deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-35756
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set Date-Time Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20084.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1261/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37310
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set Device Info Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20087.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1264/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37311
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set Device Info Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20088.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1265/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37312
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set Device Info Device Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20089.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1266/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37313
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set IPv4 Address Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20090.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1267/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37314
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set IPv6 Address Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20092.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1268/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37315
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set IPv6 Address Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20093.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1269/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37316
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set IPv6 Address Default Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20094.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1270/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37317
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set IPv6 Address Primary DNS Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20095.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1271/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37318
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set IPv6 Address Secondary DNS Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20096.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1272/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37319
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20097.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1273/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37320
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set SSID List SSID Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20098.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1274/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37321
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set SSID List RADIUS Secret Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20099.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1275/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37322
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set SSID List RADIUS Server Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20100.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1276/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37323
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set SSID List PSK Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20101.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1277/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37324
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set Wireless Info Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20102.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1278/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37326
Published: 2024-05-03
Description: D-Link DAP-2622 DDP Set Wireless Info Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20103.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349; https://www.zerodayinitiative.com/advisories/ZDI-23-1279/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
CVE: CVE-2023-37327
Published: 2024-05-03
Description: GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of FLAC audio files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20775.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://gstreamer.freedesktop.org/security/sa-2023-0001.html; https://www.zerodayinitiative.com/advisories/ZDI-23-903/; https://gstreamer.freedesktop.org/security/sa-2023-0001.html
CVE: CVE-2023-37328
Published: 2024-05-03
Description: GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20994.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://gstreamer.freedesktop.org/security/sa-2023-0003.html; https://www.zerodayinitiative.com/advisories/ZDI-23-901/; https://gstreamer.freedesktop.org/security/sa-2023-0003.html
CVE: CVE-2023-37329
Published: 2024-05-03
Description: GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of SRT subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20968.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://gstreamer.freedesktop.org/security/sa-2023-0002.html; https://www.zerodayinitiative.com/advisories/ZDI-23-902/; https://gstreamer.freedesktop.org/security/sa-2023-0002.html
CVE: CVE-2023-37330
Published: 2024-05-03
Description: Kofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the exportAsText method. The application exposes a JavaScript interface that allows the attacker to write arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-20230.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-925/; https://www.zerodayinitiative.com/advisories/ZDI-23-925/
CVE: CVE-2023-37331
Published: 2024-05-03
Description: Kofax Power PDF GIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20373.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-926/; https://www.zerodayinitiative.com/advisories/ZDI-23-926/
CVE: CVE-2023-37332
Published: 2024-05-03
Description: Kofax Power PDF PNG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20388.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.zerodayinitiative.com/advisories/ZDI-23-927/; https://www.zerodayinitiative.com/advisories/ZDI-23-927/
CVE: CVE-2023-37333
Published: 2024-05-03
Description: Kofax Power PDF PCX File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PCX files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20389.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.zerodayinitiative.com/advisories/ZDI-23-928/; https://www.zerodayinitiative.com/advisories/ZDI-23-928/
CVE: CVE-2023-37334
Published: 2024-05-03
Description: Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20390.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-929/; https://www.zerodayinitiative.com/advisories/ZDI-23-929/
CVE: CVE-2023-37335
Published: 2024-05-03
Description: Kofax Power PDF BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20391.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-23-930/; https://www.zerodayinitiative.com/advisories/ZDI-23-930/