8440 State: PUBLISHED Published: 2017-06-05T14:00:00 Last Updated: 2024-08-05T16:34:22.872Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released - https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 - https://www.elastic.co/community/security
CVE ID: CVE-2017-8441 State: PUBLISHED Published: 2017-06-05T14:00:00 Last Updated: 2024-08-05T16:34:22.945Z Vendors: Elastic Products: X-Pack Security Problem Types: CWE-279 Description: Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 - https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released - http
stack-5-4-1-and-5-3-3-security-updates/87952 - https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released - https://www.elastic.co/community/security
CVE ID: CVE-2017-8442 State: PUBLISHED Published: 2017-07-07T20:00:00 Last Updated: 2024-08-05T16:34:23.206Z Vendors: Elastic Products: Elasticsearch X-Pack Security Problem Types: CWE-402 Description: Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security
CVE ID: CVE-2017-8443 State: PUBLISHED Published: 2017-06-30T19:00:00 Last Updated: 2024-08-05T16:34:23.103Z Vendors: Elastic Products: Kibana X-Pack Security Problem Types: CWE-598 Description: In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be viewed by untrusted parties or logged into the Kibana access logs. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security
CVE ID: CVE-2017-8444 State: PUBLISHED Published: 2017-09-28T19:00:00 Last Updated: 2024-08-05T16:34:22.949Z Vendors: Elastic Products: Elastic Cloud Enterprise Problem Types: CWE-319 Description: The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the middle (MITM) the traffic between the client-forwarder and ZooKeeper they could potentially obtain sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-security-update/100247
CVE ID: CVE-2017-8445 State: PUBLISHED Published: 2017-08-18T20:00:00 Last Updated: 2024-08-05T16:34:23.276Z Vendors: Elastic Products: Elastic X-Pack Security Problem Types: CWE-295 Description: An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replaced with an instance that trusts all certificates. This could allow any node using any certificate to join a cluster. The proper behavior in this instance is for the TLS trust manager to deny all certificates. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security
CVE ID: CVE-2017-8446 State: PUBLISHED Published: 2017-08-18T20:00:00 Last Updated: 2024-08-05T16:34:23.202Z Vendors: Elastic Products: Elastic X-Pack Reporting Problem Types: CWE-522 Description: The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security