Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2624 State: PUBLISHED Published: 2023-06-27T13:17:23.450Z Last Updated: 2025-02-13T16:44:52.693Z Vendors: Unknown Products: KiviCare Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dc3a841d-a95b-462e-be4b-acaa44e77264 - http://packetstormsecurity.com/files/174895/WordPress-KiviCare-3.2.0-Cross-Site-Scriptin
d-a95b-462e-be4b-acaa44e77264 - http://packetstormsecurity.com/files/174895/WordPress-KiviCare-3.2.0-Cross-Site-Scripting.html
CVE ID: CVE-2023-2625 State: PUBLISHED Published: 2023-06-28T16:15:46.529Z Last Updated: 2024-12-04T20:57:56.402Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Energy Products: TXpert Hub CoreTec 4 Problem Types: CWE-78 Description: A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a particular field of the web user interface that will be executed by the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
at will be executed by the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000163&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2023-2626 State: PUBLISHED Published: 2023-07-25T17:07:02.960Z Last Updated: 2024-08-02T06:26:09.825Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Google Products: Nest Hub Max, Nest Hub (2nd. gen) w/ Sleep Tracking, Nest Wifi 6E, Google Wifi (next gen), Nest Wifi Point Problem Types: CWE-287 Description: There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft radio frames using “Key ID Mode 2”: a special mode using a static encryption key to bypass security checks, resulting in arbitrary IP packets being allowed on the Thread network. This prov
cryption key to bypass security checks, resulting in arbitrary IP packets being allowed on the Thread network. This provides a pathway for an attacker to send/receive arbitrary IPv6 packets to devices on the LAN, potentially exploiting them if they lack additional authentication or contain any network vulnerabilities that would normally be mitigated by the home router’s NAT firewall. Effected devices have been mitigated through an automatic update beyond the affected range. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.google.com/product-documentation/answer/13588832?hl=en&ref_topic=12974021&sjid=7833436865896465963-NA#zippy=%2Cnest
port.google.com/product-documentation/answer/13588832?hl=en&ref_topic=12974021&sjid=7833436865896465963-NA#zippy=%2Cnest-wifi
CVE ID: CVE-2023-2627 State: PUBLISHED Published: 2023-06-27T13:17:06.660Z Last Updated: 2024-12-03T17:10:09.353Z Vendors: Unknown Products: KiviCare Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/162d0029-2adc-4925-9985-1d5d672d
gram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/162d0029-2adc-4925-9985-1d5d672dbe75
CVE ID: CVE-2023-2628 State: PUBLISHED Published: 2023-06-27T13:17:22.624Z Last Updated: 2024-11-27T19:14:47.509Z Vendors: Unknown Products: KiviCare Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vul
rs etc) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e0741e2c-c529-4815-8744-16e01cdb0aed
CVE ID: CVE-2023-2629 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T19:40:22.120Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L) Vendors: pimcore Products: pimcore/customer-data-framework Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01 - https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803
CVE ID: CVE-2023-2630 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T19:39:51.618Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e1001870-b8d8-4921-8b9c-bbdfb1a1491e - https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38
CVE ID: CVE-2023-2631 State: PUBLISHED Published: 2023-05-16T18:06:59.001Z Last Updated: 2025-01-22T20:33:38.273Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Jenkins Products: Jenkins Code Dx Plugin Problem Types: CWE-352 Description: A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3118
CVE ID: CVE-2023-2632 State: PUBLISHED Published: 2023-05-16T17:54:11.737Z Last Updated: 2025-01-22T20:34:38.913Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Jenkins Products: Jenkins Code Dx Plugin Problem Types: CWE-256 Description: Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3146
CVE ID: CVE-2023-2633 State: PUBLISHED Published: 2023-05-16T17:56:40.703Z Last Updated: 2025-01-22T20:34:19.745Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Jenkins Products: Jenkins Code Dx Plugin Problem Types: CWE-256 Description: Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3146
CVE ID: CVE-2023-2634 State: PUBLISHED Published: 2023-06-05T13:39:00.960Z Last Updated: 2025-01-08T16:37:50.335Z Vendors: Unknown Products: Get your number Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Get your number WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1df111aa-6057-47a2-8e8b-9ef5ec3bb472
CVE ID: CVE-2023-2635 State: PUBLISHED Published: 2023-07-10T12:41:07.725Z Last Updated: 2024-11-13T21:39:02.755Z Vendors: Unknown Products: Call Now Accessibility Button Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/81b89613-18d0-4c13-84e3-9e2e1802fd7c
CVE ID: CVE-2023-2636 State: PUBLISHED Published: 2023-07-17T13:29:51.763Z Last Updated: 2025-02-13T16:44:53.802Z Vendors: Unknown Products: AN_GradeBook Problem Types: CWE-89 SQL Injection Description: The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6a3bfd88-1251-4d40-b26f-62950a3ce0b5 - http://packetstormsecurity.com/files/173815/WordPress-AN_Gradebook-5.0.1-SQL-Injection.html
CVE ID: CVE-2023-2637 State: PUBLISHED Published: 2023-06-13T20:15:07.735Z Last Updated: 2025-01-02T20:42:32.420Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H) Vendors: Rockwell Automation Products: FactoryTalk System Services Problem Types: CWE-321 Description: Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lead to privilege escalation. This vulnerability may allow a local, authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. This may allow the threat actor to m
ie giving them administrative privileges to the FactoryTalk Policy Manger database. This may allow the threat actor to make malicious changes to the database that will be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required for this vulnerability to be successfully exploited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139683
CVE ID: CVE-2023-2638 State: PUBLISHED Published: 2023-06-13T20:25:03.375Z Last Updated: 2025-01-02T20:45:55.640Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: Rockwell Automation Products: FactoryTalk System Services Problem Types: CWE-287 Description: Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives. This vulnerability may allow a local, authenticated non-admin user to craft a malicious backup archive, without password protection, that will be loaded by FactoryTalk System S
admin user to craft a malicious backup archive, without password protection, that will be loaded by FactoryTalk System Services as a valid backup when a restore procedure takes places. User interaction is required for this vulnerability to be successfully exploited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139683
CVE ID: CVE-2023-2639 State: PUBLISHED Published: 2023-06-13T20:28:28.153Z Last Updated: 2025-01-02T20:56:26.573Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: Rockwell Automation Products: FactoryTalk System Services Problem Types: CWE-346 Description: The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local client device. This may allow a threat actor to craft a malicious website that, when visited, will send a malicious script that can connect to the local Web
at actor to craft a malicious website that, when visited, will send a malicious script that can connect to the local WebSocket endpoint and wait for events as if it was a valid client device. If successfully exploited, this would allow a threat actor to receive information including whether FactoryTalk Policy Manager is installed and potentially the entire security policy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139683
CVE ID: CVE-2023-2640 State: PUBLISHED Published: 2023-07-26T01:59:23.543Z Last Updated: 2024-10-23T14:59:17.779Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Canonical Products: Ubuntu Kernel Problem Types: CWE-863 Description: On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ubuntu.com/security/notices/USN-6250-1
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ubuntu.com/security/notices/USN-6250-1 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640 - https://wiz.io/blog/ubuntu-overlayfs-vulnerability - https://lists.ubuntu.com/archives/kernel-team/2023-July/140923.html
CVE ID: CVE-2023-2641 State: PUBLISHED Published: 2023-05-11T05:31:03.735Z Last Updated: 2024-11-22T15:45:59.539Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Internship Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Internship Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin/login.php of the component POST Parameter Handler. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228770 is the identifier
ck may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228770 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.228770 - https://vuldb.com/?ctiid.228770 - https://github.com/csbsong/bug_report/blob/main/SQLi-1.md
CVE ID: CVE-2023-2642 State: PUBLISHED Published: 2023-05-11T06:00:05.816Z Last Updated: 2025-01-24T21:13:33.480Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Exam System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. This affects an unknown part of the file adminpanel/admin/facebox_modal/updateCourse.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is
otely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228771. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.228771 - https://vuldb.com/?ctiid.228771 - https://github.com/sushanburanxisha/cve/blob/main/SQLi-1.md
CVE ID: CVE-2023-2643 State: PUBLISHED Published: 2023-05-11T06:31:03.763Z Last Updated: 2024-08-02T06:26:09.925Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: File Tracker Manager System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester File Tracker Manager System 1.0. This vulnerability affects unknown code of the file register/update_password.php of the component POST Parameter Handler. The manipulation of the argument new_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-2
ed remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228772. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228772 - https://vuldb.com/?ctiid.228772 - https://github.com/GZRsecurity/cve/blob/main/SQLi.md
CVE ID: CVE-2023-2644 State: PUBLISHED Published: 2023-05-11T07:00:06.766Z Last Updated: 2024-08-02T06:26:09.830Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: DigitalPersona Products: FPSensor Problem Types: CWE-428 Description: A vulnerability, which was classified as problematic, has been found in DigitalPersona FPSensor 1.0.0.1. This issue affects some unknown processing of the file C:\Program Files (x86)\FPSensor\bin\DpHost.exe. The manipulation leads to unquoted search path. Attacking locally is a requirement. The identifier VDB-228773 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
773 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.228773 - https://vuldb.com/?ctiid.228773
CVE ID: CVE-2023-2645 State: PUBLISHED Published: 2023-05-11T07:00:08.579Z Last Updated: 2024-08-02T06:26:09.854Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: USR Products: USR-G806 Problem Types: CWE-259 Description: A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-228774 is the identifier assigned to
public and may be used. It is recommended to change the configuration settings. VDB-228774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228774 - https://vuldb.com/?ctiid.228774 - https://github.com/wswokao/testrouter/blob/main/README.md
CVE ID: CVE-2023-2646 State: PUBLISHED Published: 2023-05-11T07:31:04.076Z Last Updated: 2025-01-24T16:52:19.575Z Severity: N/A (CVSS 5 AV:A/AC:L/Au:M/C:N/I:N/A:C) Vendors: TP-Link Products: Archer C7v2 Problem Types: CWE-404 Description: A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component GET Request Parameter Handler. The manipulation leads to denial of service. The attack can only be done within the local network. The associated identifier of this vulnerability is VDB-228775. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
vulnerability is VDB-228775. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.228775 - https://vuldb.com/?ctiid.228775
CVE ID: CVE-2023-2647 State: PUBLISHED Published: 2023-05-11T07:31:05.039Z Last Updated: 2024-08-02T06:26:09.776Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Weaver Products: E-Office Problem Types: CWE-77 Description: A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/utility_all.php of the component File Upload Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228776. NOTE: The vendor was contacted early about this disclosure
be used. The identifier of this vulnerability is VDB-228776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228776 - https://vuldb.com/?ctiid.228776 - https://github.com/sunyixuan1228/cve/blob/main/weaver%20exec.md
CVE ID: CVE-2023-2648 State: PUBLISHED Published: 2023-05-11T08:00:04.941Z Last Updated: 2025-01-24T21:14:05.440Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Weaver Products: E-Office Problem Types: CWE-434 Description: A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclos
d. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.228777 - https://vuldb.com/?ctiid.228777 - https://github.com/sunyixuan1228/cve/blob/main/weaver.md
CVE ID: CVE-2023-2649 State: PUBLISHED Published: 2023-05-11T08:00:06.552Z Last Updated: 2024-08-02T06:26:09.909Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Tenda Products: AC23 Problem Types: CWE-77 Description: A vulnerability was found in Tenda AC23 16.03.07.45_cn. It has been declared as critical. This vulnerability affects unknown code of the file /bin/ate of the component Service Port 7329. The manipulation of the argument v2 leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-228778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosur
. VDB-228778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228778 - https://vuldb.com/?ctiid.228778 - https://github.com/xinzhihen06/ac23tenda/blob/main/tendaAC23.md