deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-51575
Published: 2024-05-03
Description: Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the MonitorConsole class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22011.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1881/; https://www.zerodayinitiative.com/advisories/ZDI-23-1881/
CVE: CVE-2023-51576
Published: 2024-05-03
Description: Voltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the RMI interface, which listens on TCP port 51099 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22012.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1882/; https://www.zerodayinitiative.com/advisories/ZDI-23-1882/
CVE: CVE-2023-51577
Published: 2024-05-03
Description: Voltronic Power ViewPower setShutdown Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the setShutdown method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22023.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1883/; https://www.zerodayinitiative.com/advisories/ZDI-23-1883/
CVE: CVE-2023-51578
Published: 2024-05-03
Description: Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the MonitorConsole class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-22024.
CVSS Score: 7.5 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1884/; https://www.zerodayinitiative.com/advisories/ZDI-23-1884/
CVE: CVE-2023-51579
Published: 2024-05-03
Description: Voltronic Power ViewPower Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from incorrect permissions set on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22025.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1885/; https://www.zerodayinitiative.com/advisories/ZDI-23-1885/
CVE: CVE-2023-51580
Published: 2024-05-03
Description: BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20852.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1903/; https://www.zerodayinitiative.com/advisories/ZDI-23-1903/
CVE: CVE-2023-51581
Published: 2024-05-03
Description: Voltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the MacMonitorConsole class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22034.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1886/; https://www.zerodayinitiative.com/advisories/ZDI-23-1886/
CVE: CVE-2023-51582
Published: 2024-05-03
Description: Voltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the LinuxMonitorConsole class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22035.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1887/; https://www.zerodayinitiative.com/advisories/ZDI-23-1887/
CVE: CVE-2023-51583
Published: 2024-05-03
Description: Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UpsScheduler class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22036.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1888/; https://www.zerodayinitiative.com/advisories/ZDI-23-1888/
CVE: CVE-2023-51584
Published: 2024-05-03
Description: Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.

The specific flaw exists within the shutdown method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22065.
CVSS Score: 8.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1889/; https://www.zerodayinitiative.com/advisories/ZDI-23-1889/
CVE: CVE-2023-51585
Published: 2024-05-03
Description: Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.

The specific flaw exists within the shutdown method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22071.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1890/; https://www.zerodayinitiative.com/advisories/ZDI-23-1890/
CVE: CVE-2023-51586
Published: 2024-05-03
Description: Voltronic Power ViewPower Pro selectEventConfig SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the selectEventConfig method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22072.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1891/; https://www.zerodayinitiative.com/advisories/ZDI-23-1891/
CVE: CVE-2023-51587
Published: 2024-05-03
Description: Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1892/; https://www.zerodayinitiative.com/advisories/ZDI-23-1892/
CVE: CVE-2023-51588
Published: 2024-05-03
Description: Voltronic Power ViewPower Pro MySQL Use of Hard-coded Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of a MySQL instance. The issue results from hardcoded database credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22075.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1893/; https://www.zerodayinitiative.com/advisories/ZDI-23-1893/
CVE: CVE-2023-51589
Published: 2024-05-03
Description: BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20853.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1904/; https://www.zerodayinitiative.com/advisories/ZDI-23-1904/
CVE: CVE-2023-51590
Published: 2024-05-03
Description: Voltronic Power ViewPower Pro UpLoadAction Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UpLoadAction class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22080.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1894/; https://www.zerodayinitiative.com/advisories/ZDI-23-1894/
CVE: CVE-2023-51591
Published: 2024-05-03
Description: Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the doDocument method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of LOCAL SERVICE. Was ZDI-CAN-22081.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1895/; https://www.zerodayinitiative.com/advisories/ZDI-23-1895/
CVE: CVE-2023-51592
Published: 2024-05-03
Description: BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20854.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1905/; https://www.zerodayinitiative.com/advisories/ZDI-23-1905/
CVE: CVE-2023-51593
Published: 2024-05-03
Description: Voltronic Power ViewPower Pro Expression Language Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Struts2 dependency. The issue results from the use of a library that is vulnerable to expression language injection. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22095.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1896/; https://www.zerodayinitiative.com/advisories/ZDI-23-1896/
CVE: CVE-2023-51594
Published: 2024-05-03
Description: BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20937.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1901/; https://www.zerodayinitiative.com/advisories/ZDI-23-1901/
CVE: CVE-2023-51595
Published: 2024-05-03
Description: Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the selectDeviceListBy method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22163.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1897/; https://www.zerodayinitiative.com/advisories/ZDI-23-1897/
CVE: CVE-2023-51596
Published: 2024-05-03
Description: BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20939.
CVSS Score: 7.1 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1902/; https://www.zerodayinitiative.com/advisories/ZDI-23-1902/
CVE: CVE-2023-51597
Published: 2024-05-03
Description: Kofax Power PDF U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21755.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1906/; https://www.zerodayinitiative.com/advisories/ZDI-23-1906/
CVE: CVE-2023-51598
Published: 2024-05-03
Description: Hancom Office Word DOC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hancom Office Word. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DOC files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20384.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1855/; https://www.zerodayinitiative.com/advisories/ZDI-23-1855/
CVE: CVE-2023-51599
Published: 2024-05-03
Description: Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
. Was ZDI-CAN-18412.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1848/; https://www.zerodayinitiative.com/advisories/ZDI-23-1848/
CVE: CVE-2023-51600
Published: 2024-05-03
Description: Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XML files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process.
. Was ZDI-CAN-18456.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1849/; https://www.zerodayinitiative.com/advisories/ZDI-23-1849/
CVE: CVE-2023-51601
Published: 2024-05-03
Description: Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of xml files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process.
. Was ZDI-CAN-18563.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1850/; https://www.zerodayinitiative.com/advisories/ZDI-23-1850/
CVE: CVE-2023-51602
Published: 2024-05-03
Description: Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XML files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process.
. Was ZDI-CAN-18591.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1851/; https://www.zerodayinitiative.com/advisories/ZDI-23-1851/