Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-37284 State: PUBLISHED Published: 2023-09-06T09:24:42.525Z Last Updated: 2024-09-26T20:41:42.264Z Vendors: TP-LINK Products: Archer C20 Problem Types: Improper authentication Description: Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616' allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command via a crafted request to bypass authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/jp/support/download/archer-c20/v1/#Firmware - https://jvn.jp/en/vu/JVNVU99392903/
CVE ID: CVE-2023-37285 State: PUBLISHED Published: 2023-07-28T04:30:46.186Z Last Updated: 2025-02-13T16:56:42.060Z Vendors: Apple Products: macOS, iOS and iPadOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213842 - https://supp
chment: References: - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213842 - https://support.apple.com/en-us/HT213845 - https://support.apple.com/en-us/HT213844 - https://support.apple.com/kb/HT213843 - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213845 - https://support.apple.com/kb/HT213842
CVE ID: CVE-2023-37286 State: PUBLISHED Published: 2023-07-10T00:00:00 Last Updated: 2024-11-12T19:28:26.124Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SamrtSoft Products: SmartBPM.NET Problem Types: CWE-798 Description: SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7221-438c6-1.html
CVE ID: CVE-2023-37287 State: PUBLISHED Published: 2023-07-10T00:00:00 Last Updated: 2024-11-12T19:27:53.525Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SamrtSoft Products: SmartBPM.NET Problem Types: CWE-798 Description: SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7222-cdfd0-1.html
CVE ID: CVE-2023-37288 State: PUBLISHED Published: 2023-07-10T00:00:00.000Z Last Updated: 2025-02-13T17:01:12.085Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SmartSoft Products: SmartBPM.NET Problem Types: CWE-23 Description: SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7223-af8f8-1.html
CVE ID: CVE-2023-37289 State: PUBLISHED Published: 2023-07-20T02:45:25.479Z Last Updated: 2024-10-24T18:46:57.664Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: InfoDoc Products: Document On-line Submission and Approval System Problem Types: CWE-434 Description: It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. This issue affects D
upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. This issue affects Document On-line Submission and Approval System: 22547, 22567. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7225-cef32-1.html
CVE ID: CVE-2023-37290 State: PUBLISHED Published: 2023-07-20T10:55:16.588Z Last Updated: 2024-10-24T14:56:44.738Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: InfoDoc Products: Document On-line Submission and Approval System Problem Types: CWE-918 Description: InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows unauthenticated remote attackers to perform Server-Side Request Forgery (SSRF) attacks, gaining unauthorized access
lows unauthenticated remote attackers to perform Server-Side Request Forgery (SSRF) attacks, gaining unauthorized access to arbitrary system files and uncovering the internal network topology. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7226-12195-1.html
CVE ID: CVE-2023-37291 State: PUBLISHED Published: 2023-07-21T03:02:50.129Z Last Updated: 2024-10-24T14:31:28.873Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Galaxy Software Services Products: Vitals ESP Problem Types: CWE-321 Description: Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data. This issue affects Vitals ESP: from 3.0.8 through 6.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/c
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7224-4fe1f-1.html
CVE ID: CVE-2023-37292 State: PUBLISHED Published: 2023-07-21T04:08:55.811Z Last Updated: 2024-10-24T14:30:28.102Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: iSherlock 4.5, iSherlock 5.5 Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga iSherlock 5.5 (iSherlock-user modules) allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock 5.5: before iSherlock-user-5.5-174. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
5.5: before iSherlock-user-5.5-174. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7239-8fc29-1.html
CVE ID: CVE-2023-37293 State: PUBLISHED Published: 2024-01-09T22:18:05.255Z Last Updated: 2025-06-17T20:39:16.680Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: AMI Products: MegaRAC_SPx Problem Types: CWE-121 Description: AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE ID: CVE-2023-37294 State: PUBLISHED Published: 2024-01-09T22:18:45.537Z Last Updated: 2025-06-17T20:39:16.797Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: AMI Products: MegaRAC_SPx Problem Types: CWE-122 Description: AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE ID: CVE-2023-37295 State: PUBLISHED Published: 2024-01-09T22:19:18.376Z Last Updated: 2025-06-17T20:39:16.918Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: AMI Products: MegaRAC_SPx Problem Types: CWE-122 Description: AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE ID: CVE-2023-37296 State: PUBLISHED Published: 2024-01-09T22:19:48.454Z Last Updated: 2025-06-17T20:39:17.031Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: AMI Products: MegaRAC_SPx Problem Types: CWE-121 Description: AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE ID: CVE-2023-37297 State: PUBLISHED Published: 2024-01-09T22:20:19.142Z Last Updated: 2025-06-03T14:29:40.018Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: AMI Products: MegaRAC_SPx Problem Types: CWE-122 Description: AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE ID: CVE-2023-37298 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-27T15:30:00.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joplin before 2.11.5 allows XSS via a USE element in an SVG document. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/laurent22/joplin/releases/tag/v2.11.5 - https://github.com/laurent22/joplin/commit/caf66068bfc474bbfd505013076ed173cd90ca83 - https://vuln.ryotak.net/advisories/69
CVE ID: CVE-2023-37299 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-27T15:29:11.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joplin before 2.11.5 allows XSS via an AREA element of an image map. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/laurent22/joplin/releases/tag/v2.11.5 - https://github.com/laurent22/joplin/commit/9e90d9016daf79b5414646a93fd369aedb035071 - https://vuln.ryotak.net/advisories/68
CVE ID: CVE-2023-37300 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-27T18:54:20.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T330968 - https://gerrit.wikimedia.org/r/q/I993fdcae1fedb7dd543b35a477026bc727615b0a
CVE ID: CVE-2023-37301 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-27T18:47:20.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T250720 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933663
CVE ID: CVE-2023-37302 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-26T16:44:49.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T339111 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649 - https://gerrit.wikimedia.org/r/c/mediawiki/ex
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933650
CVE ID: CVE-2023-37303 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-27T18:41:36.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T338276 - https://gerrit.wikimedia.org/r/q/I10a9273c542576b3f7bb38de68dcd2aa41cfb1b0
CVE ID: CVE-2023-37304 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-26T16:16:56.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T323651 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DoubleWiki/+/932825
CVE ID: CVE-2023-37305 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-26T16:16:14.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T326952 - https://gerrit.wikimedia.org/r/q/Ibe5f8e25dea155bbd811a65833394c0d4b906a34
CVE ID: CVE-2023-37306 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-27T18:38:01.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle - https://github.com/MISP/MISP/commit/f125630c1c2d0f5d11079d3653ab7bb2ab5cd908
CVE ID: CVE-2023-37307 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-08-02T17:09:34.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/286c84fab0047726a6a396ceefaae1bb666fc485 - https://github.com/MISP/MISP/compare/v2.4.171...v2.4.172 - https://zigrin.com/advisories/misp-stored-xss/ - http://packetstormsecurity.com/files/176975/MISP-2.4.171-Cross-Site-Scripting.html
CVE ID: CVE-2023-37308 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-20T21:49:26.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/cve-2023-37308.html
CVE ID: CVE-2023-37310 State: PUBLISHED Published: 2024-05-03T01:58:08.032Z Last Updated: 2024-09-18T18:29:17.818Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set Device Info Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied
flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20087. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1264/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-37311 State: PUBLISHED Published: 2024-05-03T01:58:08.723Z Last Updated: 2024-09-18T18:29:18.541Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set Device Info Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied
flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20088. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1265/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-37312 State: PUBLISHED Published: 2024-05-03T01:58:09.440Z Last Updated: 2024-09-18T18:29:19.239Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set Device Info Device Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied da
aw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20089. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1266/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-37313 State: PUBLISHED Published: 2024-05-03T01:58:10.182Z Last Updated: 2024-09-18T18:29:20.020Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set IPv4 Address Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied
flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20090. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1267/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-37314 State: PUBLISHED Published: 2024-05-03T01:58:10.952Z Last Updated: 2024-09-18T18:29:20.764Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set IPv6 Address Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied
flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20092. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1268/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE ID: CVE-2023-37315 State: PUBLISHED Published: 2024-05-03T01:58:11.671Z Last Updated: 2024-09-18T18:29:21.483Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2622 Problem Types: CWE-121 Description: D-Link DAP-2622 DDP Set IPv6 Address Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied