Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-35030 State: PUBLISHED Published: 2021-07-26T11:20:40.191209Z Last Updated: 2024-09-17T01:46:12.877Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: Zyxel Products: GS1900-8 Firmware Problem Types: CWE-79 Description: A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel_security_advisory_for_XSS_vulnerability_of_GS1900_series_switches.shtml
CVE ID: CVE-2021-35031 State: PUBLISHED Published: 2021-12-28T10:36:23 Last Updated: 2024-08-04T00:33:49.873Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: GS1900 series firmware, XGS1210 series firmware, XGS1250 series firmware Problem Types: CWE-78 Description: A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vul
CVE Program Container: References: - https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml
CVE ID: CVE-2021-35032 State: PUBLISHED Published: 2021-12-28T10:42:07 Last Updated: 2024-08-04T00:33:49.889Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: GS1900 series firmware Problem Types: CWE-78 Description: A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands via a crafted function call. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml
CVE ID: CVE-2021-35033 State: PUBLISHED Published: 2021-11-23T21:20:38 Last Updated: 2024-08-04T00:33:49.871Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NBG6818 series firmware, NBG7815 series firmware, WSQ20 series firmware, WSQ50 series firmware, WSQ60 series firmware, WSR30 series firmware Problem Types: CWE-260 Description: A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote
device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml - https://www.tenable.com/security/research/tra-2022-06
CVE ID: CVE-2021-35034 State: PUBLISHED Published: 2021-12-29T12:36:47 Last Updated: 2024-08-04T00:33:49.919Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Zyxel Products: NBG6604 series firmware Problem Types: CWE-613 Description: An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml
CVE ID: CVE-2021-35035 State: PUBLISHED Published: 2021-12-29T12:45:38 Last Updated: 2024-08-04T00:33:49.910Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: NBG6604 series firmware Problem Types: CWE-312 Description: A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtain sensitive information from the configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml
CVE ID: CVE-2021-35036 State: PUBLISHED Published: 2022-03-01T06:20:12 Last Updated: 2024-08-04T00:33:49.906Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: VMG3625-T50B firmware Problem Types: CWE-312 Description: A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated attacker to obtain sensitive information from the configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-cleartext-storage-of-information-vulnerability
CVE ID: CVE-2021-35037 State: PUBLISHED Published: 2021-07-12T10:56:44 Last Updated: 2024-08-04T00:33:49.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jamf Pro before 10.30.1 allows for an unvalidated URL redirect vulnerability affecting Jamf Pro customers who host their environments on-premises. An attacker may craft a URL that appears to be for a customer's Jamf Pro instance, but when clicked will forward a user to an arbitrary URL that may be malicious. This is tracked via Jamf with the following ID: PI-009822 Additional Analyst Notes: - CVE Program Container: References: - https://www.jamf.com/resources/product-documentation/jamf-pro-release-notes/ - https://www.jamf.co
tainer: References: - https://www.jamf.com/resources/product-documentation/jamf-pro-release-notes/ - https://www.jamf.com/jamf-nation/discussions/39219/jamf-pro-10-30-1-security-upgrade
CVE ID: CVE-2021-35039 State: PUBLISHED Published: 2021-07-07T00:57:50 Last Updated: 2024-08-04T00:33:49.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/07/06/3 - https://github.com/torvalds/linux/commit/0c18f29aae7ce3dadd26d8ee3505d07cc982df75 - https://cdn.kernel.org/pub/linux/kernel/v5.x/Chan
b.com/torvalds/linux/commit/0c18f29aae7ce3dadd26d8ee3505d07cc982df75 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.14 - http://www.openwall.com/lists/oss-security/2021/07/06/3 - https://security.netapp.com/advisory/ntap-20210813-0004/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0c18f29aae7ce3dadd26d8ee3505d07cc982df75
CVE ID: CVE-2021-35041 State: PUBLISHED Published: 2021-06-23T23:50:12 Last Updated: 2024-08-04T00:33:49.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory sustainably and crash. More details are shown at: https://github.com/FISCO-BCOS/FISCO-BCOS/issues/1951 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FISCO-BCOS/FISCO-BCOS/issues/1951
CVE ID: CVE-2021-35042 State: PUBLISHED Published: 2021-07-02T09:54:11 Last Updated: 2024-08-04T00:33:49.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/3.2/releases/security/ - https://www.openwall.com/lists/oss-security/2021/07/02/2 - https://www.djangoproject.com/weblog/2021/jul/01/security-releases/ - https://security.netapp.com/advisory/ntap-20210805-0008/ - htt
djangoproject.com/weblog/2021/jul/01/security-releases/ - https://security.netapp.com/advisory/ntap-20210805-0008/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SS6NJTBYWOX6J7G4U3LUOILARJKWPQ5Y/
CVE ID: CVE-2021-35043 State: PUBLISHED Published: 2021-07-19T14:53:09 Last Updated: 2024-08-04T00:33:50.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuoct2021.html - https://github.com/nahsra/antisamy/releases/tag/v1.6.4 - https://github.com/nahsra/antisamy/pull/87 - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-
.com/nahsra/antisamy/pull/87 - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-35045 State: PUBLISHED Published: 2021-06-22T13:21:42 Last Updated: 2024-08-04T00:33:49.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xoffense/POC/blob/main/Account%20takeover%20%28Chaining%20session%20fixation%20%2B%20reflected%20Cross%20Site%20Scripting%29%20in%20ICE%20Hrm%20Version%2029.0.0.OS.md
CVE ID: CVE-2021-35046 State: PUBLISHED Published: 2021-06-22T13:21:44 Last Updated: 2024-08-04T00:33:50.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xoffense/POC/blob/main/Account%20takeover%20%28Chaining%20session%20fixation%20%2B%20reflected%20Cross%20Site%20Scripting%29%20in%20ICE%20Hrm%20Version%2029.0.0.OS.md
CVE ID: CVE-2021-35047 State: PUBLISHED Published: 2021-06-25T11:44:30.916514Z Last Updated: 2024-09-16T20:41:47.623Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-78 Description: Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this v
is Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies - https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/
CVE ID: CVE-2021-35048 State: PUBLISHED Published: 2021-06-25T11:44:25.422784Z Last Updated: 2024-09-17T02:46:55.900Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-89 Description: Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerabilit
and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies - https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/
CVE ID: CVE-2021-35049 State: PUBLISHED Published: 2021-06-25T11:44:45.218211Z Last Updated: 2024-09-16T23:10:59.157Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-89 Description: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in
an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies - https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/
CVE ID: CVE-2021-35050 State: PUBLISHED Published: 2021-06-25T11:44:36.530189Z Last Updated: 2024-09-16T16:12:29.280Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-257 Description: User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions. A
and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions. Additional Analyst Notes: - CVE Program Container: References: - https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies - https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/
CVE ID: CVE-2021-35052 State: PUBLISHED Published: 2021-11-23T15:30:38 Last Updated: 2024-08-04T00:33:50.733Z Vendors: n/a Products: Kaspersky Password Manager for Windows Problem Types: LPE Description: A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121 - https://www.zerodayinitiative.com/advisories/ZDI-21-1335/
CVE ID: CVE-2021-35053 State: PUBLISHED Published: 2021-11-03T19:11:26 Last Updated: 2024-08-04T00:33:50.745Z Vendors: n/a Products: Kaspersky Endpoint Security for Windows Problem Types: DoS Description: Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file in a certain way and then reboot the system to make the system unbootable. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#01112021 - https://www.zerodayinitiative.com/advisories/ZDI-21-1280/ - https://www.zerodayinitiative.com/advisories/ZDI-22-431/
CVE ID: CVE-2021-35054 State: PUBLISHED Published: 2021-07-20T06:58:40 Last Updated: 2024-08-04T00:33:50.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files. Additional Analyst Notes: - CVE Program Container: References: - https://www.minecraft.net/en-us/article/minecraft-java-edition-1-16-5 - https://vuln.ryotak.me/advisories/55 - http://jvn.jp/en/jp/JVN53278122/index.html
CVE ID: CVE-2021-35055 State: PUBLISHED Published: 2021-12-25T23:26:13 Last Updated: 2024-08-04T00:33:50.868Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected Setup) protocol. (Affected Chipsets MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915; Affected Software Versions 7.4.0.0; Out-of-bounds write). Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Mu
ainer: References: - https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300 - https://corp.mediatek.com/product-security-bulletin/January-2022
CVE ID: CVE-2021-35056 State: PUBLISHED Published: 2021-07-15T18:14:39 Last Updated: 2024-08-04T00:33:50.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executable might run. Additional Analyst Notes: - CVE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Home.aspx - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=64
CVE ID: CVE-2021-35059 State: PUBLISHED Published: 2021-10-11T08:19:54 Last Updated: 2024-08-04T00:33:50.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwaygroup.com/way4-platform - https://gist.github.com/exviry/560fededd1e44b7cced483d8ca8c362e
CVE ID: CVE-2021-35060 State: PUBLISHED Published: 2021-10-11T08:24:26 Last Updated: 2024-08-04T00:33:50.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: /way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwaygroup.com/way4-platform - https://gist.github.com/exviry/9527ce2ccdc0718d3ffd1e3ca62cf304
CVE ID: CVE-2021-35061 State: PUBLISHED Published: 2021-08-30T18:58:44 Last Updated: 2024-08-04T00:33:49.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary web script or HTML via all parameters to HTML form fields in all components. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sthierolf/security/blob/main/CVE-2021-35061.md
CVE ID: CVE-2021-35062 State: PUBLISHED Published: 2021-08-30T19:02:32 Last Updated: 2024-08-04T00:33:50.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid token of a COVID-19 test result to execute shell commands with the permissions of the web server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sthierolf/security/blob/main/CVE-2021-35062.md
CVE ID: CVE-2021-35063 State: PUBLISHED Published: 2021-07-22T17:01:40 Last Updated: 2024-08-04T00:33:50.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OISF/suricata/releases - https://forum.suricata.io/t/suricata-6-0-3-and-5-0-7-released/1489 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990835 - https://security-tracker.debian.org/tracker/CVE-2021-35063 - https://bugzilla.redhat.com/show_bug.cgi?id=1980453 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEP7PWY4LRT2R
1980453 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEP7PWY4LRT2R4MFLV7JIJRYZEZ7RQFL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JU27J2ZYG6FBDL5CERE6FBB4ZFGHOROE/
CVE ID: CVE-2021-35064 State: PUBLISHED Published: 2021-07-12T11:09:58 Last Updated: 2024-08-04T00:33:50.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg. Additional Analyst Notes: - CVE Program Container: References: - https://www.kramerav.com/us/product/viaware - http://packetstormsecurity.com/files/166623/Kramer-VIAware-Remote-Code-Execution.html
CVE ID: CVE-2021-35065 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T18:31:12.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294 - https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339 - https://github.com/gulpjs/glob-parent/pull/49
CVE ID: CVE-2021-35066 State: PUBLISHED Published: 2021-06-21T19:05:27 Last Updated: 2024-08-04T00:33:50.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. Additional Analyst Notes: - CVE Program Container: References: - https://www.connectwise.com/company/trust/security-bulletins - https://home.connectwise.com/securityBulletin/60cc8c63508a120001cb6e8d
CVE ID: CVE-2021-35067 State: PUBLISHED Published: 2021-10-07T14:29:37 Last Updated: 2024-08-04T00:33:50.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data (e.g., an attacker who sniffs a Close message can transmit an acceptable Open message). Additional Analyst Notes: - CVE Program Container: References: - https://infosec.rm-it.de/?p=878&preview=1&_ppp=219bc85c2f - https://infosec.rm-it.de/2021/06/18/meross-smart-wi-fi-garage-door-opener-analysis/
CVE ID: CVE-2021-35068 State: PUBLISHED Published: 2022-02-11T10:40:31 Last Updated: 2024-08-04T00:33:50.600Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables Problem Types: NULL Pointer Dereference in Bluetooth Host Description: Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snap