deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-42431
Published: 2023-03-29
Description: This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the bcmdhd driver. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-17544.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1407/; https://www.zerodayinitiative.com/advisories/ZDI-22-1407/
CVE: CVE-2022-42432
Published: 2023-03-29
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval function. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-18540.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-457
References: https://patchwork.ozlabs.org/project/netfilter-devel/patch/[PII_REDACTED]2[PII_REDACTED]-1-pablo%40netfilter.org/; https://www.zerodayinitiative.com/advisories/ZDI-22-1457/; https://patchwork.ozlabs.org/project/netfilter-devel/patch/[PII_REDACTED]2[PII_REDACTED]-1-pablo%40netfilter.org/
CVE: CVE-2022-42433
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841N(US)_V14_220121 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ated_tp service. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17356.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1466/; https://www.zerodayinitiative.com/advisories/ZDI-22-1466/
CVE: CVE-2022-43608
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BJNP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16032.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.psirt.canon/advisory-information/cve-2022-43608_20221125; https://www.zerodayinitiative.com/advisories/ZDI-22-1666/; https://www.psirt.canon/advisory-information/cve-2022-43608_20221125
CVE: CVE-2022-43609
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of IronCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of STP files. When parsing the VECTOR element, the process does not properly initialize a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17672.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1467/; https://www.zerodayinitiative.com/advisories/ZDI-22-1467/
CVE: CVE-2022-43610
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16350.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1468/; https://www.zerodayinitiative.com/advisories/ZDI-22-1468/
CVE: CVE-2022-43611
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16351.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1469/; https://www.zerodayinitiative.com/advisories/ZDI-22-1469/
CVE: CVE-2022-43612
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16355.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1470/; https://www.zerodayinitiative.com/advisories/ZDI-22-1470/
CVE: CVE-2022-43613
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. When parsing CGM files, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16356.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1471/; https://www.zerodayinitiative.com/advisories/ZDI-22-1471/
CVE: CVE-2022-43614
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16357.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1472/; https://www.zerodayinitiative.com/advisories/ZDI-22-1472/
CVE: CVE-2022-43615
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16370.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1473/; https://www.zerodayinitiative.com/advisories/ZDI-22-1473/
CVE: CVE-2022-43616
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16371.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1474/; https://www.zerodayinitiative.com/advisories/ZDI-22-1474/
CVE: CVE-2022-43617
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PCX files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16372.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1475/; https://www.zerodayinitiative.com/advisories/ZDI-22-1475/
CVE: CVE-2022-43618
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PCX files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16377.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1476/; https://www.zerodayinitiative.com/advisories/ZDI-22-1476/
CVE: CVE-2022-43619
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of ConfigFileUpload requests to the web management portal. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16141.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134, CWE-134
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1493/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43620
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-16142.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1494/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43621
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from an incorrectly implemented comparison. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-16152.
CVSS Score: 8.8 (HIGH)
CWE: CWE-697
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1503/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43622
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Login requests to the web management portal. When parsing the HNAP_AUTH header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16139.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1491/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43623
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetWebFilterSetting requests to the web management portal. When parsing the WebFilterURLs element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16140.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1492/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43624
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetStaticRouteIPv6Settings requests to the web management portal. When parsing subelements within the StaticRouteIPv6List element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16145.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1496/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43625
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetStaticRouteIPv4Settings requests to the web management portal. When parsing the NetMask element, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16144.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1495/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43626
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetIPv4FirewallSettings requests to the web management portal. When parsing subelements within the IPv4FirewallRule element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16146.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1497/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43627
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetStaticRouteIPv4Settings requests to the web management portal. When parsing subelements within the StaticRouteIPv4Data element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16147.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1498/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43628
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetIPv6FirewallSettings requests to the web management portal. When parsing subelements within the IPv6FirewallRule element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16148.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1499/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43629
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetSysEmailSettings requests to the web management portal. When parsing subelements within the SetSysEmailSettings element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16149.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1500/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43630
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of http requests to the web management portal. When parsing the SOAPAction header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16150.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1501/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
CVE: CVE-2022-43631
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetVirtualServerSettings requests to the web management portal. When parsing subelements within the VirtualServerInfo element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16151.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310; https://www.zerodayinitiative.com/advisories/ZDI-22-1502/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310