rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-0580 Information Disclosure vulnerability in My Control System (on-premise)
Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application.
Of the services that make up the My Control System (on-premise) application, the following ones are affected by this vulnerability:
User Interface
System Monitoring1
Asset Inventory




This issue affects My Control System (on-premise): from 5.0;0 through 5.13.


Problem types: cwe_id: CWE-922
description: CWE-922 Insecure Storage of Sensitive Information
Affected products: vendor: ABB
product: My Control System (on-premise)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-04-06T16:19:51.149Z
CVE-2023-0581 PrivateContent  <= 8.4.3 - Protection Mechanism Bypass
The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it possible for unauthenticated attackers to bypass any login restrictions  that may prevent a brute force attack.
Problem types: cwe_id: CWE-602
description: CWE-602 Client-Side Enforcement of Server-Side Security
Affected products: vendor: LCWeb
product: PrivateContent
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Riccardo Granata
Published: 2023-01-30T14:06:27.936Z
CVE-2023-0582 Path Traversal in ForgeRock Access Managment
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass.

This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: forgerock
product: access management
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-03-27T17:09:43.769Z
CVE-2023-0583 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: vektor-inc
product: VK Blocks
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Ramuel Gall
Published: 2023-06-03T01:59:27.897Z
CVE-2023-0584 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_font_awesome_version' option to an arbitrary value.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: vektor-inc
product: VK Blocks
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Ramuel Gall
Published: 2023-06-03T01:59:28.995Z
CVE-2023-0585 All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: smub
product: All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 4.4
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
lang: en
value: Ivan Kuzymchak
Published: 2023-02-24T14:46:43.084Z
CVE-2023-0586 All in One SEO Pack  <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: smub
product: All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Ivan Kuzymchak
Published: 2023-02-24T14:47:02.730Z
CVE-2023-0587 
A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \PCCSRV\TEMP\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.
Problem types: description: File Upload Vulnerability
Affected products: vendor: n/a
product: Trend Micro Apex One
Published: 2023-02-01T00:00:00.000Z
CVE-2023-0588 Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Catalyst Connect Zoho CRM Client Portal
default_status: unaffected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2023-06-27T13:17:24.246Z
CVE-2023-0589 WP Image Carousel <= 1.0.2 - Contributor+ Stored XSS
The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Image Carousel
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-27T15:37:39.286Z
CVE-2023-0590 
A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: Kernel
Published: 2023-03-23T00:00:00.000Z
CVE-2023-0591 Path Traversal in ubi_reader

ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory).

This is due to the fact that a node name (dent_node.name) is considered trusted and joined to the extraction directory path during processing, then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g. ../../tmp/outside.txt), it's possible to force ubi_reader to write outside of the extraction directory.



This issue affects ubi-reader before 0.8.5.


Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor:  jrspruitt
product: ubi_reader
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Quentin Kaiser from ONEKEY Research Labs
lang: en
value: Jason Pruitt
Published: 2023-01-31T09:18:07.998Z
CVE-2023-0592 Path traversal in jefferson
A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.


Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: sviehb
product: jefferson
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Quentin Kaiser from ONEKEY Research Labs
lang: en
value: Stefan Viehböck
Published: 2023-01-31T09:25:10.019Z
CVE-2023-0593 Path traversal in yaffshiv
A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory.

This issue affects yaffshiv up to version 0.1 included, which is the most recent at time of publication.


Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: devttys0
product: yaffshiv
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Quentin Kaiser from ONEKEY Research Labs
Published: 2023-01-31T09:31:44.677Z
CVE-2023-0594 
Grafana is an open-source platform for monitoring and observability. 

Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. 

The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded.

An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. 

This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. 

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix. 


Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Grafana
product: Grafana
default_status: unaffected
vendor: Grafana
product: Grafana Enterprise
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2023-03-01T15:36:43.881Z
CVE-2023-0595 
A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server's database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA (All Versions)


Problem types: cwe_id: CWE-117
description: CWE-117 Improper Output Neutralization for Logs
Affected products: vendor: Schneider Electric
product: EcoStruxure Geo SCADA Expert 2019
default_status: unaffected
vendor: Schneider Electric
product: EcoStruxure Geo SCADA Expert 2020
default_status: unaffected
vendor: Schneider Electric
product: EcoStruxure Geo SCADA Expert 2021
default_status: unaffected
vendor: Schneider Electric
product: ClearSCADA 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-02-24T00:00:00.000Z
CVE-2023-0597 
A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Kernel
Published: 2023-02-23T00:00:00.000Z
CVE-2023-0598 GE Digital Proficy Code Injection

GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software. 


Problem types: cwe_id: CWE-94
description: CWE-94 Code Injection
Affected products: vendor: GE Digital 
product: Proficy iFIX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported this vulnerability to CISA. 
Published: 2023-03-16T19:13:52.427Z
CVE-2023-0599 Rapid7 Metasploit Pro Stored XSS
Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization.  Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another Metasploit Pro user using a specially crafted request. Note that in most deployments, all Metasploit Pro users tend to enjoy privileges equivalent to local administrator.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Rapid7
product: Metasploit Pro
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Michael Caruso
Published: 2023-02-01T22:13:54.609Z
CVE-2023-0600 WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Visitor Statistics (Real Time Traffic)
default_status: unaffected
Credits: lang: en
value: Trần Quốc Trường An
lang: en
value: WPScan
Published: 2023-05-15T12:15:31.686Z
CVE-2023-0602 Twittee Text Tweet <= 1.0.8 - Reflected XSS
The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Twittee Text Tweet
default_status: affected
Credits: lang: en
value: Shreya Pohekar
lang: en
value: WPScan
Published: 2023-07-31T09:37:33.393Z
CVE-2023-0603 Sloth Logo Customizer <= 2.0.2 - Stored XSS via CSRF
The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Sloth Logo Customizer
default_status: affected
Credits: lang: en
value: Nithissh Sathish
lang: en
value: WPScan
Published: 2023-05-08T13:58:23.850Z
CVE-2023-0604 WP Food Manager < 1.0.4 - Admin+ Stored XSS
The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Food Manager
default_status: unaffected
Credits: lang: en
value: Nithissh Sathish
lang: en
value: WPScan
Published: 2023-08-07T14:31:24.845Z
CVE-2023-0605 Auto Rename Media On Upload < 1.1.0 - Admin+ Stored XSS
The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Auto Rename Media On Upload
default_status: unaffected
Credits: lang: en
value: caoyebo
lang: en
value: WPScan
Published: 2023-04-10T13:17:57.330Z
CVE-2023-0606 Cross-site Scripting (XSS) - Reflected in ampache/ampache
Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ampache
product: ampache/ampache
Published: 2023-02-01T00:00:00.000Z
CVE-2023-0607 Cross-site Scripting (XSS) - Stored in projectsend/projectsend
Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: projectsend
product: projectsend/projectsend
Published: 2023-02-01T00:00:00.000Z
CVE-2023-0608 Cross-site Scripting (XSS) - DOM in microweber/microweber
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2023-02-01T00:00:00.000Z
CVE-2023-0609 Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wallabag
product: wallabag/wallabag
Published: 2023-02-01T00:00:00.000Z
CVE-2023-0610 Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wallabag
product: wallabag/wallabag
Published: 2023-02-01T00:00:00.000Z
CVE-2023-0611 TRENDnet TEW-652BRP Web Management Interface get_set.ccp command injection
A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219935.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: TRENDnet
product: TEW-652BRP
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseSeverity: HIGH
Credits: lang: en
value: leetsun (VulDB User)
Published: 2023-02-01T13:24:46.450Z
CVE-2023-0612 TRENDnet TEW-811DRU httpd basic.asp buffer overflow
A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219936.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: TRENDnet
product: TEW-811DRU
CVSS v3.1: version: 3.1
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseSeverity: HIGH
Credits: lang: en
value: leetsun (VulDB User)
Published: 2023-02-01T13:31:58.232Z
CVE-2023-0613 TRENDnet TEW-811DRU httpd security.asp memory corruption
A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /wireless/security.asp of the component httpd. The manipulation leads to memory corruption. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219937 was assigned to this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: TRENDnet
product: TEW-811DRU
CVSS v3.1: version: 3.1
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseSeverity: HIGH
Credits: lang: en
value: leetsun (VulDB User)
Published: 2023-02-01T13:40:15.988Z
CVE-2023-0614 
The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Samba
Published: 2023-04-03T00:00:00.000Z