CVE-2023-34285

The CVE-2023-34285 entry concerns NETGEAR RAX30 routers. The issue is a stack-based overflow in a shared library used by telnetd (port 23) within the cmsCli_authenticate flow. It arises from insufficient validation of the length of user-supplied data copied into a fixed-size stack buffer, enablin...

CVE-2023-34284

CVE-2023-34284 affects NETGEAR RAX30 routers. The vulnerability is caused by a hard-coded user account in the system configuration that can be used to access the CLI service as a low-privileged user, allowing network-adjacent attackers to bypass authentication without any user interaction. The is...

CVE-2023-34283

CVE-2023-34283 — NETGEAR RAX30 USB Share Link Information Disclosure : The issue arises from how the router handles symbolic links on removable USB media. By creating a symbolic link, a physically present attacker can abuse the router’s web server to access arbitrary local files, revealing sensit...

CVE-2023-34281

D‑Link DIR‑2150 is affected by CVE‑2023‑34281 due to a GetFirmwareStatus target command injection in the SOAP API interface (listening on TCP/80). The flaw lacks proper validation of a user‑supplied string that is used to execute a system call, enabling an attacker to run arbitrary code with root...

CVE-2023-34271

CVE-2023-34271 affects Fatek Automation FvDesigner FPJ file parsing. The flaw is a lack of proper validation of FPJ data, causing a write past the end of an allocated data structure (out-of-bounds write) and enabling arbitrary code execution. Exploitation requires user interaction (the target mus...

CVE-2023-34272

CVE-2023-34272 affects Fatek Automation FvDesigner; the vulnerability lies in FPJ file parsing due to an uninitialized pointer that is dereferenced. This can allow an attacker to execute arbitrary code in the context of the current process. Exploitation requires user interaction (the target must ...

CVE-2023-34270

Summary: CVE-2023-34270affects Fatek Automation FvDesigner via FPJ file parsing. The issue arises from lack of input validation in FPJ parsing, causing an out-of-bounds write and enabling remote code execution in the current process. Exploitation requires user interaction (visiting a malicious pa...

CVE-2023-34269

CVE-2023-34269 : A vulnerability in Fatek Automation FvDesigner’s FPJ file parser allows an out‑of‑bounds write due to insufficient input validation, enabling arbitrary code execution in the context of the current process. Exploitation requires user interaction (visiting a malicious page or openi...

CVE-2023-34265

CVE-2023-34265 concerns a flaw in Fatek Automation’s FvDesigner FPJ file parsing. The root cause is a lack of proper validation of user-supplied data, which can cause a write past the end of an allocated data structure (an out-of-bounds write). This vulnerability can enable an attacker to execute...

CVE-2023-34264

CVE-2023-34264 affects Fatek Automation FvDesigner FPJ file parsing. The flaw is an out-of-bounds write caused by insufficient validation of FPJ data, enabling code execution in the affected process. Exploitation requires user interaction (target must open a malicious page/file). Public documents...

CVE-2023-34263

CVE-2023-34263 affects Fatek Automation FvDesigner, due to an uninitialized pointer during FPJ file parsing that enables remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious FPJ/file). The flaw is documented across multiple sources (ZDI a...

CVE-2023-32175

The CVE-2023-32175 issue affects VIPRE Antivirus Plus, specifically the Anti Malware Service. A local attacker can create a symbolic link to abuse the service and create arbitrary files, enabling privilege escalation to SYSTEM and arbitrary code execution. Vector is LOCAL with LOW privilege requi...

CVE-2023-32173

The CVE-2023-32173 entry concerns Unified Automation UaGateway: a DoS flaw in the AddServer method where crafted arguments can inject invalid characters into an XML configuration file. The impact is a persistent denial-of-service condition, with network exposure and required authentication when t...

CVE-2023-32174

CVE-2023-32174 affects Unified Automation UaGateway, specifically the NodeManagerOpcUa handling. The issue is a use-after-free caused by not validating the existence of a NodeManagerOpcUa object before performing operations, enabling an attacker to execute code with SYSTEM privileges. Reported as...

CVE-2023-32172

CVE-2023-32172 affects Unified Automation UaGateway OPC UA Server. The vulnerability is a use-after-free in the ImportXML function due to lack of validating an object’s existence before operations, leading to remote denial-of-service with authentication required. CVSSv3.0 base score 6.5 (AV:N/AC:...

CVE-2023-32171

CVE-2023-32171 affects Unified Automation UaGateway OPC UA Server. The vulnerability occurs in the ImportCsv method where a crafted XML payload can trigger a null pointer dereference, enabling a remote denial-of-service condition. Exploitation requires authentication and is described in ZDI-20495...

CVE-2023-32168

CVE-2023-32168 affects D-Link D-View; flaw in showUser allows privilege escalation due to lack of proper authorization on a privileged endpoint. Exploitation appears to require network access with authentication; impact is escalation to resources normally protected. Connected sources discuss ZDI ...

CVE-2023-32167

The CVE-2023-32167 entry concerns D-Link D-View’s uploadMib function, where improper validation of a user-supplied path enables directory traversal and arbitrary file creation/deletion in the SYSTEM context. The vulnerability requires authentication to exploit and is evidenced by multiple disclos...

CVE-2023-32165

D-Link D-View is affected by a Directory Traversal in TftpReceiveFileHandler that enables Remote Code Execution. The flaw stems from insufficient validation of a user-supplied path before file operations, allowing an attacker to run code in the SYSTEM context without authentication. Documented im...

CVE-2023-32166

CVE-2023-32166 affects D-Link D‑View. The issue is in the uploadFile function, where user-supplied paths are not properly validated before file operations, enabling an attacker to traverse directories and create arbitrary files. The vulnerability allows file creation in the SYSTEM context and req...