deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39052
Published: 2023-09-20
Description: An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39052.md; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39052.md
CVE: CVE-2023-40930
Published: 2023-09-20
Description: An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/NSnidie/2af70d58426c4563b2f11171379fdd8c; https://gist.github.com/NSnidie/2af70d58426c4563b2f11171379fdd8c
CVE: CVE-2023-41484
Published: 2023-09-20
Description: An issue in cimg.eu Cimg Library v2.9.3 allows an attacker to obtain sensitive information via a crafted JPEG file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-401
References: https://github.com/eddieantonio/imgcat/issues/49; https://github.com/eddieantonio/imgcat/issues/49
CVE: CVE-2023-42147
Published: 2023-09-20
Description: An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.cnblogs.com/xyhz/p/17667095.html; https://www.cnblogs.com/xyhz/p/17667095.html
CVE: CVE-2023-42331
Published: 2023-09-20
Description: A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads.php component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Num-Nine/CVE/issues/2; https://github.com/Num-Nine/CVE/issues/4; https://github.com/Num-Nine/CVE/wiki/Any-file-is-uploaded-to-eliteCMS1.01
CVE: CVE-2023-42334
Published: 2023-09-20
Description: An Indirect Object Reference (IDOR) in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to escalate privileges via the user parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://0xhunter20.medium.com/an-idor-lead-to-viewing-other-users-files-cve-2023-42334-702de328c453; https://0xhunter20.medium.com/an-idor-lead-to-viewing-other-users-files-cve-2023-42334-702de328c453
CVE: CVE-2023-42335
Published: 2023-09-20
Description: Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to execute arbitrary code via the add attachment function in the New Expense component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://0xhunter20.medium.com/how-i-found-unrestricted-file-upload-in-fl3xx-ios-app-cve-2023-42335-6b1a72da6d65; https://0xhunter20.medium.com/how-i-found-unrestricted-file-upload-in-fl3xx-ios-app-cve-2023-42335-6b1a72da6d65
CVE: CVE-2023-43134
Published: 2023-09-20
Description: There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/7R4C4R/CVE/blob/main/Netis-360R-AC1200/unauthorized%20access/readme.md; https://github.com/7R4C4R/CVE/blob/main/Netis-360R-AC1200/unauthorized%20access/readme.md
CVE: CVE-2023-43137
Published: 2023-09-20
Description: TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule name parameter has injection points.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/command%20injection/01/command%20injection01.md; https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/command%20injection/01/command%20injection01.md
CVE: CVE-2023-43138
Published: 2023-09-20
Description: TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule name has an injection point.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/command%20injection/02/command%20injection02.md; https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/command%20injection/02/command%20injection02.md
CVE: CVE-2023-22024
Published: 2023-09-20
Description: In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESET and RDS6_CONN_RESET, that are not re-entrant.  A malicious local user with CAP_NET_ADMIN can use this to crash the kernel. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 5.5 (MEDIUM)
References: https://linux.oracle.com/cve/CVE-2023-22024.html; https://linux.oracle.com/cve/CVE-2023-22024.html
CVE: CVE-2023-38875
Published: 2023-09-20
Description: A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38875; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38875
CVE: CVE-2023-38876
Published: 2023-09-20
Description: A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' parameter in '/reset-password'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38876; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38876
CVE: CVE-2023-39677
Published: 2023-09-20
Description: MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://blog.sorcery.ie/posts/myprestamodules_phpinfo/; https://myprestamodules.com/; https://sorcery.ie
CVE: CVE-2023-42321
Published: 2023-09-20
Description: Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/ChubbyZ/cb4b8fd818846dec3e9d70863e7955bc; https://www.icmsdev.com/; https://gist.github.com/ChubbyZ/cb4b8fd818846dec3e9d70863e7955bc
CVE: CVE-2023-42322
Published: 2023-09-20
Description: Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://gist.github.com/ChubbyZ/0ddb9772231d9a8c5b5345883abcb0a6; https://www.icmsdev.com/; https://gist.github.com/ChubbyZ/0ddb9772231d9a8c5b5345883abcb0a6
CVE: CVE-2023-34575
Published: 2023-09-20
Description: SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontController::initContent() and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail() methods.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/09/19/opartsavecart.html; https://security.friendsofpresta.org/modules/2023/09/19/opartsavecart.html
CVE: CVE-2023-36109
Published: 2023-09-20
Description: Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_raw component at /jerry-core/ecma/base/ecma-helpers-string.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Limesss/CVE-2023-36109/tree/main; https://github.com/jerryscript-project/jerryscript/issues/5080; https://github.com/Limesss/CVE-2023-36109/tree/main
CVE: CVE-2023-36234
Published: 2023-09-20
Description: Cross Site Scripting (XSS) vulnerability in Netbox 3.5.1, allows attackers to execute arbitrary code via Name field in device-roles/add function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/gozan10/cve/issues/6; https://github.com/gozan10/cve/issues/6
CVE: CVE-2023-37279
Published: 2023-09-20
Description: Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-789, CWE-770
References: https://github.com/contribsys/faktory/security/advisories/GHSA-x4hh-vjm7-g2jv; https://github.com/contribsys/faktory/security/advisories/GHSA-x4hh-vjm7-g2jv
CVE: CVE-2023-39675
Published: 2023-09-20
Description: SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.sorcery.ie/posts/simpleimportproduct_sqli/; https://sorcery.ie; https://blog.sorcery.ie/posts/simpleimportproduct_sqli/
CVE: CVE-2023-43135
Published: 2023-09-20
Description: There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/unauthorized%20access/Unauthorized%20Access%20Vulnerability.md; https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/unauthorized%20access/Unauthorized%20Access%20Vulnerability.md
CVE: CVE-2015-5467
Published: 2023-09-21
Description: web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2-dev/CVE-2015-5467.yaml; https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix; https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2-dev/CVE-2015-5467.yaml
CVE: CVE-2015-8371
Published: 2023-09-21
Description: Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html; https://github.com/FriendsOfPHP/security-advisories/blob/e26be423c5bcfdb38478d2f92d1f928c15afb561/composer/composer/CVE-2015-8371.yaml; https://github.com/composer/composer
CVE: CVE-2018-5478
Published: 2023-09-21
Description: Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2018-5478.yaml; https://security.snyk.io/vuln/SNYK-PHP-CONTAOCORE-70397; https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2018-5478.yaml
CVE: CVE-2023-39252
Published: 2023-09-21
Description: 
Dell SCG Policy Manager 5.16.00.14  contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive information.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000217683/dsa-2023-321-security-update-for-dell-secure-connect-gateway-security-policy-manager-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000217683/dsa-2023-321-security-update-for-dell-secure-connect-gateway-security-policy-manager-vulnerabilities
CVE: CVE-2023-43669
Published: 2023-09-21
Description: The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
CVSS Score: 7.5 (HIGH)
References: https://bugzilla.redhat.com/show_bug.cgi?id=2240110; https://bugzilla.suse.com/show_bug.cgi?id=1215563; https://crates.io/crates/tungstenite/versions
CVE: CVE-2023-4152
Published: 2023-09-21
Description: Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS101 device.

CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://cert.vde.com/en/advisories/VDE-2023-038/; https://cert.vde.com/en/advisories/VDE-2023-038/
CVE: CVE-2023-4291
Published: 2023-09-21
Description: Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE) vulnerability via manipulated parameters of the web interface without authentication. This could lead to a full compromise of the FDS101 device.



CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cert.vde.com/en/advisories/VDE-2023-038; https://cert.vde.com/en/advisories/VDE-2023-038
CVE: CVE-2023-4292
Published: 2023-09-21
Description: Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a SQL injection vulnerability via manipulated parameters of the web interface without authentication. The database contains limited, non-critical log information.




CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://https://cert.vde.com/en/advisories/VDE-2023-038; https://https://cert.vde.com/en/advisories/VDE-2023-038
CVE: CVE-2023-4760
Published: 2023-09-21
Description: In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component.






The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept.

For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed.



CVSS Score: 7.6 (HIGH)
CWE: CWE-22, CWE-23, CWE-22
References: https://github.com/eclipse-rap/org.eclipse.rap/pull/141; https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/160; https://github.com/eclipse-rap/org.eclipse.rap/pull/141
CVE: CVE-2023-5104
Published: 2023-09-21
Description: Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/nocodb/nocodb/commit/db0385cb8aab2a34e233454607f59152ac62b3e2; https://huntr.dev/bounties/1b5c6d9f-941e-4dd7-a964-42b53d6826b0; https://github.com/nocodb/nocodb/commit/db0385cb8aab2a34e233454607f59152ac62b3e2
CVE: CVE-2023-4753
Published: 2023-09-21
Description: OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input.
CVSS Score: 3.9 (LOW)
CWE: CWE-20
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-11.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-11.md
CVE: CVE-2023-43235
Published: 2023-09-21
Description: D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/Dlink/823G/SetWifiDownSettings/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/peris-navince/founded-0-days/blob/main/Dlink/823G/SetWifiDownSettings/1.md
CVE: CVE-2023-43236
Published: 2023-09-21
Description: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter statuscheckpppoeuser in dir_setWanWifi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/dir_setWanWifi/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/dir_setWanWifi/1.md
CVE: CVE-2023-43237
Published: 2023-09-21
Description: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/setMAC/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/setMAC/1.md
CVE: CVE-2023-43238
Published: 2023-09-21
Description: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter nvmacaddr in form2Dhcpip.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/form2Dhcpip_cgi/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/form2Dhcpip_cgi/1.md
CVE: CVE-2023-43239
Published: 2023-09-21
Description: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag_5G in showMACfilterMAC.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/showMACfilterMAC/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/showMACfilterMAC/1.md
CVE: CVE-2023-43240
Published: 2023-09-21
Description: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/ipportFilter/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/ipportFilter/1.md
CVE: CVE-2023-43241
Published: 2023-09-21
Description: D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/Dlink/823G/SetWLanRadioSecurity/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/peris-navince/founded-0-days/blob/main/Dlink/823G/SetWLanRadioSecurity/1.md
CVE: CVE-2023-43242
Published: 2023-09-21
Description: D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter removeRuleList in form2IPQoSTcDel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/form2IPQoSTcDel/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/form2IPQoSTcDel/1.md
CVE: CVE-2023-43274
Published: 2023-09-21
Description: Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/PHP-Shopping-Cart-4.2; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/PHP-Shopping-Cart-4.2
CVE: CVE-2023-43309
Published: 2023-09-21
Description: There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/TishaManandhar/Webmin_xss_POC/blob/main/XSS; https://github.com/TishaManandhar/Webmin_xss_POC/blob/main/XSS
CVE: CVE-2023-43631
Published: 2023-09-21
Description: 
On boot, the Pillar eve container checks for the existence and content of
“/config/authorized_keys”.

If the file is present, and contains a supported public key, the container will go on to open
port 22 and enable sshd with the given keys as the authorized keys for root login.

An attacker could easily add their own keys and gain full control over the system without
triggering the “measured boot” mechanism implemented by EVE OS, and without marking
the device as “UUD” (“Unknown Update Detected”).

This is because the “/config” partition is not protected by “measured boot”, it is mutable, and
it is not encrypted in any way.




An attacker can gain full control over the device without changing the PCR values, thus not
triggering the “measured boot” mechanism, and having full access to the vault.



Note:

This issue was partially fixed in these commits (after disclosure to Zededa), where the config
partition measurement was added to PCR13:

• aa3501d6c57206ced222c33aea15a9169d629141

• 5fef4d92e75838cc78010edaed5247dfbdae1889.

This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522, CWE-922, CWE-522
References: https://asrg.io/security-advisories/cve-2023-43631/; https://asrg.io/security-advisories/cve-2023-43631/
CVE: CVE-2023-43632
Published: 2023-09-21
Description: 
As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port
8877 in EVE, exposing limited functionality of the TPM to the clients. 
VTPM allows clients to
execute tpm2-tools binaries from a list of hardcoded options”
The communication with this server is done using protobuf, and the data is comprised of 2
parts:

1. Header

2. Data

When a connection is made, the server is waiting for 4 bytes of data, which will be the header,
and these 4 bytes would be parsed as uint32 size of the actual data to come.

Then, in the function “handleRequest” this size is then used in order to allocate a payload on
the stack for the incoming data.

As this payload is allocated on the stack, this will allow overflowing the stack size allocated for
the relevant process with freely controlled data.

* An attacker can crash the system. 
* An attacker can gain control over the system, specifically on the “vtpm_server” process
which has very high privileges.



CVSS Score: 9.0 (CRITICAL)
CWE: CWE-789, CWE-770
References: https://asrg.io/security-advisories/cve-2023-43632/; https://asrg.io/security-advisories/cve-2023-43632/