deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-21785
Published: 2024-05-28
Description: A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted series of network requests can lead to unauthorized access. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-489
References: https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003yaj2AA/sa00038; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1942; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1942
CVE: CVE-2024-22187
Published: 2024-05-28
Description: A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to an arbitrary write. An attacker can send an unauthenticated packet to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003yXV2AY/sa00036; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1940; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1940
CVE: CVE-2024-22590
Published: 2024-05-28
Description: The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connection has been established.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-372
References: https://gist.github.com/QUICTester/ea3eb2ac736bb63e47c654e14e3ec556; https://gist.github.com/QUICTester/ea3eb2ac736bb63e47c654e14e3ec556
CVE: CVE-2024-23315
Published: 2024-05-28
Description: A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can send an unauthenticated packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003yZ72AI/sa00037; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1941; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1941
CVE: CVE-2024-23601
Published: 2024-05-28
Description: A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted scan_lib.bin can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345, CWE-94
References: https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003ycL2AQ/sa00039; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1943; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1943
CVE: CVE-2024-24851
Published: 2024-05-28
Description: A heap-based buffer overflow vulnerability exists in the Programming Software Connection FiBurn functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a buffer overflow. An attacker can send an unauthenticated packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-805, CWE-787
References: https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003y1F2AQ/sa00025; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1936; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1936
CVE: CVE-2024-24946
Published: 2024-05-28
Description: A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb686c` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1937; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1937; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1937
CVE: CVE-2024-24947
Published: 2024-05-28
Description: A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb68c4` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1937; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1937; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1937
CVE: CVE-2024-24954
Published: 2024-05-28
Description: Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these vulnerabilities.This CVE tracks the arbitrary null-byte write vulnerability located in firmware 1.2.10.9 of the P3-550E at offset `0xb69c8`.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938
CVE: CVE-2024-24955
Published: 2024-05-28
Description: Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these vulnerabilities.This CVE tracks the arbitrary null-byte write vulnerability located in firmware 1.2.10.9 of the P3-550E at offset `0xb69fc`.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938
CVE: CVE-2024-24956
Published: 2024-05-28
Description: Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these vulnerabilities.This CVE tracks the arbitrary null-byte write vulnerability located in firmware 1.2.10.9 of the P3-550E at offset `0xb6a38`.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938
CVE: CVE-2024-24957
Published: 2024-05-28
Description: Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these vulnerabilities.This CVE tracks the arbitrary null-byte write vulnerability located in firmware 1.2.10.9 of the P3-550E at offset `0xb6aa4`.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938
CVE: CVE-2024-24958
Published: 2024-05-28
Description: Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these vulnerabilities.This CVE tracks the arbitrary null-byte write vulnerability located in firmware 1.2.10.9 of the P3-550E at offset `0xb6bdc`.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938
CVE: CVE-2024-24959
Published: 2024-05-28
Description: Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these vulnerabilities.This CVE tracks the arbitrary null-byte write vulnerability located in firmware 1.2.10.9 of the P3-550E at offset `0xb6c18`.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1938; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1938
CVE: CVE-2024-24962
Published: 2024-05-28
Description: A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to stack-based buffer overflow. An attacker can send an unauthenticated packet to trigger this vulnerability.This CVE tracks the stack-based buffer overflow that occurs at offset `0xb6e98` of v1.2.10.9 of the P3-550E firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1939; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939
CVE: CVE-2024-24963
Published: 2024-05-28
Description: A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to stack-based buffer overflow. An attacker can send an unauthenticated packet to trigger this vulnerability.This CVE tracks the stack-based buffer overflow that occurs at offset `0xb6e84` of v1.2.10.9 of the P3-550E firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1939; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1939
CVE: CVE-2024-30212
Published: 2024-05-28
Description: If a SCSI READ(10) command is initiated via USB using the largest LBA 
(0xFFFFFFFF) with it's default block size of 512 and a count of 1,

the first 512 byte of the 0x80000000 memory area is returned to the 
user. If the block count is increased, the full RAM can be exposed.

The same method works to write to this memory area. If RAM contains 
pointers, those can be - depending on the application - overwritten to

return data from any other offset including Progam and Boot Flash.
CWE: CWE-190
References: https://github.com/Fehr-GmbH/blackleak; https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md; https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216
CVE: CVE-2024-33799
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_teacher.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2018.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2018.pdf
CVE: CVE-2024-33800
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_student1.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the index parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2015.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2015.pdf
CVE: CVE-2024-33801
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_subject_routing.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2017.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2017.pdf
CVE: CVE-2024-33802
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_student_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the index parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2014.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2014.pdf
CVE: CVE-2024-33803
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_exam.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2011.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2011.pdf
CVE: CVE-2024-33804
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2016.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2016.pdf
CVE: CVE-2024-33805
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_student.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2013.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2013.pdf
CVE: CVE-2024-33806
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_grade.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2012.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2012.pdf
CVE: CVE-2024-33807
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_teacher_timetable.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the grade parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2019.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2019.pdf
CVE: CVE-2024-33808
Published: 2024-05-28
Description: A SQL injection vulnerability in /model/get_timetable.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2020.pdf; https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2020.pdf
CVE: CVE-2024-33849
Published: 2024-05-28
Description: ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-321, CWE-522, CWE-657, CWE-1391
References: https://www.ci-solution.com/produkte/ps-out-of-office.html; https://www.syss.de/pentest-blog/rechteausweitung-durch-unsichere-standardkonfiguration-im-ci-out-of-office-manager-syss-2024-013; https://www.ci-solution.com/produkte/ps-out-of-office.html
CVE: CVE-2024-35324
Published: 2024-05-28
Description: Douchat 4.0.5 suffers from an arbitrary file upload vulnerability via Public/Plugins/webuploader/server/preview.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/w0x68y/cve-lists/blob/main/CMS/Douchat/Douchat%204.0.5%20arbitrary%20file%20upload%20vulnerability.md; https://github.com/w0x68y/cve-lists/blob/main/CMS/Douchat/Douchat%204.0.5%20arbitrary%20file%20upload%20vulnerability.md
CVE: CVE-2024-35621
Published: 2024-05-28
Description: A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/getformwork/formwork/security/advisories/GHSA-gx8m-f3mp-fg99; https://github.com/getformwork/formwork/security/advisories/GHSA-gx8m-f3mp-fg99
CVE: CVE-2024-36472
Published: 2024-05-28
Description: In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript code's behavior.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/7688; https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/7688
CVE: CVE-2024-26024
Published: 2024-05-28
Description: SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in Substation Server.
CVSS Score: 8.4 (HIGH)
CWE: CWE-1357
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-02
CVE: CVE-2024-30164
Published: 2024-05-28
Description: Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions. This is resolved in 3.11.1 on Windows, 3.9.1 on macOS, and 3.12.1 on Linux. NOTE: although the macOS resolution is the same as for CVE-2024-30165, this vulnerability on macOS is not the same as CVE-2024-30165.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-linux.html; https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-macos.html; https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-windows.html
CVE: CVE-2024-30165
Published: 2024-05-28
Description: Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE-2024-30164.
CVSS Score: 7.1 (HIGH)
CWE: CWE-120
References: https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-macos.html; https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-macos.html
CVE: CVE-2024-34852
Published: 2024-05-28
Description: F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiver_schedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful exploitation of this vulnerability may allow the attacker to execute system commands.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md; https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md
CVE: CVE-2024-34854
Published: 2024-05-28
Description: F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.`
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md; https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md
CVE: CVE-2024-35341
Published: 2024-05-28
Description: Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFile.ini or /config.xml URIs. This configuration file contains usernames and encrypted passwords (encrypted with a hardcoded key common to all devices). This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://willgu.es/pages/anpviz-ip-camera-vuln.html; https://willgu.es/pages/anpviz-ip-camera-vuln.html