deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-23119
Published: 2023-02-02
Description: The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://community.ui.com/tags/security/releases; https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/SkYce4f5o; https://community.ui.com/tags/security/releases
CVE: CVE-2023-23120
Published: 2023-02-02
Description: The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.07.01 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/HJl1oFzci; https://www.trendnet.com/support/; https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/HJl1oFzci
CVE: CVE-2022-36401
Published: 2023-02-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-wallet/wordpress-terawallet-for-woocommerce-plugin-1-3-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-wallet/wordpress-terawallet-for-woocommerce-plugin-1-3-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-3560
Published: 2023-02-02
Description: A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=2135420#c0; https://bugzilla.redhat.com/show_bug.cgi?id=2135420#c0
CVE: CVE-2022-40692
Published: 2023-02-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/sunshine-photo-cart/wordpress-sunshine-photo-cart-plugin-2-9-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sunshine-photo-cart/wordpress-sunshine-photo-cart-plugin-2-9-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-44585
Published: 2023-02-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/homepage-pop-up/wordpress-homepage-popup-plugin-1-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/homepage-pop-up/wordpress-homepage-popup-plugin-1-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-45067
Published: 2023-02-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in DevsCred Exclusive Addons Elementor plugin <= 2.6.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/exclusive-addons-for-elementor/wordpress-exclusive-addons-for-elementor-plugin-2-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/exclusive-addons-for-elementor/wordpress-exclusive-addons-for-elementor-plugin-2-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-45807
Published: 2023-02-02
Description: Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-mail-log/wordpress-wp-mail-log-plugin-1-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-mail-log/wordpress-wp-mail-log-plugin-1-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-46815
Published: 2023-02-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/conditional-shipping-for-woocommerce/wordpress-conditional-shipping-for-woocommerce-plugin-2-3-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/conditional-shipping-for-woocommerce/wordpress-conditional-shipping-for-woocommerce-plugin-2-3-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-46842
Published: 2023-02-02
Description: Cross-Site Request Forgery (CSRF) vulnerability in JS Help Desk plugin <= 2.7.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-plugin-2-7-1-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve; https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-plugin-2-7-1-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve
CVE: CVE-2022-48079
Published: 2023-02-02
Description: Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://mf.mengnai.top/; https://thanatosxingyu.github.io/; http://mf.mengnai.top/
CVE: CVE-2022-48082
Published: 2023-02-02
Description: Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/purplededa/EasyoneCRM-5.50.02-SQLinjection; https://github.com/purplededa/EasyoneCRM-5.50.02-SQLinjection
CVE: CVE-2022-48130
Published: 2023-02-02
Description: Tenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNet, staticRouteMask, staticRouteGateway, staticRouteWAN.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Stevenbaga/fengsha/blob/main/W20E/formSetStaticRoute.md; https://github.com/Stevenbaga/fengsha/blob/main/W20E/formSetStaticRoute.md
CVE: CVE-2022-48140
Published: 2023-02-02
Description: DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ChandlerChin/dedecms/blob/main/xss.docx; https://github.com/ChandlerChin/dedecms/blob/main/xss.docx
CVE: CVE-2023-0253
Published: 2023-02-02
Description: Rejected reason: **REJECT** Accidental CVE Assignment. Please use CVE-2023-0285.
CVE: CVE-2023-0576
Published: 2023-02-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-24574
Published: 2023-02-02
Description: 
Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication component. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to uncontrolled resource consumption by creating permanent home directories for unauthenticated users.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://www.dell.com/support/kbdoc/en-us/000208165/dsa-2023-039-dell-emc-enterprise-sonic-security-update-for-an-uncontrolled-resource-consumption-vulnerability; https://www.dell.com/support/kbdoc/en-us/000208165/dsa-2023-039-dell-emc-enterprise-sonic-security-update-for-an-uncontrolled-resource-consumption-vulnerability
CVE: CVE-2022-48113
Published: 2023-02-02
Description: A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://wefir.blogspot.com/2022/12/totolink-n200rev5-telnet-backdoor.html; https://wefir.blogspot.com/2022/12/totolink-n200rev5-telnet-backdoor.html
CVE: CVE-2022-48114
Published: 2023-02-02
Description: RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gitee.com/y_project/RuoYi/issues/I65V2B; https://gitee.com/y_project/RuoYi/issues/I65V2B
CVE: CVE-2023-0634
Published: 2023-02-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-22486
Published: 2023-02-03
Description: IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  226328.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/226328; https://www.ibm.com/support/pages/node/6890697; https://exchange.xforce.ibmcloud.com/vulnerabilities/226328
CVE: CVE-2022-38389
Published: 2023-02-03
Description: IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  233975.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233975; https://www.ibm.com/support/pages/node/6890695; https://exchange.xforce.ibmcloud.com/vulnerabilities/233975
CVE: CVE-2023-0658
Published: 2023-02-03
Description: A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220053 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://vuldb.com/?ctiid.220053; https://vuldb.com/?id.220053; https://vuldb.com/?ctiid.220053
CVE: CVE-2022-47130
Published: 2023-02-03
Description: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privileges interacts on the CSRF page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://portswigger.net/web-security/csrf; https://www.linkedin.com/in/xvinicius/; https://xpsec.co/blog/academy-lms-5-10-coupon-csrf
CVE: CVE-2022-47131
Published: 2023-02-03
Description: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-352
References: https://blog.hackingforce.com.br/en/xss; https://portswigger.net/web-security/csrf; https://portswigger.net/web-security/csrf/xss-vs-csrf
CVE: CVE-2022-47132
Published: 2023-02-03
Description: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://portswigger.net/web-security/csrf; https://www.linkedin.com/in/xvinicius/; https://xpsec.co/blog/academy-lms-5-10-add-admin-csrf
CVE: CVE-2022-48021
Published: 2023-02-03
Description: A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.
CVSS Score: 9.8 (CRITICAL)
References: https://zammad.com/de/advisories/zaa-2022-11; https://zammad.com/de/advisories/zaa-2022-11
CVE: CVE-2022-48022
Published: 2023-02-03
Description: An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see.
CVSS Score: 4.3 (MEDIUM)
References: https://zammad.com/de/advisories/zaa-2022-13; https://zammad.com/de/advisories/zaa-2022-13
CVE: CVE-2022-48023
Published: 2023-02-03
Description: Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. This is now corrected in v5.3.1 so that only agents with write permissions may change ticket tags.
CVSS Score: 4.3 (MEDIUM)
References: https://zammad.com/de/advisories/zaa-2022-12; https://zammad.com/de/advisories/zaa-2022-12
CVE: CVE-2023-23635
Published: 2023-02-03
Description: In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jellyfin/jellyfin-web/issues/3788; https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2022-0031/
CVE: CVE-2023-23636
Published: 2023-02-03
Description: In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jellyfin/jellyfin-web/issues/3788; https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2022-0030/
CVE: CVE-2023-24613
Published: 2023-02-03
Description: The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite the backend function call stack after accessing the system with administrator privileges. A successful exploit could leverage this vulnerability in the backend binary file that handles the user interface to a cause denial of service attack. This is fixed in AG 9.4.0.481.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_UI_Stack_Overflow_Vulnerability_ID-128285_V1.0.pdf; https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_UI_Stack_Overflow_Vulnerability_ID-128285_V1.0.pdf
CVE: CVE-2022-4634
Published: 2023-02-03
Description: All versions prior to Delta Electronic’s CNCSoft version 1.01.34 (running ScreenEditor versions 1.01.5 and prior) are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code.


CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-01
CVE: CVE-2023-0123
Published: 2023-02-03
Description: Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.


CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-031-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-031-01
CVE: CVE-2023-0124
Published: 2023-02-03
Description: Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.


CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-031-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-031-01
CVE: CVE-2023-25135
Published: 2023-02-03
Description: vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch; https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable; https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch
CVE: CVE-2022-48074
Published: 2023-02-03
Description: An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file.
CVSS Score: 5.3 (MEDIUM)
References: https://kb.nomachine.com/SU11T00239; https://kb.nomachine.com/SU11T00239
CVE: CVE-2023-25136
Published: 2023-02-03
Description: OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: http://www.openwall.com/lists/oss-security/2023/02/13/1; http://www.openwall.com/lists/oss-security/2023/02/22/1; http://www.openwall.com/lists/oss-security/2023/02/22/2
CVE: CVE-2023-25139
Published: 2023-02-03
Description: sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: http://www.openwall.com/lists/oss-security/2023/02/10/1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://sourceware.org/bugzilla/show_bug.cgi?id=30068
CVE: CVE-2022-34138
Published: 2023-02-03
Description: Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://docs.biltema.com/v2/documents/file/nb/6a9ff001-a0e0-48c4-a802-83e8b5a5e213; https://kth.diva-portal.org/smash/get/diva2:1729289/FULLTEXT01.pdf; https://docs.biltema.com/v2/documents/file/nb/6a9ff001-a0e0-48c4-a802-83e8b5a5e213
CVE: CVE-2023-24138
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/NTPSyncWithHost/NTPSyncWithHost.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/NTPSyncWithHost/NTPSyncWithHost.md
CVE: CVE-2023-24139
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagHost/setNetworkDiag_NetDiagHost.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagHost/setNetworkDiag_NetDiagHost.md
CVE: CVE-2023-24140
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagPingNum/setNetworkDiag_NetDiagPingNum.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagPingNum/setNetworkDiag_NetDiagPingNum.md
CVE: CVE-2023-24141
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagPingTimeOut/setNetworkDiag_NetDiagPingTimeOut.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagPingTimeOut/setNetworkDiag_NetDiagPingTimeOut.md
CVE: CVE-2023-24142
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagPingSize/setNetworkDiag_NetDiagPingSize.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagPingSize/setNetworkDiag_NetDiagPingSize.md
CVE: CVE-2023-24143
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagTracertHop/setNetworkDiag_NetDiagTracertHop.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setNetworkDiag_NetDiagTracertHop/setNetworkDiag_NetDiagTracertHop.md
CVE: CVE-2023-24144
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setRebootScheCfg_hour/setRebootScheCfg_hour.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setRebootScheCfg_hour/setRebootScheCfg_hour.md
CVE: CVE-2023-24145
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setUnloadUserData/setUnloadUserData.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setUnloadUserData/setUnloadUserData.md
CVE: CVE-2023-24146
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setRebootScheCfg_minute/setRebootScheCfg_minute.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setRebootScheCfg_minute/setRebootScheCfg_minute.md