deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-26968
Published: 2023-03-29
Description: In Atrocore 1.5.25, the Create Import Feed option with glyphicon-glyphicon-paperclip function is vulnerable to Unauthenticated File upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/atrocore/atrocore-1.5.25; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/atrocore/atrocore-1.5.25
CVE: CVE-2023-27167
Published: 2023-03-29
Description: Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://suprema.com; https://biostar2.ciklum.net/api/users/absence?search_month=1; https://packetstormsecurity.com/files/171523/Suprema-BioStar-2-2.8.16-SQL-Injection.html
CVE: CVE-2023-26984
Published: 2023-03-29
Description: An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/Peppermint-Lab/peppermint/tree/master; https://github.com/bypazs/CVE-2023-26984; https://peppermint.sh/
CVE: CVE-2022-27641
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15806.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://kb.netgear.com/000064437/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0278; https://www.zerodayinitiative.com/advisories/ZDI-22-544/; https://kb.netgear.com/000064437/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0278
CVE: CVE-2022-27642
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-15854.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327; https://www.zerodayinitiative.com/advisories/ZDI-22-518/; https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327
CVE: CVE-2022-27643
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the SOAPAction header, the process does not properly validate the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15692.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000064720/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0323; https://www.zerodayinitiative.com/advisories/ZDI-22-519/; https://kb.netgear.com/000064720/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0323
CVE: CVE-2022-27644
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15797.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://kb.netgear.com/000064721/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0324; https://www.zerodayinitiative.com/advisories/ZDI-22-520/; https://kb.netgear.com/000064721/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0324
CVE: CVE-2022-27645
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within readycloud_control.cgi. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15762.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-697
References: https://kb.netgear.com/000064722/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-and-Fixed-Wireless-Products-PSV-2021-0325; https://www.zerodayinitiative.com/advisories/ZDI-22-522/; https://kb.netgear.com/000064722/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-and-Fixed-Wireless-Products-PSV-2021-0325
CVE: CVE-2022-27646
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the circled daemon. A crafted circleinfo.txt file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15879.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://kb.netgear.com/000064721/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0324; https://www.zerodayinitiative.com/advisories/ZDI-22-523/; https://kb.netgear.com/000064721/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0324
CVE: CVE-2022-27647
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the name or email field provided to libreadycloud.so. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15874.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327; https://www.zerodayinitiative.com/advisories/ZDI-22-524/; https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327
CVE: CVE-2022-27648
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of KOYO Screen Creator 0.1.1.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SCA2 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14868.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.koyoele.co.jp/en/topics/[PII_REDACTED]94/; https://www.zerodayinitiative.com/advisories/ZDI-22-543/; https://www.koyoele.co.jp/en/topics/[PII_REDACTED]94/
CVE: CVE-2022-28300
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation 10.16.02.034 CONNECT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16202.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0007; https://www.zerodayinitiative.com/advisories/ZDI-22-592/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0007
CVE: CVE-2022-28301
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16392.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-612/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE: CVE-2022-28302
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a read past the end of an allocated buffer. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-16446.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-614/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE: CVE-2022-28303
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16280.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-596/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0009
CVE: CVE-2022-28304
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16171.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0008; https://www.zerodayinitiative.com/advisories/ZDI-22-594/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0008
CVE: CVE-2022-28305
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16172.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0008; https://www.zerodayinitiative.com/advisories/ZDI-22-593/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0008
CVE: CVE-2022-28306
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-16174.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0008; https://www.zerodayinitiative.com/advisories/ZDI-22-595/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0008
CVE: CVE-2022-28307
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. Crafted data in a DXF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16306.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-598/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0005
CVE: CVE-2022-28308
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16307.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003; https://www.zerodayinitiative.com/advisories/ZDI-22-599/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003
CVE: CVE-2022-28309
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16308.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003; https://www.zerodayinitiative.com/advisories/ZDI-22-600/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003
CVE: CVE-2022-28310
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16339.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-590/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0009
CVE: CVE-2022-28311
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. Crafted data in a DXF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16341.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-601/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0005
CVE: CVE-2022-28312
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16342.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003; https://www.zerodayinitiative.com/advisories/ZDI-22-602/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003
CVE: CVE-2022-28313
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16343.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003; https://www.zerodayinitiative.com/advisories/ZDI-22-603/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003
CVE: CVE-2022-28314
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16332.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-605/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE: CVE-2022-28315
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16367.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-606/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE: CVE-2022-28316
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16368.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-607/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE: CVE-2022-28317
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16369.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-604/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006