deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27600
Published: 2023-03-15
Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`).

The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`).

By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100; https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx; https://opensips.org/docs/modules/3.3.x/sipmsgops.html
CVE: CVE-2023-27601
Published: 2023-03-15
Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`).

The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`):

By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/OpenSIPS/opensips/commit/8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf; https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h; https://opensips.org/docs/modules/3.3.x/sipmsgops.html
CVE: CVE-2023-28095
Published: 2023-03-15
Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c; https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h; https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE: CVE-2023-28096
Published: 2023-03-15
Description: OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{"jsonrpc": "2.0","method": "log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time.

To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system’s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects.

The issue has been fixed in versions 3.1.8 and 3.2.5.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/OpenSIPS/opensips/commit/[PII_REDACTED]20af25ec5c5dd91da18e6db3649dcb; https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr; https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE: CVE-2022-4313
Published: 2023-03-15
Description: A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427
References: https://www.tenable.com/security/tns-2023-14; https://www.tenable.com/security/tns-2023-14
CVE: CVE-2023-1389
Published: 2023-03-15
Description: TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.html; https://www.tenable.com/security/research/tra-2023-11; http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.html
CVE: CVE-2023-1421
Published: 2023-03-15
Description: A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-24468
Published: 2023-03-15
Description: Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6372/data/advanced-authentication-releasenotes-6372.html; https://www.netiq.com/documentation/advanced-authentication-64/advanced-authentication-releasenotes-6411/data/advanced-authentication-releasenotes-6411.html; https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6372/data/advanced-authentication-releasenotes-6372.html
CVE: CVE-2023-28097
Published: 2023-03-15
Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `[PII_REDACTED]`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5; https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq; https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE: CVE-2023-28098
Published: 2023-03-15
Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing
functions that make use of the affected code, such as the function `www_authorize()` . Versions 3.1.7 and 3.2.4 contain a fix.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102; https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h; https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
CVE: CVE-2023-28099
Published: 2023-03-15
Description: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP address string (`NULL` is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash.  All users of `ds_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://github.com/OpenSIPS/opensips/commit/e2f13d374; https://github.com/OpenSIPS/opensips/issues/2780; https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3
CVE: CVE-2023-28337
Published: 2023-03-15
Description: When uploading a firmware image to a Netgear Nighthawk Wifi6 Router (RAX30), a hidden “forceFWUpdate” parameter may be provided to force the upgrade to complete and bypass certain validation checks. End users can use this to upload modified, unofficial, and potentially malicious firmware to the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://drupal9.tenable.com/security/research/tra-2023-12; https://drupal9.tenable.com/security/research/tra-2023-12
CVE: CVE-2023-28338
Published: 2023-03-15
Description: Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body being written to “/tmp/mulipartFile” on the device itself. A sufficiently large file will cause device resources to be exhausted, resulting in the device becoming unusable until it is rebooted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://drupal9.tenable.com/security/research/tra-2023-12; https://drupal9.tenable.com/security/research/tra-2023-12
CVE: CVE-2023-28460
Published: 2023-03-15
Description: A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Vulnerabilities_APV_ID-133258.pdf; https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Vulnerabilities_APV_ID-133258.pdf
CVE: CVE-2023-28461
Published: 2023-03-15
Description: Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-306
References: https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf; https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28461
CVE: CVE-2023-28466
Published: 2023-03-16
Description: do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).
CVSS Score: 7.0 (HIGH)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-25280
Published: 2023-03-16
Description: OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg; https://www.dlink.com/en/security-bulletin/; https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20in%20pingV4Msg
CVE: CVE-2023-25281
Published: 2023-03-16
Description: A stack overflow vulnerability exists in pingV4Msg component in D-Link DIR820LA1_FW105B03, allows attackers to cause a denial of service via the nextPage parameter to ping.ccp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/migraine-sudo/D_Link_Vuln/tree/main/stackoverflow%20cancelPing; https://www.dlink.com/en/security-bulletin/; https://github.com/migraine-sudo/D_Link_Vuln/tree/main/stackoverflow%20cancelPing
CVE: CVE-2023-26951
Published: 2023-03-16
Description: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/keheying/onekeyadmin/10; https://github.com/keheying/onekeyadmin/10
CVE: CVE-2023-28486
Published: 2023-03-16
Description: Sudo before 1.9.13 does not escape control characters in log messages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-116
References: https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca; https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13; https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html
CVE: CVE-2023-28487
Published: 2023-03-16
Description: Sudo before 1.9.13 does not escape control characters in sudoreplay output.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-116
References: https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca; https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13; https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html
CVE: CVE-2023-23150
Published: 2023-03-16
Description: SA-WR915ND router firmware v17.35.1 was discovered to be vulnerable to code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/yinfei6/f7099835e9abbe16a29744430ea76a37#file-cve-2023-23150; https://reference14.example.com; https://gist.github.com/yinfei6/f7099835e9abbe16a29744430ea76a37#file-cve-2023-23150
CVE: CVE-2023-24760
Published: 2023-03-16
Description: An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://gitee.com/oufu/ofcms/issues/I6BD2Q; https://gitee.com/oufu/ofcms/issues/I6L75S; https://gitee.com/oufu/ofcms/issues/I6BD2Q
CVE: CVE-2023-24795
Published: 2023-03-16
Description: Command execution vulnerability was discovered in JHR-N916R router firmware version<=21.11.1.1483.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/yinfei6/25b30ba88396408ff85200eaf3413f0c; https://gist.github.com/yinfei6/25b30ba88396408ff85200eaf3413f0c
CVE: CVE-2023-26784
Published: 2023-03-16
Description: SQL Injection vulnerability found in Kirin Fortress Machine v.1.7-2020-0610 allows attackers to execute arbitrary code via the /admin.php?controller=admin_commonuser parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/yinfei6/b13e7527887ac0eb809fa0b6f36305e1; https://www.tosec.com.cn; https://gist.github.com/yinfei6/b13e7527887ac0eb809fa0b6f36305e1
CVE: CVE-2023-27084
Published: 2023-03-16
Description: Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://gitee.com/isoftforce/dreamer_cms/issues/I6GCUN; https://github.com/iteachyou-wjn/dreamer_cms/issues/9; https://gitee.com/isoftforce/dreamer_cms/issues/I6GCUN
CVE: CVE-2023-27095
Published: 2023-03-16
Description: Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://github.com/opengoofy/hippo4j/issues/1061; https://github.com/opengoofy/hippo4j/issues/1061
CVE: CVE-2022-4009
Published: 2023-03-16
Description: In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://advisories.octopus.com/post/2023/sa2023-05/; https://advisories.octopus.com/post/2023/sa2023-05/
CVE: CVE-2022-38063
Published: 2023-03-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/social-login-wp/wordpress-social-login-wp-plugin-5-0-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/social-login-wp/wordpress-social-login-wp-plugin-5-0-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-38971
Published: 2023-03-16
Description: Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5 versions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-7-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-7-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-40699
Published: 2023-03-16
Description: Cross-Site Scripting (XSS) vulnerability in Dario Curvino Yasr – Yet Another Stars Rating plugin <= 3.1.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/yet-another-stars-rating/wordpress-yasr-yet-another-stars-rating-plugin-3-1-2-xss-arbitrary-shortcode-execution-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yet-another-stars-rating/wordpress-yasr-yet-another-stars-rating-plugin-3-1-2-xss-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2022-41554
Published: 2023-03-16
Description: Stored Cross-Site Scripting (XSS) vulnerability in John West Slideshow SE plugin <= 2.5.5 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/slideshow-se/wordpress-slideshow-se-plugin-2-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slideshow-se/wordpress-slideshow-se-plugin-2-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-24571
Published: 2023-03-16
Description: 
Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with administrator privileges could potentially exploit this vulnerability to perform arbitrary code execution.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000210955/dsa-2023-046; https://www.dell.com/support/kbdoc/en-us/000210955/dsa-2023-046
CVE: CVE-2022-34406
Published: 2023-03-16
Description: 
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.


CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability; https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability
CVE: CVE-2022-34407
Published: 2023-03-16
Description: 
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.


CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability; https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability
CVE: CVE-2022-34408
Published: 2023-03-16
Description: 
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.


CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability; https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability
CVE: CVE-2022-34409
Published: 2023-03-16
Description: 
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.


CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability; https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability