deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-23896
Published: 2024-01-26
Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/stock.php, in the batchno parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE: CVE-2024-0921
Published: 2024-01-26
Description: A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setDeviceSettings of the component Web Interface. The manipulation of the argument statuscheckpppoeuser leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252139.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/xiyuanhuaigu/cve/blob/main/rce.md; https://vuldb.com/?ctiid.252139; https://vuldb.com/?id.252139
CVE: CVE-2024-0922
Published: 2024-01-26
Description: A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49_multi_TDE01. Affected by this vulnerability is the function formQuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252127. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/formQuickIndex.md; https://vuldb.com/?ctiid.252127; https://vuldb.com/?id.252127
CVE: CVE-2024-0923
Published: 2024-01-26
Description: A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.49_multi_TDE01. Affected by this issue is the function formSetDeviceName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252128. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/formSetDeviceName.md; https://vuldb.com/?ctiid.252128; https://vuldb.com/?id.252128
CVE: CVE-2023-6291
Published: 2024-01-26
Description: A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
CVSS Score: 7.1 (HIGH)
CWE: CWE-601, CWE-601
References: https://access.redhat.com/errata/RHSA-2023:7854; https://access.redhat.com/errata/RHSA-2023:7855; https://access.redhat.com/errata/RHSA-2023:7856
CVE: CVE-2024-0924
Published: 2024-01-26
Description: A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.49_multi_TDE01. This affects the function formSetPPTPServer. The manipulation of the argument startIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/formSetPPTPServer.md; https://vuldb.com/?ctiid.252129; https://vuldb.com/?id.252129
CVE: CVE-2024-0925
Published: 2024-01-26
Description: A vulnerability has been found in Tenda AC10U 15.03.06.49_multi_TDE01 and classified as critical. This vulnerability affects the function formSetVirtualSer. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252130 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/formSetVirtualSer.md; https://vuldb.com/?ctiid.252130; https://vuldb.com/?id.252130
CVE: CVE-2024-0926
Published: 2024-01-26
Description: A vulnerability was found in Tenda AC10U 15.03.06.49_multi_TDE01 and classified as critical. This issue affects the function formWifiWpsOOB. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252131. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/formWifiWpsOOB.md; https://vuldb.com/?ctiid.252131; https://vuldb.com/?id.252131
CVE: CVE-2024-0927
Published: 2024-01-26
Description: A vulnerability was found in Tenda AC10U 15.03.06.49_multi_TDE01. It has been classified as critical. Affected is the function fromAddressNat. The manipulation of the argument entrys/mitInterface/page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252132. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromAddressNat_1.md; https://vuldb.com/?ctiid.252132; https://vuldb.com/?id.252132
CVE: CVE-2024-22550
Published: 2024-01-26
Description: An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://packetstormsecurity.com/files/176312/ShopSite-14.0-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/176312/ShopSite-14.0-Cross-Site-Scripting.html
CVE: CVE-2024-22551
Published: 2024-01-26
Description: WhatACart v2.0.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /site/default/search.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/176314/WhatACart-2.0.7-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/176314/WhatACart-2.0.7-Cross-Site-Scripting.html
CVE: CVE-2024-0928
Published: 2024-01-26
Description: A vulnerability was found in Tenda AC10U 15.03.06.49_multi_TDE01. It has been declared as critical. Affected by this vulnerability is the function fromDhcpListClient. The manipulation of the argument page/listN leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromDhcpListClient_1.md; https://vuldb.com/?ctiid.252133; https://vuldb.com/?id.252133
CVE: CVE-2024-0929
Published: 2024-01-26
Description: A vulnerability was found in Tenda AC10U 15.03.06.49_multi_TDE01. It has been rated as critical. Affected by this issue is the function fromNatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252134 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromNatStaticSetting.md; https://vuldb.com/?ctiid.252134; https://vuldb.com/?id.252134
CVE: CVE-2024-0930
Published: 2024-01-26
Description: A vulnerability classified as critical has been found in Tenda AC10U 15.03.06.49_multi_TDE01. This affects the function fromSetWirelessRepeat. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252135. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.md; https://vuldb.com/?ctiid.252135; https://vuldb.com/?id.252135
CVE: CVE-2024-21985
Published: 2024-01-26
Description: ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 
and 9.13.1P4 are susceptible to a vulnerability which could allow an 
authenticated user with multiple remote accounts with differing roles to
 perform actions via REST API beyond their intended privilege. Possible 
actions include viewing limited configuration details and metrics or 
modifying limited settings, some of which could result in a Denial of 
Service (DoS).




CVSS Score: 7.6 (HIGH)
CWE: CWE-269
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-0931
Published: 2024-01-26
Description: A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49_multi_TDE01. This vulnerability affects the function saveParentControlInfo. The manipulation of the argument deviceId/time/urls leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252136. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/saveParentControlInfo_1.md; https://vuldb.com/?ctiid.252136; https://vuldb.com/?id.252136
CVE: CVE-2024-0932
Published: 2024-01-26
Description: A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.49_multi_TDE01. This issue affects the function setSmartPowerManagement. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252137 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-121
References: https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/setSmartPowerManagement.md; https://vuldb.com/?ctiid.252137; https://vuldb.com/?id.252137
CVE: CVE-2024-0933
Published: 2024-01-26
Description: A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \app\model\Upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://docs.qq.com/doc/DYnNWeHdTVXZqZURH; https://vuldb.com/?ctiid.252140; https://vuldb.com/?id.252140
CVE: CVE-2024-0936
Published: 2024-01-26
Description: A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252181 was assigned to this vulnerability. NOTE: The vendor was contacted early and confirmed immediately the existence of the issue. A patch is planned to be released in February 2024.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://github.com/bayuncao/vul-cve-5; https://github.com/bayuncao/vul-cve-5/blob/main/poc.py; https://vuldb.com/?ctiid.252181
CVE: CVE-2024-23820
Published: 2024-01-26
Description: OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not  release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-401
References: https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39; https://github.com/openfga/openfga/releases/tag/v1.4.3; https://github.com/openfga/openfga/security/advisories/GHSA-rxpw-85vw-fx87
CVE: CVE-2024-0937
Published: 2024-01-26
Description: A vulnerability, which was classified as critical, has been found in van_der_Schaar LAB synthcity 0.2.9. Affected by this issue is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252182 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early and confirmed immediately the existence of the issue. A patch is planned to be released in February 2024.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://github.com/bayuncao/vul-cve-6; https://github.com/bayuncao/vul-cve-6/blob/main/poc.py; https://vuldb.com/?ctiid.252182
CVE: CVE-2024-0938
Published: 2024-01-26
Description: A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file /general/email/inbox/delete_webmail.php. The manipulation of the argument WEBBODY_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-252183. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yu1e/vuls/blob/main/SQL%20injection%20vulnerability%20exists%20in%20Tongda%20OA.md; https://vuldb.com/?ctiid.252183; https://vuldb.com/?id.252183
CVE: CVE-2024-20253
Published: 2024-01-26
Description: A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm
CVE: CVE-2024-20263
Published: 2024-01-26
Description: A vulnerability with the access control list (ACL) management within a stacked switch configuration of Cisco Business 250 Series Smart Switches and Business 350 Series Managed Switches could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. This vulnerability is due to incorrect processing of ACLs on a stacked configuration when either the primary or backup switches experience a full stack reload or power cycle. An attacker could exploit this vulnerability by sending crafted traffic through an affected device. A successful exploit could allow the attacker to bypass configured ACLs, causing traffic to be dropped or forwarded in an unexpected manner. The attacker does not have control over the conditions that result in the device being in the vulnerable state. Note: In the vulnerable state, the ACL would be correctly applied on the primary devices but could be incorrectly applied to the backup devices.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-bus-acl-bypass-5zn9hNJk; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-bus-acl-bypass-5zn9hNJk
CVE: CVE-2024-20305
Published: 2024-01-26
Description: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuc-xss-9TFuu5MS; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuc-xss-9TFuu5MS
CVE: CVE-2024-21336
Published: 2024-01-26
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 2.5 (LOW)
CWE: CWE-357
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21336; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21336
CVE: CVE-2024-0939
Published: 2024-01-26
Description: A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/Yu1e/vuls/blob/main/an%20arbitrary%20file%20upload%20vulnerability%20in%20BaiZhuo%20Networks%20Smart%20S210%20multi-service%20security%20gateway%20intelligent%20management%20platform.md; https://vuldb.com/?ctiid.252184; https://vuldb.com/?id.252184
CVE: CVE-2024-0941
Published: 2024-01-26
Description: A vulnerability was found in Novel-Plus 4.3.0-RC1 and classified as critical. This issue affects some unknown processing of the file /novel/bookComment/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-252185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/red0-ha1yu/warehouse/blob/main/novel-plus_sqlinject2.md; https://vuldb.com/?ctiid.252185; https://vuldb.com/?id.252185
CVE: CVE-2023-29081
Published: 2024-01-26
Description: A vulnerability has been reported in Suite Setups built with versions prior to InstallShield 2023 R2. This vulnerability may allow locally authenticated users to cause a Denial of Service (DoS) condition when handling move operations on local, temporary folders.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2023-29081-InstallShield-Symlink-Vulnerability-Affecting/ta-p/305052; https://community.flexera.com/t5/InstallShield-Knowledge-Base/CVE-2023-29081-InstallShield-Symlink-Vulnerability-Affecting/ta-p/305052
CVE: CVE-2024-0942
Published: 2024-01-26
Description: A vulnerability was found in Totolink N200RE V5 9.3.5u.6255_B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-252186 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-613
References: https://drive.google.com/file/d/1oWAGbmDtHDIUN1WSRAh4ZnuzHOuvTU4T/view?usp=sharing; https://vuldb.com/?ctiid.252186; https://vuldb.com/?id.252186
CVE: CVE-2024-0943
Published: 2024-01-26
Description: A vulnerability was found in Totolink N350RT 9.3.5u.6255. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252187. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-613
References: https://drive.google.com/file/d/1OBs4kc1KvbqrMhQHs54WtwxxxiBoI0hL/view?usp=sharing; https://vuldb.com/?ctiid.252187; https://vuldb.com/?id.252187
CVE: CVE-2024-0944
Published: 2024-01-26
Description: A vulnerability was found in Totolink T8 4.1.5cu.833_20220905. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252188. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-613
References: https://drive.google.com/file/d/1YPisSnxM5CwSLKFgs9w5k5MtNUgiijVo/view?usp=sharing; https://vuldb.com/?ctiid.252188; https://vuldb.com/?id.252188
CVE: CVE-2023-6470
Published: 2024-01-26
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER.
CVE: CVE-2024-0945
Published: 2024-01-26
Description: A vulnerability classified as critical has been found in 60IndexPage up to 1.8.5. This affects an unknown part of the file /include/file.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252189 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918, CWE-918
References: https://note.zhaoj.in/share/7F54gy22y7uJ; https://vuldb.com/?ctiid.252189; https://vuldb.com/?id.252189