deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-41219
Published: 2024-05-03
Description: D-Link DIR-3040 prog.cgi SetWanSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21619.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1327/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41220
Published: 2024-05-03
Description: D-Link DIR-3040 prog.cgi SetSysEmailSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21620.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1328/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41221
Published: 2024-05-03
Description: D-Link DIR-3040 prog.cgi SetWLanRadioSecurity Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21621.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1329/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41223
Published: 2024-05-03
Description: D-Link DIR-3040 prog.cgi SetQuickVPNSettings PSK Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21623.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1331/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41224
Published: 2024-05-03
Description: D-Link DIR-3040 prog.cgi SetDeviceSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21650.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1332/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41225
Published: 2024-05-03
Description: D-Link DIR-3040 prog.cgi SetIPv6PppoeSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21651.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1333/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41226
Published: 2024-05-03
Description: D-Link DIR-3040 prog.cgi SetMyDLinkRegistration Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21652.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1334/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41227
Published: 2024-05-03
Description: D-Link DIR-3040 prog.cgi SetTriggerPPPoEValidate Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21653.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1335/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41228
Published: 2024-05-03
Description: D-Link DIR-3040 prog.cgi SetUsersSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21654.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1336/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41229
Published: 2024-05-03
Description: D-Link DIR-3040 HTTP Request Processing Referer Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21671.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1337/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-41230
Published: 2024-05-03
Description: D-Link DIR-3040 HTTP Request Processing Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21674.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350; https://www.zerodayinitiative.com/advisories/ZDI-23-1338/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10350
CVE: CVE-2023-42032
Published: 2024-05-03
Description: Visualware MyConnection Server doRTAAccessUPass Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Visualware MyConnection Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the doRTAAccessUPass method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-21611.
CVSS Score: 7.5 (HIGH)
CWE: CWE-749
References: https://myconnectionserver.visualware.com/support/security-advisories; https://www.zerodayinitiative.com/advisories/ZDI-23-1398/; https://myconnectionserver.visualware.com/support/security-advisories
CVE: CVE-2023-42033
Published: 2024-05-03
Description: Visualware MyConnection Server doPostUploadfiles Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Visualware MyConnection Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the doPostUploadfiles method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21612.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://myconnectionserver.visualware.com/support/security-advisories; https://www.zerodayinitiative.com/advisories/ZDI-23-1396/; https://myconnectionserver.visualware.com/support/security-advisories
CVE: CVE-2023-42034
Published: 2024-05-03
Description: Visualware MyConnection Server doRTAAccessCTConfig Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Visualware MyConnection Server. Minimal user interaction is required to exploit this vulnerability.

The specific flaw exists within the doRTAAccessCTConfig method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21613.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://myconnectionserver.visualware.com/support/security-advisories; https://www.zerodayinitiative.com/advisories/ZDI-23-1399/; https://myconnectionserver.visualware.com/support/security-advisories
CVE: CVE-2023-42035
Published: 2024-05-03
Description: Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Visualware MyConnection Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the doIForward method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-21774.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://myconnectionserver.visualware.com/support/security-advisories; https://www.zerodayinitiative.com/advisories/ZDI-23-1397/; https://myconnectionserver.visualware.com/support/security-advisories
CVE: CVE-2023-42036
Published: 2024-05-03
Description: Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21582.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1393/; https://www.zerodayinitiative.com/advisories/ZDI-23-1393/
CVE: CVE-2023-42037
Published: 2024-05-03
Description: Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21583.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1392/; https://www.zerodayinitiative.com/advisories/ZDI-23-1392/
CVE: CVE-2023-42038
Published: 2024-05-03
Description: Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21602.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1394/; https://www.zerodayinitiative.com/advisories/ZDI-23-1394/
CVE: CVE-2023-42039
Published: 2024-05-03
Description: Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21603.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1395/; https://www.zerodayinitiative.com/advisories/ZDI-23-1395/
CVE: CVE-2023-42040
Published: 2024-05-03
Description: PDF-XChange Editor mailForm Use-After-Free Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the mailForm method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20663.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1391/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42041
Published: 2024-05-03
Description: PDF-XChange Editor Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20845.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1356/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42042
Published: 2024-05-03
Description: PDF-XChange Editor App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20848.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1355/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42043
Published: 2024-05-03
Description: PDF-XChange Editor PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20887.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1370/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42044
Published: 2024-05-03
Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. his vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20889.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1360/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42045
Published: 2024-05-03
Description: PDF-XChange Editor J2K File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of J2K files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20906.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1354/; https://www.tracker-software.com/support/security-bulletins.html