rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-43081 

PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in ddfscon component. A low Privileged local attacker could potentially exploit this vulnerability, leading to overwriting of log files.


Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: Dell
product: PowerProtect Agent for File System
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-11-22T12:50:22.272Z
CVE-2023-43082 

Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component. If a customer has a certificate signed by a third-party public Certificate Authority, the vCenter CA could be spoofed by an attacker who can obtain a CA-signed certificate.


Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Dell
product: Unity
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2023-11-22T16:16:08.393Z
CVE-2023-43086 

Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local malicious user could potentially modify files inside installation folder during application upgrade, leading to privilege escalation.


Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Dell
product: Dell Command Configure (DCC)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-11-23T06:27:19.920Z
CVE-2023-43087 

Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exploit this vulnerability to cause information disclosure.


Problem types: cwe_id: CWE-280
description: CWE-280: Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Dell
product: PowerScale OneFS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-11-02T10:30:31.343Z
CVE-2023-43088 

Dell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device.


Problem types: cwe_id: CWE-16
description: CWE-16: Configuration
Affected products: vendor: Dell
product: CPG BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-12-22T18:00:38.953Z
CVE-2023-43089 

Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user could potentially exploit this vulnerability to modify the content of the policy file, leading to unauthorized access to resources.


Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Dell
product: Dell Rugged Control Center
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Published: 2023-12-01T02:06:51.270Z
CVE-2023-43090 Gnome-shell: screenshot tool allows viewing open windows when session is locked
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Mickael Karatekin (SysDream) for reporting this issue.
Published: 2023-09-22T05:02:08.801Z
CVE-2023-43091 Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss)  via its service.json
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Michael Evans for reporting this issue.
Published: 2024-11-17T12:25:49.293Z
CVE-2023-43102 
An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-43103 
An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-43114 
An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-43115 
In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-43116 
A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-43118 
Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-16T00:00:00.000Z
CVE-2023-43119 
An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-16T00:00:00.000Z
CVE-2023-43120 
An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalated privileges via crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-16T00:00:00.000Z
CVE-2023-43121 
A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7, and before 31.7.2 allows attackers to read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-16T00:00:00.000Z
CVE-2023-43122 
Samsung Mobile Processor and Wearable Processor (Exynos 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, and W920) allow Information Disclosure in the Bootloader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:P/A:N/C:H/I:N/PR:H/S:C/UI:R
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
Published: 2023-12-13T00:00:00.000Z
CVE-2023-43123 Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files
On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems.

The method File.createTempFile on unix-like systems creates a file with predefined name (so easily identifiable) and by default will create this file with the permissions -rw-r--r--. Thus, if sensitive information is written to this file, other local users can read this information.

File.createTempFile(String, String) will create a temporary file in the system temporary directory if the 'java.io.tmpdir' system property is not explicitly set. 

This affects the class  https://github.com/apache/storm/blob/master/storm-core/src/jvm/org/apache/storm/utils/TopologySpoutLag.java#L99  and was introduced by  https://issues.apache.org/jira/browse/STORM-3123 

In practice, this has a very limited impact as this class is used only if ui.disable.spout.lag.monitoring

 is set to false, but its value is true by default.
Moreover, the temporary file gets deleted soon after its creation.

The solution is to use  Files.createTempFile https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/nio/file/Files.html#createTempFile(java.lang.String,java.lang.String,java.nio.file.attribute.FileAttribute...)  instead.

We recommend that all users upgrade to the latest version of Apache Storm.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Apache Software Foundation
product: Apache Storm
default_status: affected
Credits: lang: en
value: Andrea Cosentino from Apache Software Foundation
Published: 2023-11-23T09:16:34.705Z
CVE-2023-43124 BIG-IP APM Clients TunnelCrack vulnerability

BIG-IP APM clients may send IP traffic outside of the VPN tunnel.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: F5
product: BIG-IP Edge Client
default_status: unknown
vendor: F5
product: F5 Access
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Bypassing Tunnels: Leaking VPN Client Traffic by Abusing Routing Tables https://papers.mathyvanhoef.com/usenix2023-tunnelcrack.pdf
Published: 2023-09-27T15:21:50.794Z
CVE-2023-43125 BIG-IP APM Clients TunnelCrack vulnerability

BIG-IP APM clients may send IP traffic outside of the VPN tunnel.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: F5
product: BIG-IP Edge Client
default_status: unknown
vendor: F5
product: F5 Access
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Bypassing Tunnels: Leaking VPN Client Traffic by Abusing Routing Tables https://papers.mathyvanhoef.com/usenix2023-tunnelcrack.pdf
Published: 2023-09-27T15:22:07.212Z
CVE-2023-43128 
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-21T00:00:00.000Z
CVE-2023-43129 
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of REMOTE_PORT parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-22T00:00:00.000Z
CVE-2023-43130 
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-22T00:00:00.000Z
CVE-2023-43131 
General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-25T00:00:00.000Z
CVE-2023-43132 
szvone vmqphp <=1.13 is vulnerable to SQL Injection. Unauthorized remote users can use sql injection attacks to obtain the hash of the administrator password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-25T00:00:00.000Z
CVE-2023-43134 
There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43135 
There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43137 
TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule name parameter has injection points.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43138 
TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule name has an injection point.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43139 
An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-43141 
TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-25T00:00:00.000Z
CVE-2023-43144 
Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-22T00:00:00.000Z
CVE-2023-43147 
PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-12T00:00:00.000Z
CVE-2023-43148 
SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-12T00:00:00.000Z
CVE-2023-43149 
SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-12T00:00:00.000Z
CVE-2023-43154 
In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in "isValidLogin()" function during login attempt results in PHP type confusion vulnerability that leads to authentication bypass and takeover of the administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-26T00:00:00.000Z
CVE-2023-43176 
A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-03T00:00:00.000Z
CVE-2023-43177 
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-17T00:00:00.000Z
CVE-2023-43183 
Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows read-only users to arbitrarily change the password of an admin and hijack their account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-03T00:00:00.000Z
CVE-2023-43187 
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-26T00:00:00.000Z
CVE-2023-43191 
SpringbootCMS 1.0 foreground message can be embedded malicious code saved in the database. When users browse the comments, these malicious codes embedded in the HTML will be executed, and the user's browser will be controlled by the attacker, so as to achieve the special purpose of the attacker, such as cookie theft
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-27T00:00:00.000Z
CVE-2023-43192 
SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-27T00:00:00.000Z
CVE-2023-43193 
Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-43194 
Submitty before v22.06.00 is vulnerable to Incorrect Access Control. An attacker can delete any post in the forum by modifying request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-43196 
D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43197 
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.asp function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43198 
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hi_block.asp function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43199 
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/login.cgi function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43200 
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43201 
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43202 
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows attackers to execute arbitrary commands via the update.device.packet-capture.tftp-file-name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43203 
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update_users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43204 
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-43206 
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability allows attackers to execute arbitrary commands via the certDownload parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z