Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-41152 State: PUBLISHED Published: 2023-09-13T00:00:00 Last Updated: 2024-09-26T13:19:38.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the handle program field while creating a new MIME type program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41152
CVE ID: CVE-2023-41153 State: PUBLISHED Published: 2023-08-29T00:00:00 Last Updated: 2024-10-02T13:19:05.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via options for the host value while editing the host options. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.001/blob/main/CVE-2023-41153
CVE ID: CVE-2023-41154 State: PUBLISHED Published: 2023-09-13T00:00:00 Last Updated: 2024-09-26T13:15:37.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41154
CVE ID: CVE-2023-41155 State: PUBLISHED Published: 2023-09-13T00:00:00 Last Updated: 2024-09-25T20:39:56.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the forward to field while creating a mail forwarding rule. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41155
CVE ID: CVE-2023-41156 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T19:33:15.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the save to new folder named field while creating a new filter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.001/blob/main/CVE-2023-41156
CVE ID: CVE-2023-41157 State: PUBLISHED Published: 2023-09-16T00:00:00 Last Updated: 2024-09-25T18:47:25.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name parameter while creating the folder to manage the folder tab, filter tab, and forward mail tab. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41157
CVE ID: CVE-2023-41158 State: PUBLISHED Published: 2023-09-13T00:00:00 Last Updated: 2024-09-25T20:36:19.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the description field while creating a new MIME type program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41158
CVE ID: CVE-2023-41159 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T19:30:29.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML by editing the forward file manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41159
CVE ID: CVE-2023-41160 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T19:22:51.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the key name field while adding an authorized key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.001/blob/main/CVE-2023-41160
CVE ID: CVE-2023-41161 State: PUBLISHED Published: 2023-09-07T00:00:00 Last Updated: 2024-09-26T19:03:09.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41161
CVE ID: CVE-2023-41162 State: PUBLISHED Published: 2023-09-13T00:00:00 Last Updated: 2024-09-25T20:34:26.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the file mask field while searching under the tools drop down. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41162
CVE ID: CVE-2023-41163 State: PUBLISHED Published: 2023-08-30T00:00:00 Last Updated: 2024-10-01T19:56:18.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webmin.com/tags/webmin-changelog/ - https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41163
CVE ID: CVE-2023-41164 State: PUBLISHED Published: 2023-11-03T00:00:00.000Z Last Updated: 2025-11-04T17:12:37.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.2/releases/security/ - https://www.djangoproject.com/weblog/2023/sep/04/security-releases/ - https://lists.fedoraproject.org/archives/li
ity/ - https://www.djangoproject.com/weblog/2023/sep/04/security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJFRPUHDYJHBH3KYHSPGULQM4JN7BMSU/ - https://security.netapp.com/advisory/ntap-20231214-0002/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D/
CVE ID: CVE-2023-41165 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T18:54:03.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer with malicious JavaScript elements that can result in data theft. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.stormshield.eu/2023-020/
CVE ID: CVE-2023-41166 State: PUBLISHED Published: 2023-12-20T00:00:00 Last Updated: 2024-11-26T16:19:52.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1. It's possible to know if a specific user account exists on the SNS firewall by using remote access commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.stormshield.eu/2023-027
CVE ID: CVE-2023-41167 State: PUBLISHED Published: 2023-08-25T00:00:00 Last Updated: 2024-10-02T17:52:37.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: @webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the editor.js rich text editor to handle rich text content. The CMS stores rich text content from the editor.js into the database. When the @webiny/react-rich-text-renderer is used to render such content, it uses the dangerouslySetInnerHT
he database. When the @webiny/react-rich-text-renderer is used to render such content, it uses the dangerouslySetInnerHTML prop, without applying HTML sanitization. The issue arises when an actor, who in this context would specifically be a content manager with access to the CMS, inserts a malicious script as part of the user-defined input. This script is then injected and executed within the user's browser when the main page or admin page loads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://webiny.com - https://github.com/webiny/webiny-js/security/advisories/GHSA-3x59-vrmc-5mx6
CVE ID: CVE-2023-41168 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T18:54:04.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 1 of 4). Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2023-41169 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T18:54:04.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 2 of 4). Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2023-41170 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T18:54:04.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2023-41171 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-11-26T15:25:03.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 3 of 4). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2023-41172 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T18:54:04.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 4 of 4). Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2023-41173 State: PUBLISHED Published: 2023-08-25T00:00:00 Last Updated: 2024-10-02T17:51:37.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://adguard-dns.io/en/versions.html#2.2
CVE ID: CVE-2023-41174 State: PUBLISHED Published: 2023-09-26T20:12:03.609Z Last Updated: 2025-11-04T19:20:59.069Z Vendors: Apple Products: iOS and iPadOS, tvOS, watchOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213936 - https://support.apple.com/en-us/HT213937 - http://seclists.org/fulld
213938 - https://support.apple.com/en-us/HT213936 - https://support.apple.com/en-us/HT213937 - http://seclists.org/fulldisclosure/2023/Oct/10 - http://seclists.org/fulldisclosure/2023/Oct/8 - http://seclists.org/fulldisclosure/2023/Oct/9
CVE ID: CVE-2023-41175 State: PUBLISHED Published: 2023-10-05T18:55:26.876Z Last Updated: 2025-11-20T18:27:54.142Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-190 Description: A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
age, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2289 - https://access.redhat.com/security/cve/CVE-2023-41175 - https://bugzilla.redhat.com/show_bug.cgi?id=2235264
CVE ID: CVE-2023-41176 State: PUBLISHED Published: 2024-01-23T20:35:25.291Z Last Updated: 2025-06-20T18:47:18.273Z Vendors: Trend Micro, Inc. Products: Trend Micro Mobile Security for Enterprise Description: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker. Please note, this vulnerability is similar to, but not identical to, CVE-2023-41177. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US - https://www.zerodayinitiative.com/advi
ences: - https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US - https://www.zerodayinitiative.com/advisories/ZDI-24-078/
CVE ID: CVE-2023-41177 State: PUBLISHED Published: 2024-01-23T20:35:37.218Z Last Updated: 2025-05-30T14:18:56.310Z Vendors: Trend Micro, Inc. Products: Trend Micro Mobile Security for Enterprise Description: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker. Please note, this vulnerability is similar to, but not identical to, CVE-2023-41178. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US - https://www.zerodayinitiative.com/advi
ences: - https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US - https://www.zerodayinitiative.com/advisories/ZDI-24-079/
CVE ID: CVE-2023-41178 State: PUBLISHED Published: 2024-01-23T20:36:01.653Z Last Updated: 2025-06-09T20:42:42.334Z Vendors: Trend Micro, Inc. Products: Trend Micro Mobile Security for Enterprise Description: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker. Please note, this vulnerability is similar to, but not identical to, CVE-2023-41176. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US - https://www.zerodayinitiative.com/advi
ences: - https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US - https://www.zerodayinitiative.com/advisories/ZDI-24-080/
CVE ID: CVE-2023-41179 State: PUBLISHED Published: 2023-09-19T13:44:57.831Z Last Updated: 2025-10-21T23:05:37.728Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security, Trend Micro Worry-Free Business Security Services Description: A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability. Ad
attacker must first obtain administrative console access on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000294994 - https://success.trendmicro.com/jp/solution/000294706 - https://jvn.jp/en/vu/JVNVU90967486/
CVE ID: CVE-2023-41180 State: PUBLISHED Published: 2023-09-03T15:52:52.884Z Last Updated: 2024-09-27T18:47:25.827Z Vendors: Apache Software Foundation Products: Apache NiFi MiNiFi C++ Problem Types: CWE-295 Description: Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS. Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects
property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y
CVE ID: CVE-2023-41181 State: PUBLISHED Published: 2024-05-03T02:11:42.944Z Last Updated: 2024-08-02T18:54:04.323Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: LG Products: SuperSign Media Editor Problem Types: CWE-22 Description: LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG SuperSign Media Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getSubFolderList method. The issue results from the lack of proper validation of a user-supplied pat
w exists within the getSubFolderList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20330. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1220/
CVE ID: CVE-2023-41182 State: PUBLISHED Published: 2024-05-03T02:11:43.770Z Last Updated: 2024-09-18T18:29:58.463Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: ProSAFE Network Management System Problem Types: CWE-22 Description: NETGEAR ProSAFE Network Management System ZipUtils Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ZipUtils cl
is vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ZipUtils class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19716. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1284/ - https://kb.netgear.com/000065705/Security-Advisory-for-Post-authentication-Command-Injection-on-the-Prosafe-Network-Management-System-PSV-2023-0037
CVE ID: CVE-2023-41183 State: PUBLISHED Published: 2024-05-03T02:11:44.607Z Last Updated: 2024-08-02T18:54:04.418Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: Orbi 760 Problem Types: CWE-306 Description: NETGEAR Orbi 760 SOAP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR Orbi 760 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SOAP API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverag
PI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20524. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1283/ - https://kb.netgear.com/000065734/Security-Advisory-for-Authentication-Bypass-on-the-RBR760-PSV-2023-0052
CVE ID: CVE-2023-41184 State: PUBLISHED Published: 2024-05-03T02:11:45.362Z Last Updated: 2024-09-18T18:29:59.278Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: Tapo C210 Problem Types: CWE-121 Description: TP-Link Tapo C210 ActiveCells Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Tapo C210 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the ActiveCells parameter of the Cre