deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4758
Published: 2023-01-23
Description: The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c2c89234-5e9c-47c8-9827-8ab0b10fb7d6; https://wpscan.com/vulnerability/c2c89234-5e9c-47c8-9827-8ab0b10fb7d6
CVE: CVE-2022-4760
Published: 2023-01-23
Description: The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/ad710c22-878a-441b-9c5a-90511b913d9d; https://wpscan.com/vulnerability/ad710c22-878a-441b-9c5a-90511b913d9d
CVE: CVE-2022-4775
Published: 2023-01-23
Description: The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/5ab3fc58-7d1c-4bcd-8bbd-86c62a3f979c; https://wpscan.com/vulnerability/5ab3fc58-7d1c-4bcd-8bbd-86c62a3f979c
CVE: CVE-2022-4789
Published: 2023-01-23
Description: The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/5e816e9a-84e5-42d2-a7ff-e46be9072278; https://wpscan.com/vulnerability/5e816e9a-84e5-42d2-a7ff-e46be9072278
CVE: CVE-2022-4790
Published: 2023-01-23
Description: The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c01f9d36-955d-432c-8a09-ea9ee750f1a1; https://wpscan.com/vulnerability/c01f9d36-955d-432c-8a09-ea9ee750f1a1
CVE: CVE-2022-4832
Published: 2023-01-23
Description: The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/735a33e1-63fb-4f17-812c-3e68709b5c2c; https://wpscan.com/vulnerability/735a33e1-63fb-4f17-812c-3e68709b5c2c
CVE: CVE-2023-24095
Published: 2023-01-23
Description: TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formSystemCheck. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/05/README.md; https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/05/README.md
CVE: CVE-2023-24096
Published: 2023-01-23
Description: TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the newpass parameter at /formPasswordSetup. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/06/README.md; https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/06/README.md
CVE: CVE-2023-24097
Published: 2023-01-23
Description: TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formPasswordAuth. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/03/README.md; https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/03/README.md
CVE: CVE-2023-24098
Published: 2023-01-23
Description: TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formSysLog. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/04/README.md; https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/04/README.md
CVE: CVE-2023-24099
Published: 2023-01-23
Description: TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the username parameter at /formWizardPassword. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/07/README.md; https://github.com/chunklhit/cve/blob/master/TRENDNet/TEW-820AP/07/README.md
CVE: CVE-2022-38725
Published: 2023-01-23
Description: An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc; https://lists.balabit.hu/pipermail/syslog-ng/; https://lists.debian.org/debian-lts-announce/2023/02/msg00043.html
CVE: CVE-2022-37718
Published: 2023-01-23
Description: The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands through a specially crafted payload. This vulnerability can also be exploited from an unauthenticated context via unspecified vectors
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.cryptnetix.com/blog/2022/09/14/Edge-Nexus-Vulnerability-Disclosure.html; https://www.edgenexus.io/products/load-balancer/; https://www.cryptnetix.com/blog/2022/09/14/Edge-Nexus-Vulnerability-Disclosure.html
CVE: CVE-2022-37719
Published: 2023-01-23
Description: A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and execute arbitrary code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.cryptnetix.com/blog/2022/09/14/Edge-Nexus-Vulnerability-Disclosure.html; https://www.edgenexus.io/products/load-balancer/; https://www.cryptnetix.com/blog/2022/09/14/Edge-Nexus-Vulnerability-Disclosure.html
CVE: CVE-2022-3430
Published: 2023-01-23
Description: A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-94952; https://support.lenovo.com/us/en/product_security/LEN-94952
CVE: CVE-2022-4816
Published: 2023-01-23
Description: A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-400
References: https://iknow.lenovo.com.cn/detail/dc_205899.html; https://iknow.lenovo.com.cn/detail/dc_205899.html
CVE: CVE-2023-0446
Published: 2023-01-23
Description: The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2844200%40youtube-channel&new=2844200%40youtube-channel&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d979f899-8cdc-4230-b1b5-865c025dc86a?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2844200%40youtube-channel&new=2844200%40youtube-channel&sfp_email=&sfph_mail=
CVE: CVE-2023-0447
Published: 2023-01-23
Description: The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions up to, and including, 3.0.12.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to clear the plugin's cache.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/youtube-channel/trunk/youtube-channel.php?rev=2482795#L1502; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2844200%40youtube-channel&new=2844200%40youtube-channel&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/486b6a75-d101-4f3a-8436-6c23dd0ff200?source=cve
CVE: CVE-2023-22721
Published: 2023-01-23
Description: Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress <= 3.2.7 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/oi-yamaps/wordpress-oi-yandex-maps-for-wordpress-plugin-3-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/oi-yamaps/wordpress-oi-yandex-maps-for-wordpress-plugin-3-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23687
Published: 2023-01-23
Description: Auth. Stored Cross-Site Scripting (XSS) vulnerability in Youtube shortcode <= 1.8.5 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/youtube-shortcode/wordpress-youtube-shortcode-plugin-1-8-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/youtube-shortcode/wordpress-youtube-shortcode-plugin-1-8-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23824
Published: 2023-01-23
Description: Auth. SQL Injection (SQLi) vulnerability in WP-TopBar <= 5.36 versions.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wp-topbar/wordpress-wp-topbar-plugin-5-36-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/wp-topbar/wordpress-wp-topbar-plugin-5-36-sql-injection?_s_id=cve
CVE: CVE-2023-22960
Published: 2023-01-23
Description: Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-284
References: https://publications.lexmark.com/publications/security-alerts/CVE-2023-22960.pdf; https://publications.lexmark.com/publications/security-alerts/CVE-2023-22960.pdf
CVE: CVE-2023-23560
Published: 2023-01-23
Description: In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-20
References: https://publications.lexmark.com/publications/security-alerts/CVE-2023-23560.pdf; https://support.lexmark.com/alerts/; https://publications.lexmark.com/publications/security-alerts/CVE-2023-23560.pdf
CVE: CVE-2018-20104
Published: 2023-01-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none.
CVE: CVE-2022-23005
Published: 2023-01-23
Description: Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in the UFS standard, is provided by UFS devices to support platforms that need to download the system boot loader from external non-volatile storage locations. Several scenarios have been identified in which adversaries may disable the boot capability, or revert to an old boot loader code, if the host boot ROM code is improperly implemented. UFS Host Boot ROM implementers may be impacted by this vulnerability. UFS devices are only impacted when connected to a vulnerable UFS Host and are not independently impacted by this vulnerability. When present, the vulnerability is in the UFS Host implementation and is not a vulnerability in Western Digital UFS Devices. Western Digital has provided details of the vulnerability to the JEDEC standards body, multiple vendors of host processors, and software solutions providers.
CVSS Score: 8.7 (HIGH)
CWE: CWE-1224, CWE-1233, CWE-1262, CWE-662
References: https://documents.westerndigital.com/content/dam/doc-library/en_us/assets/public/western-digital/collateral/white-paper/white-paper-host-boot-rom-code-vulnerability-and-mitigation.pdf; https://www.westerndigital.com/support/product-security/wdc-23001-host-boot-rom-code-vulnerability-in-systems-implementing-ufs-boot-feature; https://documents.westerndigital.com/content/dam/doc-library/en_us/assets/public/western-digital/collateral/white-paper/white-paper-host-boot-rom-code-vulnerability-and-mitigation.pdf
CVE: CVE-2022-40034
Published: 2023-01-23
Description: Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/rawchen/blog-ssm/issues/4; https://github.com/rawchen/blog-ssm/issues/4
CVE: CVE-2022-46639
Published: 2023-01-23
Description: A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://ia-informatica.com/it/CVE-2022-46639; https://ia-informatica.com/it/CVE-2022-46639
CVE: CVE-2023-22630
Published: 2023-01-23
Description: IzyBat Orange casiers before 20221102_1 allows SQL Injection via a getCasier.php?taille= URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/orangecertcc/security-research/security/advisories/GHSA-j94f-5cg6-6j9j; https://github.com/orangecertcc/security-research/security/advisories/GHSA-j94f-5cg6-6j9j
CVE: CVE-2023-22483
Published: 2023-01-23
Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.

CVSS Score: 3.5 (LOW)
CWE: CWE-400, CWE-407
References: https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c; https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c
CVE: CVE-2023-22484
Published: 2023-01-23
Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.
CVSS Score: 3.5 (LOW)
CWE: CWE-400, CWE-407, CWE-407
References: https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r; https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r
CVE: CVE-2023-21719
Published: 2023-01-24
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21719; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21719; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-21775
Published: 2023-01-24
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21775; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21775; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-21795
Published: 2023-01-24
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21795; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21795
CVE: CVE-2023-21796
Published: 2023-01-24
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21796; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21796; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-22485
Published: 2023-01-24
Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-91
References: https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr; https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr
CVE: CVE-2023-23331
Published: 2023-01-24
Description: Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://0xhunter20.medium.com/how-i-found-my-first-blind-sql-injection-cve-2023-23331-aef103a7f73c; https://www.amano.eu/en/parking/xparc/; https://0xhunter20.medium.com/how-i-found-my-first-blind-sql-injection-cve-2023-23331-aef103a7f73c
CVE: CVE-2022-45639
Published: 2023-01-24
Description: OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/171649/Sleuthkit-4.11.1-Command-Injection.html; http://www.binaryworld.it/; https://www.binaryworld.it/guidepoc.asp#CVE-2022-45639
CVE: CVE-2022-4554
Published: 2023-01-24
Description: B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0022; https://www.usom.gov.tr/bildirim/tr-23-0022
CVE: CVE-2022-3806
Published: 2023-01-25
Description: Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-415
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w525-fm68-ppq3; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w525-fm68-ppq3
CVE: CVE-2023-0396
Published: 2023-01-25
Description: A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8rpp-6vxq-pqg3; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8rpp-6vxq-pqg3
CVE: CVE-2022-40717
Published: 2023-01-26
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15727.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304; https://www.zerodayinitiative.com/advisories/ZDI-22-1220/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304
CVE: CVE-2022-40718
Published: 2023-01-26
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15728.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304; https://www.zerodayinitiative.com/advisories/ZDI-22-1221/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304
CVE: CVE-2022-40719
Published: 2023-01-26
Description: This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd_generic.lua plugin for the xupnpd service, which listens on TCP port 4044 by default. When parsing the feed parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15906.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304; https://www.zerodayinitiative.com/advisories/ZDI-22-1223/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304