deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-40476
Published: 2024-05-03
Description: GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of H265 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21768.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://gstreamer.freedesktop.org/security/sa-2023-0008.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1458/; https://gstreamer.freedesktop.org/security/sa-2023-0008.html
CVE: CVE-2023-40477
Published: 2024-05-03
Description: RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa; https://www.zerodayinitiative.com/advisories/ZDI-23-1152/; https://lists.debian.org/debian-lts-announce/2023/11/msg00009.html
CVE: CVE-2023-40478
Published: 2024-05-03
Description: NETGEAR RAX30 Telnet CLI passwd Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the telnet CLI service, which listens on TCP port 23. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20009.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://kb.netgear.com/000065649/Security-Advisory-for-Post-authentication-Buffer-Overflow-on-the-RAX30-PSV-2023-0002; https://www.zerodayinitiative.com/advisories/ZDI-23-1163/; https://kb.netgear.com/000065649/Security-Advisory-for-Post-authentication-Buffer-Overflow-on-the-RAX30-PSV-2023-0002
CVE: CVE-2023-40479
Published: 2024-05-03
Description: NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UPnP service. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19704.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://kb.netgear.com/000065645/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0360-PSV-2022-0361; https://www.zerodayinitiative.com/advisories/ZDI-23-1161/; https://kb.netgear.com/000065645/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0360-PSV-2022-0361
CVE: CVE-2023-40480
Published: 2024-05-03
Description: NETGEAR RAX30 DHCP Server Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DHCP server. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19705.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://kb.netgear.com/000065645/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0360-PSV-2022-0361; https://www.zerodayinitiative.com/advisories/ZDI-23-1162/; https://kb.netgear.com/000065645/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0360-PSV-2022-0361
CVE: CVE-2023-40481
Published: 2024-05-03
Description: 7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SQFS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18589.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/; https://www.zerodayinitiative.com/advisories/ZDI-23-1164/; https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/
CVE: CVE-2023-40482
Published: 2024-05-03
Description: Maxon Cinema 4D SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21430.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1184/; https://www.zerodayinitiative.com/advisories/ZDI-23-1184/
CVE: CVE-2023-40483
Published: 2024-05-03
Description: Maxon Cinema 4D SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21431.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1185/; https://www.zerodayinitiative.com/advisories/ZDI-23-1185/
CVE: CVE-2023-40484
Published: 2024-05-03
Description: Maxon Cinema 4D SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21432.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1188/; https://www.zerodayinitiative.com/advisories/ZDI-23-1188/
CVE: CVE-2023-40485
Published: 2024-05-03
Description: Maxon Cinema 4D SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21433.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1187/; https://www.zerodayinitiative.com/advisories/ZDI-23-1187/
CVE: CVE-2023-40486
Published: 2024-05-03
Description: Maxon Cinema 4D SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21434.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1186/; https://www.zerodayinitiative.com/advisories/ZDI-23-1186/
CVE: CVE-2023-40487
Published: 2024-05-03
Description: Maxon Cinema 4D SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21435.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1192/; https://www.zerodayinitiative.com/advisories/ZDI-23-1192/
CVE: CVE-2023-40488
Published: 2024-05-03
Description: Maxon Cinema 4D SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21436.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1189/; https://www.zerodayinitiative.com/advisories/ZDI-23-1189/
CVE: CVE-2023-40489
Published: 2024-05-03
Description: Maxon Cinema 4D SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21437.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1193/; https://www.zerodayinitiative.com/advisories/ZDI-23-1193/
CVE: CVE-2023-40491
Published: 2024-05-03
Description: Maxon Cinema 4D SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21439.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1191/; https://www.zerodayinitiative.com/advisories/ZDI-23-1191/
CVE: CVE-2023-40492
Published: 2024-05-03
Description: LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the deleteCheckSession method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM.
. Was ZDI-CAN-19919.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1198/; https://www.zerodayinitiative.com/advisories/ZDI-23-1198/
CVE: CVE-2023-40493
Published: 2024-05-03
Description: LG Simple Editor copySessionFolder Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the copySessionFolder command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19920.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1199/; https://www.zerodayinitiative.com/advisories/ZDI-23-1199/
CVE: CVE-2023-40494
Published: 2024-05-03
Description: LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the deleteFolder method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM.
. Was ZDI-CAN-19921.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1200/; https://www.zerodayinitiative.com/advisories/ZDI-23-1200/
CVE: CVE-2023-40495
Published: 2024-05-03
Description: LG Simple Editor copyTemplateAll Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the copyTemplateAll method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
. Was ZDI-CAN-19922.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1201/; https://www.zerodayinitiative.com/advisories/ZDI-23-1201/
CVE: CVE-2023-40496
Published: 2024-05-03
Description: LG Simple Editor copyStickerContent Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the copyStickerContent command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
. Was ZDI-CAN-19923.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1202/; https://www.zerodayinitiative.com/advisories/ZDI-23-1202/
CVE: CVE-2023-40497
Published: 2024-05-03
Description: LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the saveXml command implemented in the makeDetailContent method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19924.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1203/; https://www.zerodayinitiative.com/advisories/ZDI-23-1203/
CVE: CVE-2023-40498
Published: 2024-05-03
Description: LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the cp command implemented in the makeDetailContent method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19925.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1204/; https://www.zerodayinitiative.com/advisories/ZDI-23-1204/
CVE: CVE-2023-40499
Published: 2024-05-03
Description: LG Simple Editor mkdir Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the mkdir command implemented in the makeDetailContent method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM.
. Was ZDI-CAN-19926.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1205/; https://www.zerodayinitiative.com/advisories/ZDI-23-1205/
CVE: CVE-2023-40500
Published: 2024-05-03
Description: LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the copyContent command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19944.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1206/; https://www.zerodayinitiative.com/advisories/ZDI-23-1206/
CVE: CVE-2023-40501
Published: 2024-05-03
Description: LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the copyContent command. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19945.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1217/; https://www.zerodayinitiative.com/advisories/ZDI-23-1217/
CVE: CVE-2023-40502
Published: 2024-05-03
Description: LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the cropImage command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM.
. Was ZDI-CAN-19951.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1194/; https://www.zerodayinitiative.com/advisories/ZDI-23-1194/
CVE: CVE-2023-40503
Published: 2024-05-03
Description: LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the saveXmlFile method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
. Was ZDI-CAN-19952.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1207/; https://www.zerodayinitiative.com/advisories/ZDI-23-1207/
CVE: CVE-2023-40504
Published: 2024-05-03
Description: LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the readVideoInfo method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19953.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1208/; https://www.zerodayinitiative.com/advisories/ZDI-23-1208/