deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-24758
Published: 2023-03-01
Description: libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/strukturag/libde265/issues/383; https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html; https://github.com/strukturag/libde265/issues/383
CVE: CVE-2023-25221
Published: 2023-03-01
Description: Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function in motion.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/strukturag/libde265/issues/388; https://lists.debian.org/debian-lts-announce/2023/03/msg00004.html; https://github.com/strukturag/libde265/issues/388
CVE: CVE-2023-25222
Published: 2023-03-01
Description: A heap-based buffer overflow vulnerability exits in GNU LibreDWG v0.12.5 via the bit_read_RC function at bits.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibreDWG/libredwg/issues/615; https://github.com/LibreDWG/libredwg/issues/615
CVE: CVE-2023-25544
Published: 2023-03-01
Description: 
Dell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and may launch target-specific attacks.


CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-668
References: https://www.dell.com/support/kbdoc/en-us/000210471/dsa-2023-058-dell-networker-security-update-for-version-disclosure-vulnerability; https://www.dell.com/support/kbdoc/en-us/000210471/dsa-2023-058-dell-networker-security-update-for-version-disclosure-vulnerability
CVE: CVE-2022-36021
Published: 2023-03-01
Description: Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-407, CWE-407
References: https://github.com/redis/redis/commit/dcbfcb916ca1a269b3feef86ee[PII_REDACTED]8f84; https://github.com/redis/redis/security/advisories/GHSA-jr7j-rfj5-8xqv; https://github.com/redis/redis/commit/dcbfcb916ca1a269b3feef86ee[PII_REDACTED]8f84
CVE: CVE-2022-45608
Published: 2023-03-01
Description: An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to gain escalated privileges (vertically) and become an Administrator (TENANT_ADMIN) or (SYS_ADMIN) on the web application. It is important to note that in order to accomplish this, the attacker must know the corresponding API's parameter (authority : value).
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://thingsboard.com; https://wiki.wizard32.net/en/blog/access-control-vulnerability-ThingsBoard; http://thingsboard.com
CVE: CVE-2023-0507
Published: 2023-03-01
Description: Grafana is an open-source platform for monitoring and observability. 

Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. 

The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. 

An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. 

This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. 

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://grafana.com/security/security-advisories/cve-2023-0507/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://grafana.com/security/security-advisories/cve-2023-0507/
CVE: CVE-2023-0594
Published: 2023-03-01
Description: Grafana is an open-source platform for monitoring and observability. 

Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. 

The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded.

An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. 

This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. 

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix. 


CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://grafana.com/security/security-advisories/cve-2023-0594/; https://grafana.com/security/security-advisories/cve-2023-0594/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-39228
Published: 2023-03-01
Description: vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-204, CWE-203
References: https://github.com/vantage6/vantage6/commit/ab4381c35d24add06f75d5a8a284321f7a340bd2; https://github.com/vantage6/vantage6/issues/59; https://github.com/vantage6/vantage6/pull/281
CVE: CVE-2023-0460
Published: 2023-03-01
Description: The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s ClassLoader. A potential vulnerability in the binding logic used by the client SDK where the SDK ends up calling bindService() on a malicious app rather than YT Main App. This creates a vulnerability where the SDK can load the malicious app’s ClassLoader instead, allowing the malicious app to load arbitrary code into the calling app whenever the embedded SDK is invoked.

In order to trigger this vulnerability, an attacker must masquerade the Youtube app and install it on a device, have a second app that uses the Embedded player and typically distribute both to the victim outside of the Play Store.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-470, CWE-470
References: https://developers.google.com/youtube/android/player/downloads; https://developers.google.com/youtube/android/player/downloads
CVE: CVE-2022-3162
Published: 2023-03-01
Description: Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://github.com/kubernetes/kubernetes/issues/113756; https://groups.google.com/g/kubernetes-security-announce/c/iUd550j7kjA; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-3294
Published: 2023-03-01
Description: Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: https://github.com/kubernetes/kubernetes/issues/113757; https://groups.google.com/g/kubernetes-security-announce/c/VyPOxF7CIbA; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-48309
Published: 2023-03-01
Description: A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf; https://www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf
CVE: CVE-2022-48310
Published: 2023-03-01
Description: An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf; https://www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf
CVE: CVE-2022-4901
Published: 2023-03-01
Description: Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim.
CVSS Score: 3.3 (LOW)
CWE: CWE-79, CWE-79
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf; https://www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf
CVE: CVE-2023-1127
Published: 2023-03-01
Description: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
CVSS Score: 7.8 (HIGH)
CWE: CWE-369
References: https://github.com/vim/vim/commit/e0f869196930ef5f25a0ac41c9215b09c9ce2d3c; https://huntr.dev/bounties/2d4d309e-4c96-415f-9070-36d0815f1beb; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/
CVE: CVE-2023-23000
Published: 2023-03-01
Description: In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17; https://github.com/torvalds/linux/commit/045a31b95509c8f25f5f04ec5e0dec5cd09f2c5f; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-25931
Published: 2023-03-01
Description: Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app.  Changes still cannot be made outside of the established therapy parameters of the programmer.  For unauthorized access to occur, an individual would need physical access to the Smart Programmer. 


CVSS Score: 6.4 (MEDIUM)
CWE: CWE-620, CWE-287
References: https://global.medtronic.com/xg-en/product-security/security-bulletins/pelvic-health-interstim-micro.html; https://global.medtronic.com/xg-en/product-security/security-bulletins/pelvic-health-interstim-micro.html
CVE: CVE-2023-1097
Published: 2023-03-01
Description: Baicells EG7035-M11 devices with firmware through  BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery.






CVSS Score: 9.3 (CRITICAL)
CWE: CWE-94, CWE-77
References: https://community.na.baicells.com/t/baice-bm-2-5-26-new-cpe-software-has-been-released/1756; https://img.baicells.com//Upload/20220524/FILE/BaiCE_BM_2.5.26_NA.bin.bin; https://community.na.baicells.com/t/baice-bm-2-5-26-new-cpe-software-has-been-released/1756
CVE: CVE-2023-1130
Published: 2023-03-01
Description: A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222105 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/WhiteA1so/Cvetest/blob/main/Sql1.pdf; https://vuldb.com/?ctiid.222105; https://vuldb.com/?id.222105
CVE: CVE-2023-1131
Published: 2023-03-01
Description: A vulnerability has been found in SourceCodester Computer Parts Sales and Inventory System 1.0 and classified as problematic. This vulnerability affects unknown code of the file customer.php. The manipulation of the argument FIRST_NAME/LAST_NAME/PHONE_NUMBER leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222106 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/WhiteA1so/Cvetest/blob/main/1.pdf; https://vuldb.com/?ctiid.222106; https://vuldb.com/?id.222106
CVE: CVE-2023-23001
Published: 2023-03-01
Description: In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3; https://github.com/torvalds/linux/commit/3ba880a12df5aa4488c18281701b5b1bc3d4531a; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
CVE: CVE-2023-23002
Published: 2023-03-01
Description: In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3; https://github.com/torvalds/linux/commit/[PII_REDACTED]a28c09b5dfc401c1ad[PII_REDACTED]4; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
CVE: CVE-2023-23003
Published: 2023-03-01
Description: In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-252, CWE-252
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16; https://github.com/torvalds/linux/commit/0a515a06c5ebfa46fee3ac519e418f801e718da4; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-23004
Published: 2023-03-01
Description: In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19; https://github.com/torvalds/linux/commit/15342f930ebebcfe36f[PII_REDACTED]a77d7d2e045; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2023-23005
Published: 2023-03-01
Description: In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.suse.com/show_bug.cgi?id=1208844#c2; https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2; https://github.com/torvalds/linux/commit/4a625ceee8a0ab0273534cb6b432ce6b331db5ee
CVE: CVE-2023-23006
Published: 2023-03-01
Description: In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.13; https://github.com/torvalds/linux/commit/6b8b42585886c59a[PII_REDACTED]82aae434349094; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.13
CVE: CVE-2023-24128
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey2_DoS
CVE: CVE-2023-24129
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey4_DoS
CVE: CVE-2023-24130
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey_DoS
CVE: CVE-2023-24131
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1_5g parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey1_5g_DoS
CVE: CVE-2023-24132
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey3_5g parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey3_5g_DoS
CVE: CVE-2023-24133
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey_5g parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey_5g_DoS
CVE: CVE-2023-24134
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey3_DoS
CVE: CVE-2023-22738
Published: 2023-03-01
Description: vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://github.com/vantage6/vantage6/commit/798aca1de142a4eca175ef51112e2235642f4f24; https://github.com/vantage6/vantage6/security/advisories/GHSA-vvjv-97j8-94xh; https://github.com/vantage6/vantage6/commit/798aca1de142a4eca175ef51112e2235642f4f24
CVE: CVE-2023-24117
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth_5g parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepauth_5g_DoS
CVE: CVE-2023-24118
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_security_DoS
CVE: CVE-2023-24119
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wrlEn_5g_DoS
CVE: CVE-2023-24120
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wrlEn_5g_DoS
CVE: CVE-2023-24121
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_security_5g_DoS
CVE: CVE-2023-24122
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid_5g parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_ssid_5g_DoS
CVE: CVE-2023-24123
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepauth_DoS
CVE: CVE-2023-24124
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wrlEn_DoS
CVE: CVE-2023-24125
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2_5g parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey2_5g_DoS
CVE: CVE-2023-24126
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey4_5g parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey4_5g_DoS
CVE: CVE-2023-24127
Published: 2023-03-01
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://eagle.com; http://jensen.com; https://oxnan.com/posts/WifiBasic_wepkey1_DoS