deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32169
Published: 2024-05-03
Description: D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the TokenUtils class. The issue results from a hard-coded cryptographic key. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-19659.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10332; https://www.zerodayinitiative.com/advisories/ZDI-23-714/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10332
CVE: CVE-2023-32170
Published: 2024-05-03
Description: Unified Automation UaGateway OPC UA Server Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. User interaction is required to exploit this vulnerability in that the target must choose to accept a client certificate.

The specific flaw exists within the processing of client certificates. The issue results from the lack of proper validation of certificate data. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20494.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt; https://www.zerodayinitiative.com/advisories/ZDI-23-775/; https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt
CVE: CVE-2023-32171
Published: 2024-05-03
Description: Unified Automation UaGateway OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability.

The specific flaw exists within the ImportCsv method. A crafted XML payload can cause a null pointer dereference. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20495.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt; https://www.zerodayinitiative.com/advisories/ZDI-23-776/; https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt
CVE: CVE-2023-32172
Published: 2024-05-03
Description: Unified Automation UaGateway OPC UA Server Use-After-Free Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the ImportXML function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20497.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt; https://www.zerodayinitiative.com/advisories/ZDI-23-777/; https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt
CVE: CVE-2023-32173
Published: 2024-05-03
Description: Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration.

The specific flaw exists within the implementation of the AddServer method. By specifying crafted arguments, an attacker can cause invalid characters to be inserted into an XML configuration file. An attacker can leverage this vulnerability to create a persistent denial-of-service condition on the system. 
. Was ZDI-CAN-20576.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-91
References: https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt; https://www.zerodayinitiative.com/advisories/ZDI-23-779/; https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt
CVE: CVE-2023-32174
Published: 2024-05-03
Description: Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration.

The specific flaw exists within the handling of NodeManagerOpcUa objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-20577.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-416
References: https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt; https://www.zerodayinitiative.com/advisories/ZDI-23-780/; https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt
CVE: CVE-2023-32175
Published: 2024-05-03
Description: VIPRE Antivirus Plus Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Anti Malware Service. By creating a symbolic link, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18899.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530; https://www.zerodayinitiative.com/advisories/ZDI-23-755/; https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530
CVE: CVE-2023-32176
Published: 2024-05-03
Description: VIPRE Antivirus Plus SetPrivateConfig Directory Traversal  Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SetPrivateConfig method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
. Was ZDI-CAN-19394.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530; https://www.zerodayinitiative.com/advisories/ZDI-23-756/; https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530
CVE: CVE-2023-32177
Published: 2024-05-03
Description: VIPRE Antivirus Plus DeleteHistoryFile Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the DeleteHistoryFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
. Was ZDI-CAN-19395.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530; https://www.zerodayinitiative.com/advisories/ZDI-23-757/; https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530
CVE: CVE-2023-32178
Published: 2024-05-03
Description: VIPRE Antivirus Plus TelFileTransfer Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the TelFileTransfer method. By creating a symbolic link, an attacker can abuse the method to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
. Was ZDI-CAN-19396.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530; https://www.zerodayinitiative.com/advisories/ZDI-23-758/; https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530
CVE: CVE-2023-32179
Published: 2024-05-03
Description: VIPRE Antivirus Plus FPQuarTransfer Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the FPQuarTransfer method. By creating a symbolic link, an attacker can abuse the method to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
. Was ZDI-CAN-19397.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530; https://www.zerodayinitiative.com/advisories/ZDI-23-759/; https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530
CVE: CVE-2023-34262
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18161.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-760/; https://www.zerodayinitiative.com/advisories/ZDI-23-760/
CVE: CVE-2023-34263
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18162.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-23-761/; https://www.zerodayinitiative.com/advisories/ZDI-23-761/
CVE: CVE-2023-34264
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18164.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-762/; https://www.zerodayinitiative.com/advisories/ZDI-23-762/
CVE: CVE-2023-34265
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18166.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-763/; https://www.zerodayinitiative.com/advisories/ZDI-23-763/
CVE: CVE-2023-34266
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18168.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-764/; https://www.zerodayinitiative.com/advisories/ZDI-23-764/
CVE: CVE-2023-34267
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18170.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-765/; https://www.zerodayinitiative.com/advisories/ZDI-23-765/
CVE: CVE-2023-34268
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18172.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-766/; https://www.zerodayinitiative.com/advisories/ZDI-23-766/
CVE: CVE-2023-34269
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18173.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-767/; https://www.zerodayinitiative.com/advisories/ZDI-23-767/
CVE: CVE-2023-34270
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18176.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-768/; https://www.zerodayinitiative.com/advisories/ZDI-23-768/
CVE: CVE-2023-34271
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18178.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-769/; https://www.zerodayinitiative.com/advisories/ZDI-23-769/
CVE: CVE-2023-34272
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18182.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-23-770/; https://www.zerodayinitiative.com/advisories/ZDI-23-770/
CVE: CVE-2023-34273
Published: 2024-05-03
Description: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18183.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-771/; https://www.zerodayinitiative.com/advisories/ZDI-23-771/
CVE: CVE-2023-34274
Published: 2024-05-03
Description: D-Link DIR-2150 LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. A crafted login request can cause authentication to succeed without providing proper credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20552.
CVSS Score: 8.8 (HIGH)
CWE: CWE-303
References: https://www.zerodayinitiative.com/advisories/ZDI-23-627/; https://www.zerodayinitiative.com/advisories/ZDI-23-627/
CVE: CVE-2023-34275
Published: 2024-05-03
Description: D-Link DIR-2150 SetNTPServerSettings Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20553.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-631/; https://www.zerodayinitiative.com/advisories/ZDI-23-631/
CVE: CVE-2023-34276
Published: 2024-05-03
Description: D-Link DIR-2150 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20554.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-632/; https://www.zerodayinitiative.com/advisories/ZDI-23-632/