deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-50207
Published: 2024-05-03
Description: D-Link G416 flupl filename Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21300.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1823/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50208
Published: 2024-05-03
Description: D-Link G416 ovpncfg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21441.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1824/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50209
Published: 2024-05-03
Description: D-Link G416 cfgsave Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21442.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1825/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50210
Published: 2024-05-03
Description: D-Link G416 httpd API-AUTH Digest Processing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21662.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1826/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50211
Published: 2024-05-03
Description: D-Link G416 httpd API-AUTH Timestamp Processing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21663.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1827/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50212
Published: 2024-05-03
Description: D-Link G416 httpd Improper Handling of Exceptional Conditions Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper handling of error conditions. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-21664.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1828/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50213
Published: 2024-05-03
Description: D-Link G416 nodered File Handling Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21807.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1829/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50214
Published: 2024-05-03
Description: D-Link G416 nodered tar File Handling Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21808.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1830/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50215
Published: 2024-05-03
Description: D-Link G416 nodered gz File Handling Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21809.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1831/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50216
Published: 2024-05-03
Description: D-Link G416 awsfile tar File Handling Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21810.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1832/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50217
Published: 2024-05-03
Description: D-Link G416 awsfile rm Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21811.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367; https://www.zerodayinitiative.com/advisories/ZDI-23-1833/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367
CVE: CVE-2023-50218
Published: 2024-05-03
Description: Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.

The specific flaw exists within the ModuleInvoke class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21624.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b; https://www.zerodayinitiative.com/advisories/ZDI-23-1813/; https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b
CVE: CVE-2023-50219
Published: 2024-05-03
Description: Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.

The specific flaw exists within the RunQuery class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21625.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b; https://www.zerodayinitiative.com/advisories/ZDI-24-014/; https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b
CVE: CVE-2023-50220
Published: 2024-05-03
Description: Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.

The specific flaw exists within the Base64Element class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21801.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b; https://www.zerodayinitiative.com/advisories/ZDI-24-015/; https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b
CVE: CVE-2023-50221
Published: 2024-05-03
Description: Inductive Automation Ignition ResponseParser SerializedResponse Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server.

The specific flaw exists within the ResponseParser method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21926.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b; https://www.zerodayinitiative.com/advisories/ZDI-24-016/; https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b
CVE: CVE-2023-50222
Published: 2024-05-03
Description: Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server.

The specific flaw exists within the ResponseParser method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22067.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b; https://www.zerodayinitiative.com/advisories/ZDI-24-017/; https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b
CVE: CVE-2023-50223
Published: 2024-05-03
Description: Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.

The specific flaw exists within the ExtendedDocumentCodec class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22127.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b; https://www.zerodayinitiative.com/advisories/ZDI-24-018/; https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b[PII_REDACTED]49c5b
CVE: CVE-2023-50224
Published: 2024-05-03
Description: TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
. Was ZDI-CAN-19899.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware; https://www.zerodayinitiative.com/advisories/ZDI-23-1808/; https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware
CVE: CVE-2023-50225
Published: 2024-05-03
Description: TP-Link TL-WR902AC dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR902AC routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the libcmm.so module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-21819.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121
References: https://www.tp-link.com/ca/support/download/tl-wr902ac/v3/#Firmware; https://www.zerodayinitiative.com/advisories/ZDI-23-1809/; https://www.tp-link.com/ca/support/download/tl-wr902ac/v3/#Firmware
CVE: CVE-2023-50226
Published: 2024-05-03
Description: Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Updater service. By creating a symbolic link, an attacker can abuse the service to move arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
. Was ZDI-CAN-21227.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-1805/; https://kb.parallels.com/en/125013
CVE: CVE-2023-50227
Published: 2024-05-03
Description: Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Parallels Desktop. User interaction is required to exploit this vulnerability in that the target in a guest system must visit a malicious page or open a malicious file.

The specific flaw exists within the virtio-gpu virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the hypervisor.
. Was ZDI-CAN-21260.
CVSS Score: 8.3 (HIGH)
CWE: CWE-787
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-1804/; https://kb.parallels.com/en/125013
CVE: CVE-2023-50228
Published: 2024-05-03
Description: Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Updater service. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
. Was ZDI-CAN-21817.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-1803/; https://kb.parallels.com/en/125013
CVE: CVE-2023-50229
Published: 2024-05-03
Description: BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20936.
CVSS Score: 8.0 (HIGH)
CWE: CWE-122
References: https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a[PII_REDACTED]; https://www.zerodayinitiative.com/advisories/ZDI-23-1811/; https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a[PII_REDACTED]
CVE: CVE-2023-50230
Published: 2024-05-03
Description: BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20938.
CVSS Score: 8.0 (HIGH)
CWE: CWE-122
References: https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a[PII_REDACTED]; https://www.zerodayinitiative.com/advisories/ZDI-23-1812/; https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a[PII_REDACTED]
CVE: CVE-2023-50231
Published: 2024-05-03
Description: NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Minimal user interaction is required to exploit this vulnerability. 

The specific flaw exists within the saveNodeLabel method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-21838.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://kb.netgear.com/000065901/Security-Advisory-for-Stored-Cross-Site-Scripting-on-the-NMS300-PSV-2023-0106; https://www.zerodayinitiative.com/advisories/ZDI-23-1847/; https://kb.netgear.com/000065901/Security-Advisory-for-Stored-Cross-Site-Scripting-on-the-NMS300-PSV-2023-0106