deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8411
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x00023BCC which calls the "Send_mail" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2019-5443
Published: 2019-07-02
Description: A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-427
References: http://www.openwall.com/lists/oss-security/2019/06/24/1; http://www.securityfocus.com/bid/108881; https://curl.haxx.se/docs/CVE-2019-5443.html
CVE: CVE-2019-7252
Published: 2019-07-02
Description: Linear eMerge E3-Series devices have Default Credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7253
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow Directory Traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7254
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow File Inclusion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/155252/Linear-eMerge-E3-1.00-06-Directory-Traversal.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005
CVE: CVE-2019-7255
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155253/Linear-eMerge-E3-1.00-06-Cross-Site-Scripting.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005
CVE: CVE-2019-7256
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow Command Injections.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html; http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html; http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html
CVE: CVE-2019-7257
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow Unrestricted File Upload.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155254/Linear-eMerge-E3-1.00-06-Arbitrary-File-Upload-Remote-Root-Code-Execution.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005
CVE: CVE-2019-7258
Published: 2019-07-02
Description: Linear eMerge E3-Series devices allow Privilege Escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://packetstormsecurity.com/files/155260/Linear-eMerge-E3-1.00-06-Privilege-Escalation.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-005
CVE: CVE-2017-8405
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8406
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In this case, user's credentials are stored in clear text on the device and can be pulled easily. It also seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site flashing attack on the user's browser and execute any action on the device provided by the web management interface which steals the credentials from tools_admin.cgi file's response and displays it inside a Textfield.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8409
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the device does not enforce the same restriction on a specific URL thereby allowing any attacker in possession of that to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8410
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8414
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f" and stores it on the stack. Since there is no length check, this results in corrupting the registers for the function sub_A098 which results in memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2019-10136
Published: 2019-07-02
Description: It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://www.securityfocus.com/bid/109029; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10136; http://www.securityfocus.com/bid/109029
CVE: CVE-2019-10137
Published: 2019-07-02
Description: A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137
CVE: CVE-2019-10975
Published: 2019-07-02
Description: An out-of-bounds read vulnerability has been identified in Fuji Electric Alpha7 PC Loader Versions 1.1 and prior, which may crash the system.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://www.securityfocus.com/bid/108359; https://felib.fujielectric.co.jp/download/search2.htm?dosearch=1&site=global&lang=en&documentGroup=software; https://www.us-cert.gov/ics/advisories/ICSA-19-136-02%2C
CVE: CVE-2019-13173
Published: 2019-07-02
Description: fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00052.html; https://github.com/npm/fstream/commit/6a77d2fa6e1462693cf8e46f930da96ec1b0bb22
CVE: CVE-2019-13175
Published: 2019-07-02
Description: Read the Docs before 3.5.1 has an Open Redirect if certain user-defined redirects are used. This affects private instances of Read the Docs (in addition to the public readthedocs.org web sites).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/readthedocs/readthedocs.org/security/advisories/GHSA-2mw9-4c46-qrcv; https://github.com/readthedocs/readthedocs.org/security/advisories/GHSA-2mw9-4c46-qrcv
CVE: CVE-2017-11578
Published: 2019-07-02
Description: It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect to web management interface on a non-SSL connection using plain text HTTP protocol. The user uses the web management interface of the device to provide the user's Wi-Fi credentials so that the device can connect to it and have Internet access. This device acts as a Wireless Blood pressure monitor and is used to measure blood pressure levels of a person. This allows an attacker who is connected to the Blipcare's device wireless network to easily sniff these values using a MITM attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Blipcare_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-11579
Published: 2019-07-02
Description: In the most recent firmware for Blipcare, the device provides an open Wireless network called "Blip" for communicating with the device. The user connects to this open Wireless network and uses the web management interface of the device to provide the user's Wi-Fi credentials so that the device can connect to it and have Internet access. This device acts as a Wireless Blood pressure monitor and is used to measure blood pressure levels of a person. This allows an attacker who is in vicinity of Wireless signal generated by the Blipcare device to easily sniff the credentials. Also, an attacker can connect to the open wireless network "Blip" exposed by the device and modify the HTTP response presented to the user by the device to execute other attacks such as convincing the user to download and execute a malicious binary that would infect a user's computer or mobile device with malware.
CVSS Score: 7.1 (HIGH)
CWE: CWE-254
References: http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Blipcare_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-11580
Published: 2019-07-02
Description: Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the "Blip" open wireless connection provided by the device, if a large string is sent as a part of the HTTP request in any part of the HTTP headers, the device could become completely unresponsive. Presumably this happens as the memory footprint provided to this device is very small. According to the specs from Rezolt, the Wi-Fi module only has 256k of memory. As a result, an incorrect string copy operation using either memcpy, strcpy, or any of their other variants could result in filling up the memory space allocated to the function executing and this would result in memory corruption. To test the theory, one can modify the demo application provided by the Cypress WICED SDK and introduce an incorrect "memcpy" operation and use the compiled application on the evaluation board provided by Cypress semiconductors with exactly the same Wi-Fi SOC. The results were identical where the device would completely stop responding to any of the ping or web requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Blipcare_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8412
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8413
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that handles commands to be executed on the device. The custom protocol created by D-Link follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111. If a packet is received with the packet type being "S" or 0x53 then the string passed in the "C" parameter is base64 decoded and then executed by passing into a System API. We can see at address 0x00009B44 that the string received in packet type subtracts 0x31 or "1" from the packet type and is compared against 0x22 or "double quotes". If that is the case, then the packet is sent towards the block of code that executes a command. Then the value stored in "C" parameter is extracted at address 0x0000A1B0. Finally, the string received is base 64 decoded and passed on to the system API at address 0x0000A2A8 as shown below. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8415
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string "admin" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8416
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8417
Published: 2019-07-02
Description: An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. However, the device allows D-Link apps on the mobile devices and desktop to communicate with the device without any authentication. As a part of that communication, the device uses custom version of base64 encoding to pass data back and forth between the apps and the device. However, the same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third party to retrieve the device's password without any authentication by sending just 1 UDP packet with custom base64 encoding. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.
CVSS Score: 8.8 (HIGH)
CWE: CWE-255
References: http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2019-5599
Published: 2019-07-02
Description: In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://packetstormsecurity.com/files/153329/Linux-FreeBSD-TCP-Based-Denial-Of-Service.html; http://packetstormsecurity.com/files/153378/FreeBSD-Security-Advisory-FreeBSD-SA-19-08.rack.html; http://www.openwall.com/lists/oss-security/2019/06/17/5
CVE: CVE-2019-6620
Published: 2019-07-02
Description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, an undisclosed iControl REST worker vulnerable to command injection for an Administrator user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://support.f5.com/csp/article/K20445457; https://support.f5.com/csp/article/K20445457