deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-42122
Published: 2024-05-03
Description: Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the cwpsrv process, which listens on the loopback interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-21079.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1479/; https://www.zerodayinitiative.com/advisories/ZDI-23-1479/
CVE: CVE-2023-42123
Published: 2024-05-03
Description: Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.

The specific flaw exists within the mysql_manager module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21080.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1476/; https://www.zerodayinitiative.com/advisories/ZDI-23-1476/
CVE: CVE-2023-42124
Published: 2024-05-03
Description: Avast Premium Security Sandbox Protection Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Premium Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the implementation of the sandbox feature. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code outside the sandbox at medium integrity.
. Was ZDI-CAN-20178.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1474/; https://www.zerodayinitiative.com/advisories/ZDI-23-1474/
CVE: CVE-2023-42125
Published: 2024-05-03
Description: Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Premium Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the implementation of the sandbox feature. By creating a symbolic link, an attacker can abuse the service to create arbitrary namespace objects. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
. Was ZDI-CAN-20383.
CVSS Score: 7.8 (HIGH)
CWE: CWE-706, CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1475/; https://www.zerodayinitiative.com/advisories/ZDI-23-1475/
CVE: CVE-2023-42126
Published: 2024-05-03
Description: G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G Data Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the GDBackupSvc service. By creating a symbolic link, an attacker can abuse the service to create a file with a permissive DACL. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-20694.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1493/; https://www.zerodayinitiative.com/advisories/ZDI-23-1493/
CVE: CVE-2023-42127
Published: 2024-05-03
Description: Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21585.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1536/; https://www.zerodayinitiative.com/advisories/ZDI-23-1536/
CVE: CVE-2023-42128
Published: 2024-05-03
Description: Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must acquire data from a malicious mobile device.

The specific flaw exists within the Android device image acquisition functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21255.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-77
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1533/; https://www.zerodayinitiative.com/advisories/ZDI-23-1533/
CVE: CVE-2023-42129
Published: 2024-05-03
Description: A10 Thunder ADC ShowTechDownloadView Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability.

The specific flaw exists within the ShowTechDownloadView class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account.
. Was ZDI-CAN-17899.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://support.a10networks.com/support/security_advisory/a10-acos-file-access-vulnerability/; https://www.zerodayinitiative.com/advisories/ZDI-23-1495/; https://support.a10networks.com/support/security_advisory/a10-acos-file-access-vulnerability/
CVE: CVE-2023-42130
Published: 2024-05-03
Description: A10 Thunder ADC FileMgmtExport Directory Traversal Arbitrary File Read and Deletion Vulnerability. This vulnerability allows remote attackers to read and delete arbitrary files on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability.

The specific flaw exists within the FileMgmtExport class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to read and delete files in the context of the service account.
. Was ZDI-CAN-17905.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://support.a10networks.com/support/security_advisory/a10-acos-file-access-vulnerability/; https://www.zerodayinitiative.com/advisories/ZDI-23-1496/; https://support.a10networks.com/support/security_advisory/a10-acos-file-access-vulnerability/
CVE: CVE-2023-42131
Published: 2024-05-03
Description: Ansys SpaceClaim X_B File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-17827.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1498/; https://www.zerodayinitiative.com/advisories/ZDI-23-1498/
CVE: CVE-2023-44403
Published: 2024-05-03
Description: D-Link DAP-1325 HNAP SetWLanRadioSettings Channel Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18822.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1501/; https://www.zerodayinitiative.com/advisories/ZDI-23-1501/
CVE: CVE-2023-44404
Published: 2024-05-03
Description: D-Link DAP-1325 get_value_from_app Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18823.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1502/; https://www.zerodayinitiative.com/advisories/ZDI-23-1502/
CVE: CVE-2023-44405
Published: 2024-05-03
Description: D-Link DAP-1325 get_value_of_key Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18824.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1503/; https://www.zerodayinitiative.com/advisories/ZDI-23-1503/
CVE: CVE-2023-44406
Published: 2024-05-03
Description: D-Link DAP-1325 SetAPLanSettings DeviceName Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18825.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1504/; https://www.zerodayinitiative.com/advisories/ZDI-23-1504/
CVE: CVE-2023-44407
Published: 2024-05-03
Description: D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18826.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1505/; https://www.zerodayinitiative.com/advisories/ZDI-23-1505/
CVE: CVE-2023-44408
Published: 2024-05-03
Description: D-Link DAP-1325 SetAPLanSettings IPAddr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18827.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1506/; https://www.zerodayinitiative.com/advisories/ZDI-23-1506/
CVE: CVE-2023-44409
Published: 2024-05-03
Description: D-Link DAP-1325 SetSetupWizardStatus Enabled Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18838.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1507/; https://www.zerodayinitiative.com/advisories/ZDI-23-1507/
CVE: CVE-2023-44410
Published: 2024-05-03
Description: D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.

The specific flaw exists within the showUsers method. The issue results from the lack of proper authorization before accessing a privileged endpoint. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.
. Was ZDI-CAN-19535.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1508/; https://www.zerodayinitiative.com/advisories/ZDI-23-1508/
CVE: CVE-2023-44411
Published: 2024-05-03
Description: D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the InstallApplication class. The class contains a hard-coded password for the remotely reachable database. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19553.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1509/; https://www.zerodayinitiative.com/advisories/ZDI-23-1509/
CVE: CVE-2023-44412
Published: 2024-05-03
Description: D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the addDv7Probe function. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-19571.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1510/; https://www.zerodayinitiative.com/advisories/ZDI-23-1510/
CVE: CVE-2023-44413
Published: 2024-05-03
Description: D-Link D-View shutdown_coreserver Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the shutdown_coreserver action. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-19572.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1511/; https://www.zerodayinitiative.com/advisories/ZDI-23-1511/
CVE: CVE-2023-44414
Published: 2024-05-03
Description: D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the coreservice_action_script action. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19573.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1512/; https://www.zerodayinitiative.com/advisories/ZDI-23-1512/
CVE: CVE-2023-44415
Published: 2024-05-03
Description: D-Link Multiple Routers cli Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1260 and DIR-2150 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the CLI service, which listens on TCP port 23. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-19946.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1513/; https://www.zerodayinitiative.com/advisories/ZDI-23-1513/
CVE: CVE-2023-44416
Published: 2024-05-03
Description: D-Link DAP-2622 Telnet CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622. Authentication is required to exploit this vulnerability.

The specific flaw exists within the CLI service, which listens on TCP port 23. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20051.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1514/; https://www.zerodayinitiative.com/advisories/ZDI-23-1514/
CVE: CVE-2023-44417
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set IPv4 Address Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20091.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1515/; https://www.zerodayinitiative.com/advisories/ZDI-23-1515/
CVE: CVE-2023-44418
Published: 2024-05-03
Description: D-Link DIR-X3260 Prog.cgi Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver. The issue results from the lack of proper validation of the length an user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20727.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1516/; https://www.zerodayinitiative.com/advisories/ZDI-23-1516/
CVE: CVE-2023-44419
Published: 2024-05-03
Description: D-Link DIR-X3260 Prog.cgi Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver. The issue results from the lack of proper validation of the length an user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20774.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1517/; https://www.zerodayinitiative.com/advisories/ZDI-23-1517/
CVE: CVE-2023-44420
Published: 2024-05-03
Description: D-Link DIR-X3260 prog.cgi Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-X3260 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the prog.cgi executable. The issue results from an incorrect implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the device. Was ZDI-CAN-21100.
CVSS Score: 8.8 (HIGH)
CWE: CWE-303
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1518/; https://www.zerodayinitiative.com/advisories/ZDI-23-1518/