deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-46892
Published: 2024-01-23
Description: The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions (e.g., thermostat's temperature).
CVSS Score: 8.8 (HIGH)
CWE: CWE-294, CWE-294
References: https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219; https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219
CVE: CVE-2023-47192
Published: 2024-01-23
Description: An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1611/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47193
Published: 2024-01-23
Description: An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2023-47194.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1612/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47194
Published: 2024-01-23
Description: An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2023-47195.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1614/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47195
Published: 2024-01-23
Description: An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2023-47196.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1615/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47196
Published: 2024-01-23
Description: An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2023-47197.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1617/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47197
Published: 2024-01-23
Description: An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2023-47198.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1616/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47198
Published: 2024-01-23
Description: An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2023-47199.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1619/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47199
Published: 2024-01-23
Description: An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2023-47193.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1620/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47200
Published: 2024-01-23
Description: A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2023-47201.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1618/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47201
Published: 2024-01-23
Description: A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This vulnerability is similar to, but not identical to, CVE-2023-47200.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1613/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-47202
Published: 2024-01-23
Description: A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-552
References: https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-1621/; https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
CVE: CVE-2023-51200
Published: 2024-01-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-52090
Published: 2024-01-23
Description: A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-026/; https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US
CVE: CVE-2023-52091
Published: 2024-01-23
Description: An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-027/; https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US
CVE: CVE-2023-52092
Published: 2024-01-23
Description: A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-025/; https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US
CVE: CVE-2023-52093
Published: 2024-01-23
Description: An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-029/; https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US
CVE: CVE-2023-52094
Published: 2024-01-23
Description: An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbitrary folder, leading for a local privilege escalation on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-028/; https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US
CVE: CVE-2023-52324
Published: 2024-01-23
Description: An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations.

Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials. Also, this vulnerability could be potentially used in combination with another vulnerability to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-077/; https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US
CVE: CVE-2023-52325
Published: 2024-01-23
Description: A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations.

Please note: this vulnerability must be used in conjunction with another one to exploit an affected system. In addition, an attacker must first obtain a valid set of credentials on target system in order to exploit this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-024/; https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US
CVE: CVE-2023-52326
Published: 2024-01-23
Description: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

Please note this vulnerability is similar, but not identical to CVE-2023-52327.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-023/; https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US
CVE: CVE-2023-52327
Published: 2024-01-23
Description: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

Please note this vulnerability is similar, but not identical to CVE-2023-52328.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-022/; https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US
CVE: CVE-2023-52328
Published: 2024-01-23
Description: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

Please note this vulnerability is similar, but not identical to CVE-2023-52329.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-021/; https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US
CVE: CVE-2023-52329
Published: 2024-01-23
Description: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

Please note this vulnerability is similar, but not identical to CVE-2023-52326.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-074/; https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US
CVE: CVE-2023-52330
Published: 2024-01-23
Description: A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central.

Please note: user interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-051/; https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US
CVE: CVE-2023-52331
Published: 2024-01-23
Description: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local services directly.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-918, CWE-918
References: https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-052/; https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US
CVE: CVE-2023-52337
Published: 2024-01-23
Description: An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/dcx/s/solution/000296337?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-075/; https://success.trendmicro.com/dcx/s/solution/000296337?language=en_US
CVE: CVE-2023-52338
Published: 2024-01-23
Description: A link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://success.trendmicro.com/dcx/s/solution/000296337?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-24-076/; https://success.trendmicro.com/dcx/s/solution/000296337?language=en_US
CVE: CVE-2021-42142
Published: 2024-01-23
Description: An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability allows remote attackers to cause a denial of service and false-positive packet drops.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755, CWE-770
References: https://github.com/contiki-ng/tinydtls/issues/24; https://seclists.org/fulldisclosure/2024/Jan/15; http://seclists.org/fulldisclosure/2024/Jan/15
CVE: CVE-2023-31654
Published: 2024-01-23
Description: Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation via the component hiredisAllocFns at /opt/fs/redisraft/deps/hiredis/alloc.c.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/RedisLabs/redisraft/issues/600; https://seclists.org/fulldisclosure/2024/Jan/13; https://github.com/RedisLabs/redisraft/issues/600
CVE: CVE-2023-36177
Published: 2024-01-23
Description: An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://snapcast.com; https://oxnan.com/posts/Snapcast_jsonrpc_rce; http://snapcast.com
CVE: CVE-2023-51199
Published: 2024-01-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-51201
Published: 2024-01-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-51208
Published: 2024-01-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-7237
Published: 2024-01-23
Description: 
Lantronix XPort sends weakly encoded credentials within web request headers.


CVSS Score: 5.7 (MEDIUM)
CWE: CWE-261, CWE-326
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-05; https://www.lantronix.com/products/xport-edge/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-05
CVE: CVE-2023-35835
Published: 2024-01-23
Description: An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. The device provides a WiFi access point for initial configuration. The WiFi network provided has no network authentication (such as an encryption key) and persists permanently, including after enrollment and setup is complete. The WiFi network serves a web-based configuration utility, as well as an unauthenticated ModBus protocol interface.
CVSS Score: 9.8 (CRITICAL)
References: https://www.solaxpower.com/downloads/; https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/; https://yougottahackthat.com/blog/
CVE: CVE-2023-35836
Published: 2024-01-23
Description: An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the Wi-Fi PSK, during device setup and reconfiguration. Upon success, the attacker is able to further infiltrate the target's Wi-Fi networks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://www.solaxpower.com/downloads/; https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/; https://yougottahackthat.com/blog/
CVE: CVE-2023-35837
Published: 2024-01-23
Description: An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. Authentication for web interface is completed via an unauthenticated WiFi AP. The administrative password for the web interface has a default password, equal to the registration ID of the device. This same registration ID is used as the WiFi SSID name. No routine is in place to force a change to this password on first use or bring its default state to the attention of the user. Once authenticated, an attacker can reconfigure the device or upload new firmware, both of which can lead to Denial of Service, code execution, or Escalation of Privileges.
CVSS Score: 9.8 (CRITICAL)
References: https://www.solaxpower.com/downloads/; https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/; https://yougottahackthat.com/blog/