rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-50949 IBM QRadar improper certificate validation
IBM QRadar SIEM 7.5 could allow an unauthorized user to perform unauthorized actions due to improper certificate validation.  IBM X-Force ID:  275706.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: IBM
product: QRadar SIEM
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2024-04-11T16:54:41.741Z
CVE-2023-50950 IBM QRadar information disclosure
IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules.  IBM X-Force ID:  275709.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: IBM
product: QRadar SIEM
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-01-17T17:08:30.053Z
CVE-2023-50951 IBM QRadar Suite information disclosure
IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts.  IBM X-Force ID:  275747.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: IBM
product: QRadar Suite Software
default_status: unaffected
vendor: IBM
product: Cloud Pak for Security
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-02-17T16:00:51.779Z
CVE-2023-50952 IBM InfoSphere Information Server server-side request forgery
IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.  IBM X-Force ID:  275774.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-06-30T18:06:11.581Z
CVE-2023-50953 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.  IBM X-Force ID:  275775.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-06-30T18:08:20.068Z
CVE-2023-50954 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system.  IBM X-Force ID:  275776.
Problem types: cwe_id: CWE-598
description: CWE-598 Information Exposure Through Query Strings in GET Request
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-06-30T16:40:59.263Z
CVE-2023-50955 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid in further attacks against the system.  IBM X-Force ID:  275777.
Problem types: cwe_id: CWE-36
description: CWE-36 Absolute Path Traversal
Affected products: vendor: IBM
product: InfoSphere Information Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 2.4
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-02-21T14:32:06.614Z
CVE-2023-50956 IBM Storage Defender - Resiliency Service information disclosure
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 

could allow a privileged user to obtain highly sensitive user credentials from secret keys that are stored in clear text.
Problem types: cwe_id: CWE-256
description: CWE-256 Plaintext Storage of a Password
Affected products: vendor: IBM
product: Storage Defender - Resiliency Service
cpes: cpe:2.3:a:ibm:storage_defender_resiliency_service:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:storage_defender_resiliency_service:2.0.9:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-12-18T15:24:57.948Z
CVE-2023-50957 IBM Storage Defender - Resiliency Service privilege escalation
IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key storage.  IBM X-Force ID:  275783.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: IBM
product: Storage Defender - Resiliency Service
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-02-10T15:30:55.922Z
CVE-2023-50959 IBM Cloud Pak for Business Automation information disclosure
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account.  IBM X-Force ID:  275938.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of System Data to an Unauthorized Control Sphere
Affected products: vendor: IBM
product: Cloud Pak for Business Automation
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-03-31T11:56:26.054Z
CVE-2023-50961 IBM QRadar cross-site scripting
IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  275939.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: QRadar SIEM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-03-27T12:35:40.175Z
CVE-2023-50962 IBM PowerSC information disclosure
IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism.  IBM X-Force ID:  276004.


Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: IBM
product: PowerSC
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-02-02T01:18:59.448Z
CVE-2023-50963 IBM Storage Defender HTTP HOST header injection
IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.  IBM X-Force ID:  276101.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: IBM
product: Storage Defender - Data Protect
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-01-19T01:30:49.594Z
CVE-2023-50964 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  276102.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-06-30T18:12:32.203Z
CVE-2023-50965 
In MicroHttpServer (aka Micro HTTP Server) through 4398570, _ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and potentially remote code execution via a long URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-17T00:00:00.000Z
CVE-2023-50966 
erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2023-50967 
latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2023-50968 Apache OFBiz: Arbitrary file properties reading and SSRF attack
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.

The same uri can be operated to realize a SSRF attack also  without  authorizations.

Users are recommended to upgrade to version 18.12.11, which fixes this issue.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Apache Software Foundation
product: Apache OFBiz
default_status: unaffected
Credits: lang: en
value: Yun Peng - 郭 运鹏 <puata123@outlook.com>
Published: 2023-12-26T11:45:55.393Z
CVE-2023-50969 
Thales Imperva SecureSphere WAF 14.7.0.40 allows remote attackers to bypass WAF rules via a crafted POST request, a different vulnerability than CVE-2021-45468.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-28T00:00:00.000Z
CVE-2023-50974 
In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-09T00:00:00.000Z
CVE-2023-50975 
The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.e., ELECTRON_RUN_AS_NODE can be used in production). This makes it easier for a compromised process to access banking information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-21T00:00:00.000Z
CVE-2023-50976 
Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-17T00:00:00.000Z
CVE-2023-50979 
Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-18T00:00:00.000Z
CVE-2023-50980 
gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve, if the degree of each term in the polynomial is not strictly decreasing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-18T00:00:00.000Z
CVE-2023-50981 
ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associated with squared odd numbers, such as the square of 268995137513890432434389773128616504853.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-18T00:00:00.000Z
CVE-2023-50982 
Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action in Admin_SmileysController do not check the file extension. This leads to remote code execution with the privileges of the www-data user. The fixed versions are 5.3.4, 5.2.6, 5.1.7, and 5.0.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
Published: 2024-01-08T00:00:00.000Z
CVE-2023-50983 
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50984 
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the ip parameter in the spdtstConfigAndStart function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50985 
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the lanGw parameter in the lanCfgSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50986 
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50987 
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysTimeInfoSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50988 
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the bandwidth parameter in the wifiRadioSetIndoor function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50989 
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50990 
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the rebootTime parameter in the sysScheduleRebootSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50991 
Buffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoS) via the pingIp parameter in the pingSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-05T00:00:00.000Z
CVE-2023-50992 
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a stack overflow via the ip parameter in the setPing function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-50993 
Ruijie WS6008 v1.x v2.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 and WS6108 v1.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 was discovered to contain a command injection vulnerability via the function downFiles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-20T00:00:00.000Z
CVE-2023-51006 
An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-51010 
An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering or checking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-28T00:00:00.000Z
CVE-2023-51011 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanPriDns parameter’ of the setLanConfig interface of the cstecgi .cgi
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51012 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanGateway parameter’ of the setLanConfig interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51013 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanNetmask parameter’ of the setLanConfig interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51014 
TOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter’ of the setLanConfig interface of the cstecgi .cgi
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51015 
TOTOLINX EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘enable parameter’ of the setDmzCfg interface of the cstecgi .cgi
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51016 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51017 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanIp parameter’ of the setLanConfig interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51018 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘opmode’ parameter of the setWiFiApConfig interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51019 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘key5g’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51020 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langType’ parameter of the setLanguageCfg interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51021 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘merge’ parameter of the setRptWizardCfg interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51022 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langFlag’ parameter of the setLanguageCfg interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51023 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘host_time’ parameter of the NTPSyncWithHost interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-51024 
TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘tz’ parameter of the setNtpCfg interface of the cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z