deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-44448
Published: 2024-05-03
Description: TP-Link Archer A54 libcmm.so dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A54 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the file libcmm.so. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22262.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1625/; https://www.zerodayinitiative.com/advisories/ZDI-23-1625/
CVE: CVE-2023-44449
Published: 2024-05-03
Description: NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability.

The specific flaw exists within the clearAlertByIds function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-21875.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://kb.netgear.com/000065866/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2023-0114-PSV-2023-0115; https://www.zerodayinitiative.com/advisories/ZDI-23-1717/; https://kb.netgear.com/000065866/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2023-0114-PSV-2023-0115
CVE: CVE-2023-44450
Published: 2024-05-03
Description: NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability.

The specific flaw exists within the getNodesByTopologyMapSearch function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21858.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://kb.netgear.com/000065866/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2023-0114-PSV-2023-0115; https://www.zerodayinitiative.com/advisories/ZDI-23-1718/; https://kb.netgear.com/000065866/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2023-0114-PSV-2023-0115
CVE: CVE-2023-44451
Published: 2024-05-03
Description: Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://github.com/linuxmint/xreader/commit/141f1313745b9cc73670df51ac145165efcbb14a; https://www.zerodayinitiative.com/advisories/ZDI-23-1835/; https://github.com/linuxmint/xreader/commit/141f1313745b9cc73670df51ac145165efcbb14a
CVE: CVE-2023-44452
Published: 2024-05-03
Description: Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CBT files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22132.
CVSS Score: 7.8 (HIGH)
CWE: CWE-88
References: https://github.com/linuxmint/xreader/commit/cd678889ecfe4e84a5cbcf3a0489e15a5e2e3736; https://www.zerodayinitiative.com/advisories/ZDI-23-1836/; https://github.com/linuxmint/xreader/commit/cd678889ecfe4e84a5cbcf3a0489e15a5e2e3736
CVE: CVE-2023-47220
Published: 2024-05-03
Description: An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following version:
Media Streaming add-on  500.1.1.5 ( 2024/01/22 ) and later

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-15; https://www.qnap.com/en/security-advisory/qsa-24-15
CVE: CVE-2023-50186
Published: 2024-05-03
Description: GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of metadata within AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22300.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://gstreamer.freedesktop.org/security/sa-2023-0011.html; https://www.zerodayinitiative.com/advisories/ZDI-24-368/; https://gstreamer.freedesktop.org/security/sa-2023-0011.html
CVE: CVE-2023-50187
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20789.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1837/; https://www.zerodayinitiative.com/advisories/ZDI-23-1837/
CVE: CVE-2023-50188
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20792.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1838/; https://www.zerodayinitiative.com/advisories/ZDI-23-1838/
CVE: CVE-2023-50189
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. 

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21783.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1839/; https://www.zerodayinitiative.com/advisories/ZDI-23-1839/
CVE: CVE-2023-50190
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21784.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1840/; https://www.zerodayinitiative.com/advisories/ZDI-23-1840/
CVE: CVE-2023-50191
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21785.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1841/; https://www.zerodayinitiative.com/advisories/ZDI-23-1841/
CVE: CVE-2023-50192
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21786.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1842/; https://www.zerodayinitiative.com/advisories/ZDI-23-1842/
CVE: CVE-2023-50193
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21787.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1843/; https://www.zerodayinitiative.com/advisories/ZDI-23-1843/
CVE: CVE-2023-50194
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. 

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21788.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1844/; https://www.zerodayinitiative.com/advisories/ZDI-23-1844/
CVE: CVE-2023-50195
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files.
The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21799.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1845/; https://www.zerodayinitiative.com/advisories/ZDI-23-1845/
CVE: CVE-2023-50196
Published: 2024-05-03
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21800.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1846/; https://www.zerodayinitiative.com/advisories/ZDI-23-1846/
CVE: CVE-2023-50197
Published: 2024-05-03
Description: Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to write a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21845.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1773/; https://www.zerodayinitiative.com/advisories/ZDI-23-1773/
CVE: CVE-2023-50198
Published: 2024-05-03
Description: D-Link G416 cfgsave Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21286.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1814/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50199
Published: 2024-05-03
Description: D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to gain access to critical functions on the device. Was ZDI-CAN-21287.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1815/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50200
Published: 2024-05-03
Description: D-Link G416 cfgsave backusb Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21288.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1816/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50201
Published: 2024-05-03
Description: D-Link G416 cfgsave upusb Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21289.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1817/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50202
Published: 2024-05-03
Description: D-Link G416 flupl pythonmodules Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21295.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1818/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50203
Published: 2024-05-03
Description: D-Link G416 nodered chmod Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21296.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1819/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50204
Published: 2024-05-03
Description: D-Link G416 flupl pythonapp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21297.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1820/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50205
Published: 2024-05-03
Description: D-Link G416 awsfile chmod Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21298.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1821/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50206
Published: 2024-05-03
Description: D-Link G416 flupl query_type edit Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21299.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1822/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367