Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ate the request path to the Jira API, allowing them to perform arbitrary GET requests using the Jira API credentials, potentially with elevated permissions, used by the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-jira/security/advisories/GHSA-pmv5-h2x6-35fh - https://github.com/discourse/discourse-jira/pull/50 - https://github.com/discourse/discourse-jira/commit/8a2d3ad228883199fd5f081cc93d173c88e2e48f
CVE ID: CVE-2023-44385 State: PUBLISHED Published: 2023-10-19T22:02:52.674Z Last Updated: 2024-09-12T15:13:30.561Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: home-assistant Products: core Problem Types: CWE-352 Description: The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this security advisory, may result in full compromise and remote code execution (RCE). Version 2023.7 addresses this issue and all users are advised t
sult in full compromise and remote code execution (RCE). Version 2023.7 addresses this issue and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-161. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp
CVE ID: CVE-2023-44386 State: PUBLISHED Published: 2023-10-05T17:41:38.379Z Last Updated: 2024-09-19T17:58:26.048Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: vapor Products: vapor Problem Types: CWE-231, CWE-617, CWE-696 Description: Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vapor/vapor/security/advisories/GHS
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vapor/vapor/security/advisories/GHSA-3mwq-h3g6-ffhm - https://github.com/vapor/vapor/commit/090464a654b03148b139a81f8f5ac63b0856f6f3 - https://github.com/vapor/vapor/releases/tag/4.84.2
CVE ID: CVE-2023-44387 State: PUBLISHED Published: 2023-10-05T17:51:15.407Z Last Updated: 2025-02-13T17:13:40.344Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: gradle Products: gradle Problem Types: CWE-732 Description: Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnera
ions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories/GHSA-43r3-pqhv-f7h9 - https://github.com/gradle/gradle/commit/3b406191e24d69e7e42dc3f3b5cc50625aa930b7 - https://github.com/gradle/gradle/releases/tag/v7.6.3 -
m/gradle/gradle/commit/3b406191e24d69e7e42dc3f3b5cc50625aa930b7 - https://github.com/gradle/gradle/releases/tag/v7.6.3 - https://github.com/gradle/gradle/releases/tag/v8.4.0 - https://security.netapp.com/advisory/ntap-20231110-0006/
CVE ID: CVE-2023-44388 State: PUBLISHED Published: 2023-10-16T21:11:26.719Z Last Updated: 2024-09-16T15:42:30.893Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-400 Description: Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the `client_max_body_size nginx directive`. `client_max_body_size` will limit the size of upl
d this problem by reducing the `client_max_body_size nginx directive`. `client_max_body_size` will limit the size of uploads that can be uploaded directly to the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-89h3-g746-xmwq - http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
CVE ID: CVE-2023-44389 State: PUBLISHED Published: 2023-10-04T20:07:34.274Z Last Updated: 2024-11-27T16:15:46.357Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: zopefoundation Products: Zope Problem Types: CWE-79 Description: Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com
and 5.8.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh - https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a - https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
CVE ID: CVE-2023-44390 State: PUBLISHED Published: 2023-10-05T13:41:20.387Z Last Updated: 2024-09-19T17:32:06.969Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mganss Products: HtmlSanitizer Problem Types: CWE-79 Description: HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed elements. In the case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code
vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. The vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-43cp-6p3q-2pc4 - https://github.com/mganss/HtmlSanitizer/commit/ab29319866c020f0cc11e6b92228cd8039196c6e
CVE ID: CVE-2023-44391 State: PUBLISHED Published: 2023-10-16T21:22:24.719Z Last Updated: 2024-09-16T15:42:23.929Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-7px5-fqcf-7mfr
CVE ID: CVE-2023-44392 State: PUBLISHED Published: 2023-10-09T19:06:04.694Z Last Updated: 2024-09-18T20:23:40.475Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: garden-io Products: garden Problem Types: CWE-94, CWE-502 Description: Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are s
p` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user mus
y, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/garden-io/garden/security/advisories/GHSA-hm75-6vc9-8rpr - https://github.com/garden-io/garden/commit/3117964da40d3114f129a6131b4ada89eaa4eb8c
CVE ID: CVE-2023-44393 State: PUBLISHED Published: 2023-10-09T14:52:42.879Z Last Updated: 2024-09-19T13:51:52.766Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Piwigo Products: Piwigo Problem Types: CWE-79, CWE-80 Description: Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is
e HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?pa
ho are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg - https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23
CVE ID: CVE-2023-44394 State: PUBLISHED Published: 2023-10-16T21:00:46.324Z Last Updated: 2025-08-11T14:49:08.671Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: mantisbt Products: mantisbt Problem Types: CWE-200 Description: MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit `65c44883f` which has been included in release `2.25.8`. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( `$g_wiki_enable = OFF;`). Additional Analy
advised to upgrade. Users unable to upgrade should disable wiki integration ( `$g_wiki_enable = OFF;`). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mantisbt/mantisbt/security/advisories/GHSA-v642-mh27-8j6m - https://github.com/mantisbt/mantisbt/commit/65c44883f9d24f3ccef066fb523c93d8fdd7afc1 - https://mantisbt.org/bugs/view.php?id=32981
CVE ID: CVE-2023-44395 State: PUBLISHED Published: 2024-01-22T14:51:14.371Z Last Updated: 2024-08-23T19:18:41.408Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: autolab Products: Autolab Problem Types: CWE-22 Description: Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform arbitrary file reads. Version 2.12.0 contains a patch. There are no feasible workarounds for this issue. Additional Analyst Notes: - CVE Program
sion 2.12.0 contains a patch. There are no feasible workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/autolab/Autolab/security/advisories/GHSA-h8wq-ghfq-5hfx - https://github.com/autolab/Autolab/releases/tag/v2.12.0 - https://www.stackhawk.com/blog/rails-path-traversal-guide-examples-and-prevention/
CVE ID: CVE-2023-44396 State: PUBLISHED Published: 2024-04-15T17:13:45.144Z Last Updated: 2024-08-02T20:07:33.423Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-79, CWE-80 Description: iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-gqqj-jgh6-3x35 - https://github.com/Combodo/iTop/commit/9df92665e08c4bf5d4d8a5a9fe21fd3fb26fb273 - https://github.com/Combodo/iTop/commit/c72cb7e70ebf
b.com/Combodo/iTop/commit/9df92665e08c4bf5d4d8a5a9fe21fd3fb26fb273 - https://github.com/Combodo/iTop/commit/c72cb7e70ebf469ce0ec01f5f9b524e39afe6c7f
CVE ID: CVE-2023-44397 State: PUBLISHED Published: 2023-10-30T22:28:23.514Z Last Updated: 2024-09-05T20:18:43.667Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: CloudExplorer-Dev Products: CloudExplorer-Lite Problem Types: CWE-287 Description: CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CloudExplorer-Dev/CloudExplo
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-fqxr-7g94-vrfj
CVE ID: CVE-2023-44398 State: PUBLISHED Published: 2023-11-06T17:30:54.394Z Last Updated: 2025-02-26T21:15:17.204Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-787 Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, so earlier versions of Exiv2 are _not_ affected. The out-of-bounds write is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit
ite is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. This bug is fixed in version v0.28.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-hrw9-ggg3-3r4r - https://github.com/Exiv2/exiv2/commit/e884a0955359107f4031c74a07406df7e99929a5 - https://security.gentoo.org/glsa/202312-06
CVE ID: CVE-2023-44399 State: PUBLISHED Published: 2023-10-10T16:55:45.309Z Last Updated: 2024-09-19T14:18:10.146Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-640 Description: ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password rese
on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL. This bug has been patched in versions 2.37.3 and 2.38.0. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-v683-rcxx-vpff - https://github.com/zitadel/zitadel/releases/tag/v2.37.3 - https://github.com/zitadel/zitadel/releases/tag/v2.38.0
CVE ID: CVE-2023-44400 State: PUBLISHED Published: 2023-10-09T15:15:07.450Z Last Updated: 2024-09-18T20:18:45.881Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: louislam Products: uptime-kuma Problem Types: CWE-384 Description: Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-kuma/s
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g - https://github.com/louislam/uptime-kuma/issues/3481 - https://github.com/louislam/uptime-kuma/commit/88afab6571ef7d4d41bb395cdb6ecd3968835a4a
CVE ID: CVE-2023-44401 State: PUBLISHED Published: 2024-01-23T13:08:34.055Z Last Updated: 2025-06-17T21:19:26.227Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: silverstripe Products: silverstripe-graphql Problem Types: CWE-863 Description: The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number of records per page. Note that this also affects GraphQL queries which have a limit applied, even if the query isn’t paginate
cords per page. Note that this also affects GraphQL queries which have a limit applied, even if the query isn’t paginated per se. This has been fixed in versions 4.3.7 and 5.1.3 by ensuring no new records are pulled in from the database after performing `canView` permission checks for each page of results. This may result in some pages in the query results having less than the maximum number of records per page even when there are more pages of results. This behavior is consistent with how pagination works in other areas of Silverstripe CMS, such as in `GridField`, and is a result of having to perform permission checks in PHP rather than in the database directly. One may disable these permis
result of having to perform permission checks in PHP rather than in the database directly. One may disable these permission checks by disabling the `CanViewPermission` plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-jgph-w8rh-xf5p - https://www.silverstripe.org/download/security-releases/CVE-2023-44401
CVE ID: CVE-2023-44402 State: PUBLISHED Published: 2023-12-01T21:45:18.379Z Last Updated: 2024-08-02T20:07:33.168Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) Vendors: electron Products: electron Problem Types: CWE-345 Description: Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched fro
e fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85 - https://github.com/electron/electron/pull/39788 - https://www.electronjs.org/docs/latest/tutorial/fuses
CVE ID: CVE-2023-44403 State: PUBLISHED Published: 2024-05-03T02:13:36.451Z Last Updated: 2024-08-02T20:07:32.905Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-1325 Problem Types: CWE-78 Description: D-Link DAP-1325 HNAP SetWLanRadioSettings Channel Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of prop
within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18822. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1501/