deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-42451
Published: 2023-10-11
Description: Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.

CVSS Score: 4.6 (MEDIUM)
CWE: CWE-522
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108007; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108007
CVE: CVE-2022-44757
Published: 2023-10-11
Description: BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure.  An attacker could gain access to sensitive information, modify data in unexpected ways, etc.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108005; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108005
CVE: CVE-2022-44758
Published: 2023-10-11
Description: BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content.  An attacker can gain access to information that is not explicitly authorized.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108005; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108005
CVE: CVE-2023-26318
Published: 2023-10-11
Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://trust.mi.com/misrc/bulletins/advisory?cveId=539; https://trust.mi.com/misrc/bulletins/advisory?cveId=539
CVE: CVE-2023-26319
Published: 2023-10-11
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-77
References: https://trust.mi.com/misrc/bulletins/advisory?cveId=536; https://trust.mi.com/misrc/bulletins/advisory?cveId=536
CVE: CVE-2023-26320
Published: 2023-10-11
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-77
References: https://trust.mi.com/misrc/bulletins/advisory?cveId=540; https://trust.mi.com/misrc/bulletins/advisory?cveId=540
CVE: CVE-2023-37536
Published: 2023-10-11
Description: An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
CVSS Score: 8.2 (HIGH)
CWE: CWE-190, CWE-680
References: https://lists.debian.org/debian-lts-announce/2023/12/msg00027.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/
CVE: CVE-2023-44997
Published: 2023-10-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha plugin <= 4.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-forms-puzzle-captcha/wordpress-wp-forms-puzzle-captcha-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-forms-puzzle-captcha/wordpress-wp-forms-puzzle-captcha-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-4990
Published: 2023-10-11
Description: Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files.
CVSS Score: 8.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.mcl-mobilityplatform.com/downloads.php; https://www.mcl-mobilityplatform.com/downloads.php
CVE: CVE-2023-42138
Published: 2023-10-11
Description: Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER Ver. 2.62 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user of KV STUDIO PLAYER open a specially crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU94752076/index.html; https://www.keyence.com/vulnerability231001; https://jvn.jp/en/vu/JVNVU94752076/index.html
CVE: CVE-2023-44093
Published: 2023-10-11
Description: Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44094
Published: 2023-10-11
Description: Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44096
Published: 2023-10-11
Description:  Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-307
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44109
Published: 2023-10-11
Description: Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-26370
Published: 2023-10-11
Description: Adobe Photoshop versions 23.5.5 (and earlier) and 24.7 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/photoshop/apsb23-51.html; https://helpx.adobe.com/security/products/photoshop/apsb23-51.html
CVE: CVE-2023-38216
Published: 2023-10-11
Description: Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/bridge/apsb23-49.html; https://helpx.adobe.com/security/products/bridge/apsb23-49.html
CVE: CVE-2023-38217
Published: 2023-10-11
Description: Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/bridge/apsb23-49.html; https://helpx.adobe.com/security/products/bridge/apsb23-49.html
CVE: CVE-2023-41304
Published: 2023-10-11
Description: Parameter verification vulnerability in the window module.Successful exploitation of this vulnerability may cause the size of an app window to be adjusted to that of a floating window.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44095
Published: 2023-10-11
Description: Use-After-Free (UAF) vulnerability in the surfaceflinger module.Successful exploitation of this vulnerability can cause system crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44097
Published: 2023-10-11
Description: Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44100
Published: 2023-10-11
Description: Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-669
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44101
Published: 2023-10-11
Description: The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]
CVE: CVE-2023-44102
Published: 2023-10-11
Description: Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability can cause the Bluetooth function to be unavailable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44103
Published: 2023-10-11
Description: Out-of-bounds read vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44104
Published: 2023-10-11
Description: Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-669
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44106
Published: 2023-10-11
Description: API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44110
Published: 2023-10-11
Description: Out-of-bounds access vulnerability in the audio module.Successful exploitation of this vulnerability may affect availability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]
CVE: CVE-2023-44111
Published: 2023-10-11
Description: Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44981
Published: 2023-10-11
Description: Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.

Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.

Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.

See the documentation for more details on correct cluster administration.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: http://www.openwall.com/lists/oss-security/2023/10/11/4; https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b; https://lists.debian.org/debian-lts-announce/2023/10/msg00029.html
CVE: CVE-2023-5520
Published: 2023-10-11
Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
CVSS Score: 7.7 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/gpac/gpac/commit/5692dc729491805e0e5f55c21d50ba1e6b19e88e; https://huntr.dev/bounties/681e42d0-18d4-4ebc-aba0-c5b0f77ac74a; https://github.com/gpac/gpac/commit/5692dc729491805e0e5f55c21d50ba1e6b19e88e
CVE: CVE-2023-5521
Published: 2023-10-11
Description: Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda; https://huntr.dev/bounties/d438eff7-4e24-45e0-bc75-d3a5b3ab2ea1; https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda
CVE: CVE-2023-37538
Published: 2023-10-11
Description: HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).

CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108006; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108006
CVE: CVE-2023-44105
Published: 2023-10-11
Description: Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44107
Published: 2023-10-11
Description:  Vulnerability of defects introduced in the design process in the screen projection module.Successful exploitation of this vulnerability may affect service availability and integrity.
CVSS Score: 9.1 (CRITICAL)
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]
CVE: CVE-2023-44108
Published: 2023-10-11
Description: Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843, CWE-843
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44114
Published: 2023-10-11
Description: Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44116
Published: 2023-10-11
Description: Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to run without being authorized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44118
Published: 2023-10-11
Description: Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confidentiality.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-44119
Published: 2023-10-11
Description: Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667, CWE-667
References: https://consumer.huawei.com/en/support/bulletin/2023/10/; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/10/
CVE: CVE-2023-45396
Published: 2023-10-11
Description: An Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/strik3r0x1/Vulns/blob/main/%28IDOR%29%20leads%20to%20events%20profiles%20access%20-%20Elenos.md; https://github.com/strik3r0x1/Vulns/blob/main/%28IDOR%29%20leads%20to%20events%20profiles%20access%20-%20Elenos.md
CVE: CVE-2023-4957
Published: 2023-10-11
Description: A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the setvarsResults.cgi file. For this vulnerability to be exploitable, the printers protected mode must be disabled.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-288
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/authentication-bypass-zebra-ztc; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/authentication-bypass-zebra-ztc
CVE: CVE-2023-24479
Published: 2023-10-11
Description: An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1762; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1762; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1762
CVE: CVE-2023-27380
Published: 2023-10-11
Description: An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1780; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1780; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1780
CVE: CVE-2023-28381
Published: 2023-10-11
Description: An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1779; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1779; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1779
CVE: CVE-2023-31272
Published: 2023-10-11
Description: A stack-based buffer overflow vulnerability exists in the httpd do_wds functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1765; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1765; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1765
CVE: CVE-2023-32632
Published: 2023-10-11
Description: A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-77
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1767; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1767; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1767
CVE: CVE-2023-32645
Published: 2023-10-11
Description: A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-489
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1752
CVE: CVE-2023-34346
Published: 2023-10-11
Description: A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-489, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1764; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1764; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1764