rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-5123 Improper Path Sanitization in JSON Datasource Plugin
The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. 





    
    
            






    
    
            This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g.  https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g.  https://example.com/api/admin_api/) .

In the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Grafana
product: grafana-json-datasource
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-02-14T15:06:11.126Z
CVE-2023-5124 PageLayer < 1.8.0 - Author+ Stored XSS
The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Page Builder: Pagelayer
default_status: unaffected
Credits: lang: en
value: Marc Montpas
lang: en
value: WPScan
Published: 2024-01-29T14:44:23.796Z
CVE-2023-5125 Contact Form by FormGet <= 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Contact Form by FormGet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formget' shortcode in versions up to, and including, 5.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pankajagarwal
product: Contact Form by FormGet – Best Form Builder Plugin for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-09-23T04:29:41.200Z
CVE-2023-5126 Delete Me <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Delete Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'plugin_delete_me' shortcode in versions up to, and including, 3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The shortcode is not displayed to administrators, so it cannot be used against administrator users.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: cmc3215
product: Delete Me
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 4.9
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-10-24T13:53:00.181Z
CVE-2023-5127 WP Font Awesome <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping on 'icon' user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: zayedbaloch
product: WP Font Awesome
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-10-24T13:52:58.747Z
CVE-2023-5128 TCD Google Maps <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The TCD Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'map' shortcode in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: designplus
product: TCD Google Maps
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-11-22T15:33:24.310Z
CVE-2023-5130 Delta Electronics WPLSoft Buffer-Overflow
A buffer overflow vulnerability exists in Delta Electronics WPLSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.

Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Delta Electronics
product: WPLSoft
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H
version: 3.1
Credits: lang: en
value: Exodus Intelligence
Published: 2024-01-18T21:14:26.662Z
CVE-2023-5131 Delta Electronics ISPSoft Heap Buffer-Overflow
A heap buffer-overflow exists in Delta Electronics ISPSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.

Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Delta Electronics
product: ISPSoft
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H
version: 3.1
Credits: lang: en
value: Exodus Intelligence
Published: 2024-01-18T21:14:39.954Z
CVE-2023-5132 Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure
The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata).
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: soisytech
product: Soisy Pagamento Rateale
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Francesco Carlucci
Published: 2023-10-21T01:53:41.144Z
CVE-2023-5133 User Activity Log Pro < 2.3.4 - IP Spoofing
This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Problem types: description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Unknown
product: user-activity-log-pro
default_status: unaffected
Credits: lang: en
value: Bartlomiej Marek and Tomasz Swiadek
lang: en
value: WPScan
Published: 2023-10-16T19:39:17.507Z
CVE-2023-5134 Easy Registration Forms <= 2.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode
The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive user meta.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: easyregistrationforms
product: Easy Registration Forms
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-09-23T07:34:02.132Z
CVE-2023-5135 Simple Cloudflare Turnstile <= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Simple Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gravity-simple-turnstile' shortcode in versions up to, and including, 1.23.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: elliotvs
product: Simple CAPTCHA Alternative with Cloudflare Turnstile
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-09-26T01:51:14.743Z
CVE-2023-5136 Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure.  An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: NI
product: TopoGrafix DataPlugin for GPX
default_status: unaffected
vendor: NI
product: DIAdem
default_status: unaffected
vendor: NI
product: VeriStand
default_status: unaffected
vendor: NI
product: FlexLogger
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-11-08T15:24:10.867Z
CVE-2023-5137 Simply Excerpts <= 1.4 - Admin+ Stored XSS
The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simply Excerpts
default_status: affected
Credits: lang: en
value: niclo
lang: en
value: WPScan
Published: 2023-12-04T21:28:33.766Z
CVE-2023-5138 Glitch detection not active by default in Silicon Labs Secure Vault High devices
Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.
Problem types: cwe_id: CWE-1319
description: CWE-1319 Improper Protection against Electromagnetic Fault Injection (EM-FI)
Affected products: vendor: silabs.com
product: GSDK
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-01-03T22:31:04.433Z
CVE-2023-5139 Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driver
Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: zephyrproject-rtos
product: Zephyr
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2023-10-26T04:40:36.930Z
CVE-2023-5140 Bonus for Woo < 5.8.3 - Reflected Cross-Site Scripting
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Bonus for Woo
default_status: unaffected
Credits: lang: en
value: Enrico Marcolini
lang: en
value: Claudio Marchesini
lang: en
value: WPScan
Published: 2023-11-20T18:55:02.911Z
CVE-2023-5141 BSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site Scripting
The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: BSK Contact Form 7 Blacklist
default_status: affected
Credits: lang: en
value: Enrico Marcolini
lang: en
value: Claudio Marchesini
lang: en
value: WPScan
Published: 2023-12-04T21:29:50.002Z
CVE-2023-5142 H3C ER6300G2 Config File userLogin.asp path traversal
A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-22
description: CWE-22 Path Traversal
Affected products: vendor: H3C
product: GR-1100-P
vendor: H3C
product: GR-1108-P
vendor: H3C
product: GR-1200W
vendor: H3C
product: GR-1800AX
vendor: H3C
product: GR-2200
vendor: H3C
product: GR-3200
vendor: H3C
product: GR-5200
vendor: H3C
product: GR-8300
vendor: H3C
product: ER2100n
vendor: H3C
product: ER2200G2
vendor: H3C
product: ER3200G2
vendor: H3C
product: ER3260G2
vendor: H3C
product: ER5100G2
vendor: H3C
product: ER5200G2
vendor: H3C
product: ER6300G2
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: yinsel975 (VulDB User)
Published: 2023-09-24T22:00:06.432Z
CVE-2023-5143 D-Link DAR-7000 webmailattach.php Privilege Escalation
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 up to 20151231. This issue affects some unknown processing of the file /log/webmailattach.php. The manipulation of the argument table_name leads to an unknown weakness. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240239. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Problem types: description: Privilege Escalation
Affected products: vendor: D-Link
product: DAR-7000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: kk1230 (VulDB User)
Published: 2023-09-24T22:31:04.295Z
CVE-2023-5144 D-Link DAR-7000/DAR-8000 updateos.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /sysmanage/updateos.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240240. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: D-Link
product: DAR-7000
vendor: D-Link
product: DAR-8000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: llixixioo (VulDB User)
Published: 2023-09-24T23:00:06.505Z
CVE-2023-5145 D-Link DAR-7000 licence.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000 up to 20151231 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240241 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: D-Link
product: DAR-7000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: llixixioo (VulDB User)
Published: 2023-09-24T23:31:05.183Z
CVE-2023-5146 D-Link DAR-7000/DAR-8000 updatelib.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240242 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: D-Link
product: DAR-7000
vendor: D-Link
product: DAR-8000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: llixixioo (VulDB User)
Published: 2023-09-25T00:00:09.044Z
CVE-2023-5147 D-Link DAR-7000 updateos.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240243. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: D-Link
product: DAR-7000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: llixixioo (VulDB User)
Published: 2023-09-25T00:31:05.290Z
CVE-2023-5148 D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240244. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: D-Link
product: DAR-7000
vendor: D-Link
product: DAR-8000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: llixixioo (VulDB User)
Published: 2023-09-25T01:00:08.452Z