deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-40505
Published: 2024-05-03
Description: LG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the createThumbnailByMovie method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19978.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1209/; https://www.zerodayinitiative.com/advisories/ZDI-23-1209/
CVE: CVE-2023-40506
Published: 2024-05-03
Description: LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the copyContent command. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
. Was ZDI-CAN-20005.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1210/; https://www.zerodayinitiative.com/advisories/ZDI-23-1210/
CVE: CVE-2023-40507
Published: 2024-05-03
Description: LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the copyContent command. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
. Was ZDI-CAN-20006.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1211/; https://www.zerodayinitiative.com/advisories/ZDI-23-1211/
CVE: CVE-2023-40508
Published: 2024-05-03
Description: LG Simple Editor putCanvasDB Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the putCanvasDB method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM.
. Was ZDI-CAN-20010.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1212/; https://www.zerodayinitiative.com/advisories/ZDI-23-1212/
CVE: CVE-2023-40509
Published: 2024-05-03
Description: LG Simple Editor deleteCanvas Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the deleteCanvas method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM.
. Was ZDI-CAN-20011.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1213/; https://www.zerodayinitiative.com/advisories/ZDI-23-1213/
CVE: CVE-2023-40510
Published: 2024-05-03
Description: LG Simple Editor getServerSetting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getServerSetting method. The issue results from the exposure of plaintext credentials. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-20012.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-522
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1214/; https://www.zerodayinitiative.com/advisories/ZDI-23-1214/
CVE: CVE-2023-40511
Published: 2024-05-03
Description: LG Simple Editor checkServer Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the checkServer method. The issue results from the exposure of plaintext credentials. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-20013.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-522
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1215/; https://www.zerodayinitiative.com/advisories/ZDI-23-1215/
CVE: CVE-2023-40512
Published: 2024-05-03
Description: LG Simple Editor PlayerController getImageByFilename Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the getImageByFilename method in the PlayerController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
. Was ZDI-CAN-20014.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1216/; https://www.zerodayinitiative.com/advisories/ZDI-23-1216/
CVE: CVE-2023-40513
Published: 2024-05-03
Description: LG Simple Editor UserManageController getImageByFilename Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the getImageByFilename method in the UserManageController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
. Was ZDI-CAN-20015.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1195/; https://www.zerodayinitiative.com/advisories/ZDI-23-1195/
CVE: CVE-2023-40514
Published: 2024-05-03
Description: LG Simple Editor FileManagerController getImageByFilename Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the getImageByFilename method in the FileManagerController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
. Was ZDI-CAN-20016.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1196/; https://www.zerodayinitiative.com/advisories/ZDI-23-1196/
CVE: CVE-2023-40515
Published: 2024-05-03
Description: LG Simple Editor joinAddUser Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the joinAddUser method. The issue results from improper input validation. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
. Was ZDI-CAN-20048.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1197/; https://www.zerodayinitiative.com/advisories/ZDI-23-1197/
CVE: CVE-2023-40516
Published: 2024-05-03
Description: LG Simple Editor Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of LG Simple Editor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The product sets incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-20327.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1218/; https://www.zerodayinitiative.com/advisories/ZDI-23-1218/
CVE: CVE-2023-40517
Published: 2024-05-03
Description: LG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG SuperSign Media Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getObject method implemented in the ContentRestController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20328.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1219/; https://www.zerodayinitiative.com/advisories/ZDI-23-1219/
CVE: CVE-2023-41181
Published: 2024-05-03
Description: LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG SuperSign Media Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getSubFolderList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20330.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1220/; https://www.zerodayinitiative.com/advisories/ZDI-23-1220/
CVE: CVE-2023-41182
Published: 2024-05-03
Description: NETGEAR ProSAFE Network Management System ZipUtils Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the ZipUtils class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19716.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://kb.netgear.com/000065705/Security-Advisory-for-Post-authentication-Command-Injection-on-the-Prosafe-Network-Management-System-PSV-2023-0037; https://www.zerodayinitiative.com/advisories/ZDI-23-1284/; https://kb.netgear.com/000065705/Security-Advisory-for-Post-authentication-Command-Injection-on-the-Prosafe-Network-Management-System-PSV-2023-0037
CVE: CVE-2023-41183
Published: 2024-05-03
Description: NETGEAR Orbi 760 SOAP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR Orbi 760 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the SOAP API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20524.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://kb.netgear.com/000065734/Security-Advisory-for-Authentication-Bypass-on-the-RBR760-PSV-2023-0052; https://www.zerodayinitiative.com/advisories/ZDI-23-1283/; https://kb.netgear.com/000065734/Security-Advisory-for-Authentication-Bypass-on-the-RBR760-PSV-2023-0052
CVE: CVE-2023-41184
Published: 2024-05-03
Description: TP-Link Tapo C210 ActiveCells Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Tapo C210 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the handling of the ActiveCells parameter of the CreateRules and ModifyRules APIs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20589.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1287/; https://www.zerodayinitiative.com/advisories/ZDI-23-1287/
CVE: CVE-2023-41185
Published: 2024-05-03
Description: Unified Automation UaGateway Certificate Parsing Integer Overflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of client certificates. When parsing the certificate length field, the process does not properly validate user-supplied data, which can result in an integer overflow. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20353.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1286/; https://www.zerodayinitiative.com/advisories/ZDI-23-1286/
CVE: CVE-2023-41186
Published: 2024-05-03
Description: D-Link DAP-1325 CGI Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to access various functionality on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the CGI interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-18804.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351; https://www.zerodayinitiative.com/advisories/ZDI-23-1323/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
CVE: CVE-2023-41187
Published: 2024-05-03
Description: D-Link DAP-1325 HNAP Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the HNAP interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18807.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351; https://www.zerodayinitiative.com/advisories/ZDI-23-1322/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
CVE: CVE-2023-41188
Published: 2024-05-03
Description: D-Link DAP-1325 HNAP SetAPLanSettings DeviceName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18808.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351; https://www.zerodayinitiative.com/advisories/ZDI-23-1296/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
CVE: CVE-2023-41189
Published: 2024-05-03
Description: D-Link DAP-1325 HNAP SetAPLanSettings Gateway Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18809.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351; https://www.zerodayinitiative.com/advisories/ZDI-23-1297/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
CVE: CVE-2023-41190
Published: 2024-05-03
Description: D-Link DAP-1325 HNAP SetAPLanSettings IPAddr Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18810.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351; https://www.zerodayinitiative.com/advisories/ZDI-23-1298/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
CVE: CVE-2023-41191
Published: 2024-05-03
Description: D-Link DAP-1325 HNAP SetAPLanSettings Mode Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18811.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351; https://www.zerodayinitiative.com/advisories/ZDI-23-1299/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
CVE: CVE-2023-41192
Published: 2024-05-03
Description: D-Link DAP-1325 HNAP SetAPLanSettings PrimaryDNS Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18812.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351; https://www.zerodayinitiative.com/advisories/ZDI-23-1300/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
CVE: CVE-2023-41193
Published: 2024-05-03
Description: D-Link DAP-1325 HNAP SetAPLanSettings SecondaryDNS Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18813.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351; https://www.zerodayinitiative.com/advisories/ZDI-23-1301/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
CVE: CVE-2023-41194
Published: 2024-05-03
Description: D-Link DAP-1325 HNAP SetAPLanSettings SubnetMask Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18814.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351; https://www.zerodayinitiative.com/advisories/ZDI-23-1302/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351