Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-36179 State: PUBLISHED Published: 2021-09-08T10:15:48 Last Updated: 2024-10-25T13:50:33.122Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via crafted parameters in CLI command execution Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-206
CVE ID: CVE-2021-36180 State: PUBLISHED Published: 2021-12-08T10:46:45 Last Updated: 2024-10-25T13:42:36.173Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
meters of HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-120
CVE ID: CVE-2021-36181 State: PUBLISHED Published: 2021-11-02T17:22:57 Last Updated: 2024-10-25T13:48:42.993Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiPortal Problem Types: Denial of service Description: A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific coordination of web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
ific coordination of web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-102
CVE ID: CVE-2021-36182 State: PUBLISHED Published: 2021-09-08T10:20:57 Last Updated: 2024-10-25T13:50:22.365Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-047
CVE ID: CVE-2021-36183 State: PUBLISHED Published: 2021-11-02T18:41:28 Last Updated: 2024-10-25T13:44:33.615Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiClientWindows Problem Types: Execute unauthorized code or commands Description: An improper authorization vulnerability [CWE-285] in FortiClient for Windows versions 7.0.1 and below and 6.4.2 and below may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for Forticlient updates. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-I
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-079
CVE ID: CVE-2021-36184 State: PUBLISHED Published: 2021-11-02T18:51:45 Last Updated: 2024-10-25T13:43:54.340Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWLM Problem Types: Information disclosure Description: A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosure device, users and database information via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-107
CVE ID: CVE-2021-36185 State: PUBLISHED Published: 2021-11-02T18:45:54 Last Updated: 2024-10-25T13:44:11.292Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWLM Problem Types: Execute unauthorized code or commands Description: A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-110
CVE ID: CVE-2021-36186 State: PUBLISHED Published: 2021-11-02T18:35:58 Last Updated: 2024-10-25T13:44:51.405Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-119
CVE ID: CVE-2021-36187 State: PUBLISHED Published: 2021-11-02T18:32:37 Last Updated: 2024-10-25T13:45:24.571Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Denial of service Description: A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-039
CVE ID: CVE-2021-36188 State: PUBLISHED Published: 2021-12-08T13:24:55 Last Updated: 2024-10-24T18:26:55.304Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advi
rs Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-118
CVE ID: CVE-2021-36189 State: PUBLISHED Published: 2021-12-09T09:10:03 Last Updated: 2024-10-25T13:37:43.372Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:H/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiClientEMS Problem Types: Information disclosure Description: A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allows attacker to information disclosure via inspecting browser decrypted data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-140
CVE ID: CVE-2021-36190 State: PUBLISHED Published: 2021-12-08T13:11:05 Last Updated: 2024-10-25T13:39:43.483Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Improper access control Description: A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-123
CVE ID: CVE-2021-36191 State: PUBLISHED Published: 2021-12-08T13:03:35 Last Updated: 2024-10-25T13:40:05.947Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Improper access control Description: A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET parameters in requests to error handlers Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-133
CVE ID: CVE-2021-36192 State: PUBLISHED Published: 2021-11-03T10:17:20 Last Updated: 2024-10-25T13:43:18.652Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiManager Problem Types: Information disclosure Description: An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.x, 6.0.x, 5.6.0 may allow a FortiGate user to see scripts from other ADOMS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-103
CVE ID: CVE-2021-36193 State: PUBLISHED Published: 2022-02-02T11:19:47 Last Updated: 2024-10-25T13:35:45.778Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-132
CVE ID: CVE-2021-36194 State: PUBLISHED Published: 2021-12-09T08:46:46 Last Updated: 2024-10-25T13:38:05.532Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-152
CVE ID: CVE-2021-36195 State: PUBLISHED Published: 2021-12-08T18:14:55 Last Updated: 2024-10-25T13:38:48.813Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ll via specially crafted command arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-157
CVE ID: CVE-2021-36198 State: PUBLISHED Published: 2021-12-06T16:54:42.792492Z Last Updated: 2024-09-16T16:38:54.666Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Johnson Controls Products: Entrapass Problem Types: CWE-200 Description: Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories/ICSA-21-336-02
CVE ID: CVE-2021-36199 State: PUBLISHED Published: 2022-01-14T19:10:42.869041Z Last Updated: 2024-09-16T18:44:18.470Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Johnson Controls Products: VideoEdge Problem Types: CWE-228 Description: Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories/ICSA-22-011-01
CVE ID: CVE-2021-36200 State: PUBLISHED Published: 2022-07-22T14:55:52.577138Z Last Updated: 2024-09-16T17:07:41.371Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Johnson Controls Products: Metasys ADS/ADX/OAS server Problem Types: CWE-306 Description: Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-02
CVE ID: CVE-2021-36201 State: PUBLISHED Published: 2022-10-11T20:17:42.951Z Last Updated: 2025-05-15T18:42:45.441Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Johnson Controls Products: C•CURE 9000 Problem Types: CWE-204 Description: Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-03
CVE ID: CVE-2021-36202 State: PUBLISHED Published: 2022-04-07T19:12:48.421855Z Last Updated: 2024-09-17T01:50:52.203Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Johnson Controls Products: Metasys Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisor
l Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-02
CVE ID: CVE-2021-36203 State: PUBLISHED Published: 2022-04-22T14:44:10.638332Z Last Updated: 2024-09-17T02:12:16.472Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Johnnson Controls Products: Metasys System Configuration Tool (SCT), Metasys System Configuration Tool Pro (SCT Pro) Problem Types: CWE-918 Description: The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02
CVE ID: CVE-2021-36204 State: PUBLISHED Published: 2023-01-13T00:00:00.000Z Last Updated: 2025-04-07T19:45:35.972Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Johnson Controls Products: Metasys ADS/ADX/OAS Problem Types: CWE-522 Description: Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/uscert/i
hment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-06
CVE ID: CVE-2021-36205 State: PUBLISHED Published: 2022-04-15T16:24:48.570137Z Last Updated: 2024-09-16T23:41:01.659Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Johnson Controls Products: Metasys Problem Types: CWE-459 Description: Under certain circumstances the session token is not cleared on logout. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-02
CVE ID: CVE-2021-36206 State: PUBLISHED Published: 2022-10-28T01:17:27.885Z Last Updated: 2025-05-05T14:37:46.026Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Johnson Controls Products: CEVAS Problem Types: CWE-79 Description: All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-05
CVE ID: CVE-2021-36207 State: PUBLISHED Published: 2022-04-29T16:39:14.893525Z Last Updated: 2024-09-17T00:11:33.212Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Johnson Controls Products: Metasys ADS/ADX/OAS server Problem Types: CWE-269 Description: Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/uscert/ics/advisories/icsa-22-118-01
CVE ID: CVE-2021-36209 State: PUBLISHED Published: 2021-08-06T13:19:25 Last Updated: 2024-08-04T00:54:50.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE ID: CVE-2021-36212 State: PUBLISHED Published: 2021-07-07T12:34:24 Last Updated: 2024-08-04T00:54:51.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/01521d614cb578de75a406394b4f0426f6036ba7 - https://github.com/MISP/MISP/compare/v2.4.145...v2.4.146
CVE ID: CVE-2021-36213 State: PUBLISHED Published: 2021-07-17T17:32:36 Last Updated: 2024-08-04T00:54:50.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/consul - https://github.com/hashicorp/consul/releases/tag/v1.10.1 - https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-
.10.1 - https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855 - https://security.gentoo.org/glsa/202208-09
CVE ID: CVE-2021-36214 State: PUBLISHED Published: 2021-07-13T17:47:37 Last Updated: 2024-08-04T00:54:50.746Z Vendors: LINE Corporation Products: LINE client for iOS Problem Types: CWE-79 Description: LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/988332
CVE ID: CVE-2021-36215 State: PUBLISHED Published: 2021-09-08T17:50:43 Last Updated: 2024-08-04T00:54:50.677Z Vendors: LINE Corporation Products: LINE client for iOS Problem Types: n/a Description: LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1082991
CVE ID: CVE-2021-36216 State: PUBLISHED Published: 2021-09-08T17:50:44 Last Updated: 2024-08-04T00:54:50.701Z Vendors: LINE Corporation Products: LINE for Windows Problem Types: CWE-427 Description: LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/950688
CVE ID: CVE-2021-36217 State: REJECTED Published: 2021-07-07T17:58:55 Last Updated: 2021-08-09T12:09:07 Description: No description available.
CVE ID: CVE-2021-36218 State: PUBLISHED Published: 2021-09-27T13:26:27 Last Updated: 2024-08-04T00:54:50.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SKALE sgxwallet 1.58.3. sgx_disp_ippsAES_GCMEncrypt allows an out-of-bounds write, resulting in a segfault and compromised enclave. This issue describes a buffer overflow, which was resolved prior to v1.77.0 and not reproducible in latest sgxwallet v1.77.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/skalenetwork/sgxwallet/releases - https://github.com/skalenetwork/sgxwallet/commit/77425c862ad20cd270d42c54f3d63e1eb4e02195
CVE ID: CVE-2021-36219 State: PUBLISHED Published: 2021-09-27T13:22:28 Last Updated: 2024-08-04T00:54:51.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/skalenetwork/sgxwallet/r
et v1.77.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/skalenetwork/sgxwallet/releases - https://github.com/skalenetwork/sgxwallet/commit/4e9b5b7526db083177e81f8bafeaa4914d276a82
CVE ID: CVE-2021-36221 State: PUBLISHED Published: 2021-08-08T00:00:00 Last Updated: 2024-08-04T00:54:50.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/golang-announce - https://groups.google.com/g/golang-announce/c/JvWG9FUUYT0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4AMYYHGBYMIWCCR5RCDFI5RAUJOPO5L/ - https://lists.fedoraproject.org/archives/list/package-announce