deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-44421
Published: 2024-05-03
Description: D-Link DIR-X3260 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21101.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1519/; https://www.zerodayinitiative.com/advisories/ZDI-23-1519/
CVE: CVE-2023-44422
Published: 2024-05-03
Description: D-Link DIR-X3260 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21102.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1520/; https://www.zerodayinitiative.com/advisories/ZDI-23-1520/
CVE: CVE-2023-44423
Published: 2024-05-03
Description: D-Link DIR-X3260 SetTriggerPPPoEValidate Password Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21157.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1521/; https://www.zerodayinitiative.com/advisories/ZDI-23-1521/
CVE: CVE-2023-44424
Published: 2024-05-03
Description: D-Link DIR-X3260 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21158.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1522/; https://www.zerodayinitiative.com/advisories/ZDI-23-1522/
CVE: CVE-2023-44425
Published: 2024-05-03
Description: D-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21159.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1523/; https://www.zerodayinitiative.com/advisories/ZDI-23-1523/
CVE: CVE-2023-44426
Published: 2024-05-03
Description: D-Link DIR-X3260 SetSysEmailSettings AccountPassword Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21160.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1524/; https://www.zerodayinitiative.com/advisories/ZDI-23-1524/
CVE: CVE-2023-44427
Published: 2024-05-03
Description: D-Link DIR-X3260 SetSysEmailSettings SMTPServerAddress Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21222.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1525/; https://www.zerodayinitiative.com/advisories/ZDI-23-1525/
CVE: CVE-2023-44428
Published: 2024-05-03
Description: MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CAP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20769.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1526/; https://www.zerodayinitiative.com/advisories/ZDI-23-1526/
CVE: CVE-2023-44429
Published: 2024-05-03
Description: GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22226.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://gstreamer.freedesktop.org/security/sa-2023-0009.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1648/; https://gstreamer.freedesktop.org/security/sa-2023-0009.html
CVE: CVE-2023-44430
Published: 2024-05-03
Description: Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19067.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/advisories/be-2022-0019/; https://www.zerodayinitiative.com/advisories/ZDI-24-019/; https://www.bentley.com/advisories/be-2022-0019/
CVE: CVE-2023-44431
Published: 2024-05-03
Description: BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1900/; https://www.zerodayinitiative.com/advisories/ZDI-23-1900/
CVE: CVE-2023-44432
Published: 2024-05-03
Description: Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21584.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1606/; https://www.zerodayinitiative.com/advisories/ZDI-23-1606/
CVE: CVE-2023-44433
Published: 2024-05-03
Description: Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
. Was ZDI-CAN-21977.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1610/; https://www.zerodayinitiative.com/advisories/ZDI-23-1610/
CVE: CVE-2023-44434
Published: 2024-05-03
Description: Kofax Power PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21979.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1609/; https://www.zerodayinitiative.com/advisories/ZDI-23-1609/
CVE: CVE-2023-44435
Published: 2024-05-03
Description: Kofax Power PDF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22040.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1607/; https://www.zerodayinitiative.com/advisories/ZDI-23-1607/
CVE: CVE-2023-44436
Published: 2024-05-03
Description: Kofax Power PDF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22045.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1608/; https://www.zerodayinitiative.com/advisories/ZDI-23-1608/
CVE: CVE-2023-44437
Published: 2024-05-03
Description: Ashlar-Vellum Cobalt Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of various file types. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21540.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1595/; https://www.zerodayinitiative.com/advisories/ZDI-23-1595/
CVE: CVE-2023-44438
Published: 2024-05-03
Description: Ashlar-Vellum Argon Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Argon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of various file types. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21678.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1596/; https://www.zerodayinitiative.com/advisories/ZDI-23-1596/
CVE: CVE-2023-44439
Published: 2024-05-03
Description: Ashlar-Vellum Xenon Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Xenon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of various file types. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21679.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1597/; https://www.zerodayinitiative.com/advisories/ZDI-23-1597/
CVE: CVE-2023-44440
Published: 2024-05-03
Description: Ashlar-Vellum Lithium Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Lithium. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of various file types. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21680.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1598/; https://www.zerodayinitiative.com/advisories/ZDI-23-1598/
CVE: CVE-2023-44441
Published: 2024-05-03
Description: GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-22093.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/; https://www.zerodayinitiative.com/advisories/ZDI-23-1592/; https://lists.debian.org/debian-lts-announce/2023/11/msg00031.html
CVE: CVE-2023-44442
Published: 2024-05-03
Description: GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/; https://www.zerodayinitiative.com/advisories/ZDI-23-1594/; https://lists.debian.org/debian-lts-announce/2023/11/msg00015.html
CVE: CVE-2023-44443
Published: 2024-05-03
Description: GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-22096.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/; https://www.zerodayinitiative.com/advisories/ZDI-23-1593/; https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/
CVE: CVE-2023-44444
Published: 2024-05-03
Description: GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-22097.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193
References: https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/; https://www.zerodayinitiative.com/advisories/ZDI-23-1591/; https://lists.debian.org/debian-lts-announce/2023/11/msg00015.html
CVE: CVE-2023-44445
Published: 2024-05-03
Description: NETGEAR CAX30 SSO Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR CAX30 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the sso binary. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19058.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://kb.netgear.com/000065859/Security-Advisory-for-Pre-authentication-Buffer-Overflow-on-the-CAX30-PSV-2023-0093; https://www.zerodayinitiative.com/advisories/ZDI-23-1636/; https://kb.netgear.com/000065859/Security-Advisory-for-Pre-authentication-Buffer-Overflow-on-the-CAX30-PSV-2023-0093
CVE: CVE-2023-44446
Published: 2024-05-03
Description: GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of MXF video files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22299.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://gstreamer.freedesktop.org/security/sa-2023-0010.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1647/; https://gstreamer.freedesktop.org/security/sa-2023-0010.html
CVE: CVE-2023-44447
Published: 2024-05-03
Description: TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-21529.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1623/; https://www.zerodayinitiative.com/advisories/ZDI-23-1623/