deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-24147
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/telnet_hard_code/telnet_hard_code.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/telnet_hard_code/telnet_hard_code.md
CVE: CVE-2023-24148
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setUploadUserData/setUploadUserData.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/setUploadUserData/setUploadUserData.md
CVE: CVE-2023-24149
Published: 2023-02-03
Description: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/root_hard_code/root_hard_code.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_ca300-poe/root_hard_code/root_hard_code.md
CVE: CVE-2023-24150
Published: 2023-02-03
Description: A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/meshSlaveDlfw/meshSlaveDlfw.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/meshSlaveDlfw/meshSlaveDlfw.md
CVE: CVE-2023-24151
Published: 2023-02-03
Description: A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/recvSlaveCloudCheckStatus_ip/recvSlaveCloudCheckStatus_ip.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/recvSlaveCloudCheckStatus_ip/recvSlaveCloudCheckStatus_ip.md
CVE: CVE-2023-24152
Published: 2023-02-03
Description: A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/meshSlaveUpdate/meshSlaveUpdate.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/meshSlaveUpdate/meshSlaveUpdate.md
CVE: CVE-2023-24153
Published: 2023-02-03
Description: A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/recvSlaveCloudCheckStatus_version/recvSlaveCloudCheckStatus.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/recvSlaveCloudCheckStatus_version/recvSlaveCloudCheckStatus.md
CVE: CVE-2023-24154
Published: 2023-02-03
Description: TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/setUpgradeFW/setUpgradeFW.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/setUpgradeFW/setUpgradeFW.md
CVE: CVE-2023-24155
Published: 2023-02-03
Description: TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/telnet_login/telnet_login.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/telnet_login/telnet_login.md
CVE: CVE-2023-24156
Published: 2023-02-03
Description: A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/recvSlaveUpgstatus/recvSlaveUpgstatus.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/recvSlaveUpgstatus/recvSlaveUpgstatus.md
CVE: CVE-2023-24157
Published: 2023-02-03
Description: A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/updateWifiInfo/updateWifiInfo.md; https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/updateWifiInfo/updateWifiInfo.md
CVE: CVE-2023-22975
Published: 2023-02-03
Description: A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jflyfox/jfinal_cms/issues/53; https://github.com/jflyfox/jfinal_cms/issues/53
CVE: CVE-2021-36424
Published: 2023-02-03
Description: An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/slackero/phpwcms/issues/310; https://github.com/slackero/phpwcms/issues/310
CVE: CVE-2021-36425
Published: 2023-02-03
Description: Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/slackero/phpwcms/issues/311; https://github.com/slackero/phpwcms/issues/311
CVE: CVE-2021-36426
Published: 2023-02-03
Description: File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/slackero/phpwcms/issues/312; https://github.com/slackero/phpwcms/issues/312
CVE: CVE-2021-36431
Published: 2023-02-03
Description: SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check() function in jocms/apps/mask/inc/mask.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/mxgbr/jocms/issues/6; https://github.com/mxgbr/jocms/issues/6
CVE: CVE-2021-36432
Published: 2023-02-03
Description: SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_mask() function in jocms/apps/mask/mask.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/mxgbr/jocms/issues/6; https://github.com/mxgbr/jocms/issues/6
CVE: CVE-2021-36433
Published: 2023-02-03
Description: SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_delete_mask function in jocms/apps/mask/mask.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/mxgbr/jocms/issues/6; https://github.com/mxgbr/jocms/issues/6
CVE: CVE-2021-36434
Published: 2023-02-03
Description: SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check function in jocms/apps/mask/inc/getmask.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/mxgbr/jocms/issues/6; https://github.com/mxgbr/jocms/issues/6
CVE: CVE-2021-36443
Published: 2023-02-03
Description: Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/peacexie/imcat/issues/9; https://github.com/peacexie/imcat/issues/9
CVE: CVE-2021-36444
Published: 2023-02-03
Description: Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/peacexie/imcat/issues/9; https://github.com/peacexie/imcat/issues/9
CVE: CVE-2021-36484
Published: 2023-02-03
Description: SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.notion.so/JIZHICMS-v1-9-5-SQL-Injection-3a[PII_REDACTED]4a20bf22c052c7778bbd; https://www.notion.so/JIZHICMS-v1-9-5-SQL-Injection-3a[PII_REDACTED]4a20bf22c052c7778bbd
CVE: CVE-2021-36489
Published: 2023-02-03
Description: Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/liballeg/allegro5/issues/1251; https://github.com/liballeg/allegro5/issues/1251
CVE: CVE-2021-36493
Published: 2023-02-03
Description: Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42160; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42160
CVE: CVE-2021-36503
Published: 2023-02-03
Description: SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Fanli2012/native-php-cms/issues/3; https://github.com/Fanli2012/native-php-cms/issues/3
CVE: CVE-2021-36532
Published: 2023-02-03
Description: Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-362
References: https://github.com/excellentoldtv/portfolioCMS-issues/issues/1; https://github.com/excellentoldtv/portfolioCMS-issues/issues/1
CVE: CVE-2021-36535
Published: 2023-02-03
Description: Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/cesanta/mjs/issues/175; https://github.com/cesanta/mjs/issues/175
CVE: CVE-2021-36538
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/miglen/b09498b4b9fe1be58973bd474af125ab; https://gist.github.com/miglen/b09498b4b9fe1be58973bd474af125ab
CVE: CVE-2021-36544
Published: 2023-02-03
Description: Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://gitee.com/happy_source/tpcms/issues/I3YNWY; https://gitee.com/happy_source/tpcms/issues/I3YNWY
CVE: CVE-2021-36545
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field in Site Configuration page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitee.com/happy_source/tpcms/issues/I3YUCJ; https://gitee.com/happy_source/tpcms/issues/I3YUCJ
CVE: CVE-2021-36546
Published: 2023-02-03
Description: Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922, CWE-922
References: https://github.com/Kitesky/KiteCMS/issues/10; https://github.com/Kitesky/KiteCMS/issues/10
CVE: CVE-2021-36569
Published: 2023-02-03
Description: Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/daylightstudio/FUEL-CMS/issues/578; https://github.com/daylightstudio/FUEL-CMS/issues/578
CVE: CVE-2021-36570
Published: 2023-02-03
Description: Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/daylightstudio/FUEL-CMS/issues/579; https://github.com/daylightstudio/FUEL-CMS/issues/579
CVE: CVE-2021-36712
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://yzmcms.com; https://github.com/linuka-deception/yzmcms6.1.git; http://yzmcms.com
CVE: CVE-2021-37234
Published: 2023-02-03
Description: Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-352, CWE-352
References: https://github.com/pwnlandia/mhn/issues/809; https://github.com/pwnlandia/mhn/issues/809
CVE: CVE-2021-37304
Published: 2023-02-03
Description: An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://github.com/jeecgboot/jeecg-boot/issues/2793; https://github.com/jeecgboot/jeecg-boot/issues/2793
CVE: CVE-2021-37305
Published: 2023-02-03
Description: An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://github.com/jeecgboot/jeecg-boot/issues/2794; https://github.com/jeecgboot/jeecg-boot/issues/2794
CVE: CVE-2021-37306
Published: 2023-02-03
Description: An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: api uri:/sys/user/checkOnlyUser?username=admin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://github.com/jeecgboot/jeecg-boot/issues/2794; https://github.com/jeecgboot/jeecg-boot/issues/2794
CVE: CVE-2021-37311
Published: 2023-02-03
Description: Buffer Overflow vulnerability in fcitx5 5.0.8 allows attackers to cause a denial of service via crafted message to the application's listening port.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://fcitx-im.org; https://github.com/fcitx/fcitx5/pull/308; https://fcitx-im.org
CVE: CVE-2021-37315
Published: 2023-02-03
Description: Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the source for COPY and MOVE operations.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-706, CWE-706
References: https://robertchen.cc/blog/2021/03/31/asus-rce; https://robertchen.cc/blog/2021/03/31/asus-rce
CVE: CVE-2021-37316
Published: 2023-02-03
Description: SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive information via /etc/shadow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://robertchen.cc/blog/2021/03/31/asus-rce; https://robertchen.cc/blog/2021/03/31/asus-rce
CVE: CVE-2021-37317
Published: 2023-02-03
Description: Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the target for COPY and MOVE operations.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://robertchen.cc/blog/2021/03/31/asus-rce; https://robertchen.cc/blog/2021/03/31/asus-rce
CVE: CVE-2021-37373
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in Teradek Slice 1st generation firmware 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tbutler.org/2021/04/29/teradek-vulnerability-advisory; https://tbutler.org/2021/04/29/teradek-vulnerability-advisory
CVE: CVE-2021-37374
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tbutler.org/2021/04/29/teradek-vulnerability-advisory; https://tbutler.org/2021/04/29/teradek-vulnerability-advisory
CVE: CVE-2021-37375
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in Teradek VidiU / VidiU Mini firmware version 3.0.8 and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://tbutler.org/2021/04/29/teradek-vulnerability-advisory; https://tbutler.org/2021/04/29/teradek-vulnerability-advisory
CVE: CVE-2021-37376
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in Teradek Bond, Bond 2 and Bond Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://tbutler.org/2021/04/29/teradek-vulnerability-advisory; https://teradek.com/collections/cube2; https://tbutler.org/2021/04/29/teradek-vulnerability-advisory
CVE: CVE-2021-37377
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in Teradek Brik firmware version 7.2.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://tbutler.org/2021/04/29/teradek-vulnerability-advisory; https://tbutler.org/2021/04/29/teradek-vulnerability-advisory
CVE: CVE-2021-37378
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in Teradek Cube and Cube Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tbutler.org/2021/04/29/teradek-vulnerability-advisory; https://tbutler.org/2021/04/29/teradek-vulnerability-advisory
CVE: CVE-2021-37379
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in Teradek Sphere all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://tbutler.org/2021/04/29/teradek-vulnerability-advisory; https://tbutler.org/2021/04/29/teradek-vulnerability-advisory
CVE: CVE-2021-37497
Published: 2023-02-03
Description: SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/penson233/Vuln/issues/3; https://www.pbootcms.com/; https://github.com/penson233/Vuln/issues/3
CVE: CVE-2021-37501
Published: 2023-02-03
Description: Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/HDFGroup/hdf5; https://github.com/HDFGroup/hdf5/issues/2458; https://github.com/ST4RF4LL/Something_Found/blob/main/HDF5_v1.13.0_h5dump_heap_overflow.md
CVE: CVE-2021-37502
Published: 2023-02-03
Description: Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/marcantondahmen/automad/issues/29; https://github.com/marcantondahmen/automad/issues/29
CVE: CVE-2021-37518
Published: 2023-02-03
Description: Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via omnibar feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/philc/vimium/issues/3832; https://github.com/philc/vimium/pull/3850; https://github.com/philc/vimium/issues/3832
CVE: CVE-2021-37519
Published: 2023-02-03
Description: Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/memcached/memcached/issues/805; https://github.com/memcached/memcached/pull/806/commits/264722ae4e248b453be00e97197dadc685b60fd0; https://github.com/memcached/memcached/issues/805
CVE: CVE-2023-0659
Published: 2023-02-03
Description: A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220101 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://vuldb.com/?ctiid.220101; https://vuldb.com/?id.220101; https://vuldb.com/?ctiid.220101
CVE: CVE-2023-23086
Published: 2023-02-03
Description: Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/scottcgi/MojoJson/issues/2; https://github.com/scottcgi/MojoJson/issues/2
CVE: CVE-2023-23087
Published: 2023-02-03
Description: An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476, CWE-476
References: https://github.com/scottcgi/MojoJson/issues/3; https://github.com/scottcgi/MojoJson/issues/3