deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-25664
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a heap buffer overflow in TAvgPoolGrad. A fix is included in TensorFlow 2.12.0 and 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-122
References: https://github.com/tensorflow/tensorflow/commit/ddaac2bdd099bec5d7923dea45276a7558217e5b; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6hg6-5c2q-7rcr; https://github.com/tensorflow/tensorflow/commit/ddaac2bdd099bec5d7923dea45276a7558217e5b
CVE: CVE-2023-25665
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `SparseSparseMaximum` is given invalid sparse tensors as inputs, it can give a null pointer error. A fix is included in TensorFlow version 2.12 and version 2.11.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/tensorflow/tensorflow/commit/5e0ecfb42f5f65629fd7a4edd6c4afe7ff0feb04; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-558h-mq8x-7q9g; https://github.com/tensorflow/tensorflow/commit/5e0ecfb42f5f65629fd7a4edd6c4afe7ff0feb04
CVE: CVE-2023-25666
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a floating point exception in AudioSpectrogram. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: https://github.com/tensorflow/tensorflow/commit/d0d4e779da0d0f56499c6fa5ba09f0a576cc6b14; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f637-vh3r-vfh2; https://github.com/tensorflow/tensorflow/commit/d0d4e779da0d0f56499c6fa5ba09f0a576cc6b14
CVE: CVE-2023-25667
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, integer overflow occurs when `2^31 <= num_frames * height * width * channels < 2^32`, for example Full HD screencast of at least 346 frames. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/tensorflow/tensorflow/commit/8dc723fcdd1a6127d6c970bd2ecb18b019a1a58d; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fqm2-gh8w-gr68; https://github.com/tensorflow/tensorflow/commit/8dc723fcdd1a6127d6c970bd2ecb18b019a1a58d
CVE: CVE-2023-25668
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will be included in TensorFlow version 2.12.0 and will also cherrypick this commit on TensorFlow version 2.11.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gw97-ff7c-9v96; https://github.com/tensorflow/tensorflow/commit/7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb
CVE: CVE-2023-25669
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the stride and window size are not positive for `tf.raw_ops.AvgPoolGrad`, it can give a floating point exception. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: https://github.com/tensorflow/tensorflow/commit/1295ae4dbb52fe06b19733b0257e2340d7b63b8d; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rcf8-g8jv-vg6p; https://github.com/tensorflow/tensorflow/commit/1295ae4dbb52fe06b19733b0257e2340d7b63b8d
CVE: CVE-2023-25670
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a null point error in QuantizedMatMulWithBiasAndDequantize with MKL enabled. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/tensorflow/tensorflow/commit/8a47a39d[PII_REDACTED]d23a523c977238717e8727; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-49rq-hwc3-x77w; https://github.com/tensorflow/tensorflow/commit/8a47a39d[PII_REDACTED]d23a523c977238717e8727
CVE: CVE-2023-25671
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. There is out-of-bounds access due to mismatched integer type sizes. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/tensorflow/tensorflow/commit/2eedc8f676d2c3b8be9492e547b2bc814c10b367; https://github.com/tensorflow/tensorflow/commit/760322a71ac9033e122ef1f4b1c62813021e5938; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j5w9-hmfh-4cr6
CVE: CVE-2023-25672
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. The function `tf.raw_ops.LookupTableImportV2` cannot handle scalars in the `values` parameter and gives an NPE. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/tensorflow/tensorflow/commit/980b22536abcbbe1b4a5642fc940af33d8c19b69; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-94mm-g2mv-8p7r; https://github.com/tensorflow/tensorflow/commit/980b22536abcbbe1b4a5642fc940af33d8c19b69
CVE: CVE-2023-25673
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a Floating Point Exception in TensorListSplit with XLA. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: https://github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017fa; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-647v-r7qq-24fh; https://github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017fa
CVE: CVE-2023-25674
Published: 2023-03-25
Description: TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix is included in TensorFlow 2.12.0 and 2.11.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017fa; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gf97-q72m-7579; https://github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017fa
CVE: CVE-2023-25675
Published: 2023-03-25
Description: TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.Bincount` segfaults when given a parameter `weights` that is neither the same shape as parameter `arr` nor a length-0 tensor. A fix is included in TensorFlow 2.12.0 and 2.11.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: https://github.com/tensorflow/tensorflow/commit/8ae76cf085f4be26295d2ecf2081e759e04b8acf; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7x4v-9gxg-9hwj; https://github.com/tensorflow/tensorflow/commit/8ae76cf085f4be26295d2ecf2081e759e04b8acf
CVE: CVE-2023-25676
Published: 2023-03-25
Description: TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.ParallelConcat` segfaults with a nullptr dereference when given a parameter `shape` with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/tensorflow/tensorflow/commit/da66bc6d5ff466aee084f9e7397980a24890cd15; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6wfh-89q8-44jq; https://github.com/tensorflow/tensorflow/commit/da66bc6d5ff466aee084f9e7397980a24890cd15
CVE: CVE-2023-25801
Published: 2023-03-25
Description: TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.
CVSS Score: 8.0 (HIGH)
CWE: CWE-415
References: https://github.com/tensorflow/tensorflow/commit/ee50d1e00f81f62a4517453f721c634bbb478307; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f49c-87jh-g47q; https://github.com/tensorflow/tensorflow/commit/ee50d1e00f81f62a4517453f721c634bbb478307
CVE: CVE-2023-27579
Published: 2023-03-25
Description: TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5w96-866f-6rm8; https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa
CVE: CVE-2023-28437
Published: 2023-03-25
Description: Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds. 
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/dataease/dataease/issues/4795; https://github.com/dataease/dataease/releases/tag/v1.18.5; https://github.com/dataease/dataease/security/advisories/GHSA-7j7j-9rw6-3r56
CVE: CVE-2023-1629
Published: 2023-03-25
Description: A vulnerability classified as critical was found in JiangMin Antivirus 16.2.2022.418. Affected by this vulnerability is the function 0x222010 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224011.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://drive.google.com/file/d/1soMFXUAYkCttFDA_icry6q-irb2jdAxw/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1629; https://vuldb.com/?ctiid.224011
CVE: CVE-2023-1626
Published: 2023-03-25
Description: A vulnerability was found in Jianming Antivirus 16.2.2022.418. It has been declared as critical. This vulnerability affects unknown code in the library kvcore.sys of the component IoControlCode Handler. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224008.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://drive.google.com/file/d/1soMFXUAYkCttFDA_icry6q-irb2jdAxw/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/unassigned31; https://vuldb.com/?ctiid.224008
CVE: CVE-2023-1627
Published: 2023-03-25
Description: A vulnerability was found in Jianming Antivirus 16.2.2022.418. It has been rated as problematic. This issue affects some unknown processing in the library kvcore.sys of the component IoControlCode Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier VDB-224009 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1fQFw8ayQUFzJM2_4V-ld8CN8gvisVoiu/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/unassigned29; https://vuldb.com/?ctiid.224009
CVE: CVE-2023-1628
Published: 2023-03-25
Description: A vulnerability classified as problematic has been found in Jianming Antivirus 16.2.2022.418. Affected is an unknown function in the library kvcore.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. VDB-224010 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://drive.google.com/file/d/1Div9mElTdsluLrU2etziLYqmXcqQFj1j/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/unassigned30; https://vuldb.com/?ctiid.224010
CVE: CVE-2023-1630
Published: 2023-03-25
Description: A vulnerability, which was classified as problematic, has been found in JiangMin Antivirus 16.2.2022.418. Affected by this issue is the function 0x222000 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224012.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1fQFw8ayQUFzJM2_4V-ld8CN8gvisVoiu/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1630; https://vuldb.com/?ctiid.224012
CVE: CVE-2023-1631
Published: 2023-03-25
Description: A vulnerability, which was classified as problematic, was found in JiangMin Antivirus 16.2.2022.418. This affects the function 0x222010 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224013 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://drive.google.com/file/d/1Div9mElTdsluLrU2etziLYqmXcqQFj1j/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1631; https://vuldb.com/?ctiid.224013
CVE: CVE-2023-1632
Published: 2023-03-25
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Vendor identified that the vulnerability does not exist within the product, but merely with this particular on premise customer's implementation.
CVE: CVE-2015-10097
Published: 2023-03-25
Description: A vulnerability was found in grinnellplans-php up to 3.0. It has been declared as critical. Affected by this vulnerability is the function interface_disp_page/interface_disp_page of the file read.php. The manipulation leads to sql injection. The attack can be launched remotely. The identifier of the patch is 57e4409e19203a94495140ff1b5a697734d17cfb. It is recommended to apply a patch to fix this issue. The identifier VDB-223801 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/grinnellplans/grinnellplans-php/commit/57e4409e19203a94495140ff1b5a697734d17cfb; https://vuldb.com/?ctiid.223801; https://vuldb.com/?id.223801
CVE: CVE-2016-15030
Published: 2023-03-25
Description: A vulnerability classified as problematic has been found in Arno0x TwoFactorAuth. This affects an unknown part of the file login/login.php. The manipulation of the argument from leads to open redirect. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 8549ad3cf197095f783643e41333586d6a4d0e54. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-223803.
CVSS Score: 3.5 (LOW)
CWE: CWE-601, CWE-601
References: https://github.com/Arno0x/TwoFactorAuth/commit/8549ad3cf197095f783643e41333586d6a4d0e54; https://github.com/Arno0x/TwoFactorAuth/pull/3; https://vuldb.com/?ctiid.223803
CVE: CVE-2023-1634
Published: 2023-03-25
Description: A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md; https://vuldb.com/?ctiid.224016; https://vuldb.com/?id.224016
CVE: CVE-2023-1635
Published: 2023-03-25
Description: A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/BigTiger2020/2023/blob/main/XSS.md; https://vuldb.com/?ctiid.224017; https://vuldb.com/?id.224017
CVE: CVE-2023-1456
Published: 2023-03-25
Description: A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown processing of the component NAT Configuration Handler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-223301 was assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://vuldb.com/?ctiid.223301; https://vuldb.com/?id.223301; https://vuldb.com/?ctiid.223301
CVE: CVE-2023-1457
Published: 2023-03-25
Description: A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-223302 is the identifier assigned to this vulnerability. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://vuldb.com/?ctiid.223302; https://vuldb.com/?id.223302; https://vuldb.com/?ctiid.223302
CVE: CVE-2023-1458
Published: 2023-03-25
Description: A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknown functionality of the component OSPF Handler. The manipulation of the argument area leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-223303. NOTE: The vendor position is that post-authentication issues are not accepted as vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://vuldb.com/?ctiid.223303; https://vuldb.com/?id.223303; https://vuldb.com/?ctiid.223303
CVE: CVE-2023-28858
Published: 2023-03-26
Description: redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.
CVSS Score: 3.7 (LOW)
CWE: CWE-193
References: https://github.com/redis/redis-py/compare/v4.3.5...v4.3.6; https://github.com/redis/redis-py/compare/v4.4.2...v4.4.3; https://github.com/redis/redis-py/compare/v4.5.2...v4.5.3
CVE: CVE-2023-28859
Published: 2023-03-26
Description: redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-459
References: https://github.com/redis/redis-py/issues/2665; https://github.com/redis/redis-py/pull/2641; https://github.com/redis/redis-py/pull/2666
CVE: CVE-2023-1638
Published: 2023-03-26
Description: A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been rated as problematic. Affected by this issue is the function 0x8001E024/0x8001E040 in the library ImfRegistryFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-224018 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1_jYlCkQMNaUwGV5QJtyz4zhdTqaGCv6Z/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1638; https://vuldb.com/?ctiid.224018
CVE: CVE-2023-1639
Published: 2023-03-26
Description: A vulnerability classified as problematic has been found in IObit Malware Fighter 9.4.0.776. This affects the function 0x8001E04C in the library ImfRegistryFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224019.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://drive.google.com/file/d/1hWgHhboaekq4hGIj2kNgEI54rM-u_rvV/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1639; https://vuldb.com/?ctiid.224019
CVE: CVE-2023-26800
Published: 2023-03-26
Description: Ruijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upgradeConfirm function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/winmt/my-vuls/tree/main/RG-EW1200; https://github.com/winmt/my-vuls/tree/main/RG-EW1200
CVE: CVE-2023-26801
Published: 2023-03-26
Description: LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/winmt/my-vuls/tree/main/LB-LINK%20BL-AC1900%2C%20BL-WR9000%2C%20BL-X26%20and%20BL-LTE300%20Wireless%20Routers; https://www.akamai.com/blog/security-research/cve-2023-26801-exploited-spreading-mirai-botnet; https://github.com/winmt/my-vuls/tree/main/LB-LINK%20BL-AC1900%2C%20BL-WR9000%2C%20BL-X26%20and%20BL-LTE300%20Wireless%20Routers
CVE: CVE-2023-26802
Published: 2023-03-26
Description: An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/winmt/my-vuls/tree/main/DCN%20DCBI-Netlog-LAB; https://github.com/winmt/my-vuls/tree/main/DCN%20DCBI-Netlog-LAB