Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-39997 State: PUBLISHED Published: 2022-02-09T22:03:54 Last Updated: 2024-08-04T02:20:34.314Z Vendors: Huawei Products: EMUI Problem Types: Unstrict input parameter verification vulnerability Description: There is a vulnerability of unstrict input parameter verification in the audio assembly.Successful exploitation of this vulnerability may cause out-of-bounds access. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/2/
CVE ID: CVE-2021-39998 State: PUBLISHED Published: 2022-01-07T22:39:48 Last Updated: 2024-08-04T02:20:34.247Z Vendors: n/a Products: EMUI;Magic UI;HarmonyOS Problem Types: Concurrently called for multiple times Description: There is Vulnerability of APIs being concurrently called for multiple times in HwConnectivityExService a in smartphones. Successful exploitation of this vulnerability may cause the system to crash and restart. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202112-0000001183296718 - https://consumer.huawei.com/en/support/bulletin/2021/12/
CVE ID: CVE-2021-39999 State: PUBLISHED Published: 2022-07-11T13:56:49 Last Updated: 2024-08-04T02:20:34.182Z Vendors: n/a Products: eSE620X vESS Problem Types: Buffer Overflow Description: There is a buffer overflow vulnerability in eSE620X vESS V100R001C10SPC200 and V100R001C20SPC200. An attacker can exploit this vulnerability by sending a specific message to the target device due to insufficient validation of packets. Successful exploit could cause a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211201-01-buffer-en
CVE ID: CVE-2021-3002 State: PUBLISHED Published: 2021-01-01T18:14:27 Last Updated: 2024-08-03T16:45:50.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.cinquino.eu/SeoPanelReflect.htm - https://github.com/seopanel/Seo-Panel/issues/202
CVE ID: CVE-2021-3003 State: PUBLISHED Published: 2021-05-10T05:13:19 Last Updated: 2024-08-03T16:45:50.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof product updates. Additional Analyst Notes: - CVE Program Container: References: - https://telematici.agenziaentrate.gov.it/Main/Desktop.jsp - https://fibonhack.github.io/2021/desktop-telematico-mitm-to-rce
CVE ID: CVE-2021-3004 State: PUBLISHED Published: 2021-01-03T03:20:10 Last Updated: 2024-08-03T16:45:50.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should. Additional Analyst Notes: - CVE Program Container: References: - https://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3 - https://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261
CVE ID: CVE-2021-3005 State: PUBLISHED Published: 2021-01-03T03:37:39 Last Updated: 2024-08-03T16:45:50.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice number) value to the central/recibo.php URI. Additional Analyst Notes: - CVE Program Container: References: - http://mk-auth.com.br/ - https://gist.github.com/alacerda/3b925cb333eb839ae808d6f01642aeb3
CVE ID: CVE-2021-3006 State: PUBLISHED Published: 2021-01-03T05:49:30 Last Updated: 2024-08-03T16:45:50.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021. Additional Analyst Notes: - CVE Program Container: References: - https://etherscan.io/address/0x33c2da7fd5b125e629b3950f3c38d7f721d7b30d - https://blocksecteam.medium.com/security-incident-on-seal-finance-fa79c27a1c3b
CVE ID: CVE-2021-3007 State: PUBLISHED Published: 2021-01-04T02:26:45 Last Updated: 2024-08-03T16:45:50.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-su
elf" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ling-Yizhou/zendframework3-/blob/main/zend%20framework3%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%20rce.md - https://github.com/laminas/laminas-http/commits/2.15.x/src/Response/Stream.php - https://github.com/laminas/laminas-http/pull/48 - https://github.com/laminas/laminas-http/releases/tag/2.14.2 - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
CVE ID: CVE-2021-3010 State: PUBLISHED Published: 2021-02-26T14:12:19 Last Updated: 2024-08-03T16:45:50.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server Version 20.3. The application allows a remote attacker to introduce arbitrary JavaScript by crafting malicious form values that are later not sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://www.opentext.com/products-and-solutions/products/enterprise-content-management/content-management - https://www.exploit-db.com/exploits/49578
CVE ID: CVE-2021-3011 State: PUBLISHED Published: 2021-01-07T15:07:18 Last Updated: 2024-08-03T16:45:50.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards
keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF). Additional Analyst Notes: - CVE Program Container: References: - https://ninjalab.io/wp-content/uploads/2021/01/a_side_journey_to_titan.pdf - https://nin
rogram Container: References: - https://ninjalab.io/wp-content/uploads/2021/01/a_side_journey_to_titan.pdf - https://ninjalab.io/a-side-journey-to-titan/
CVE ID: CVE-2021-3012 State: PUBLISHED Published: 2021-04-08T10:15:18 Last Updated: 2024-08-03T16:45:50.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab). Additional Analyst Notes: - CVE Program Container: References: - https://blog.bssi.fr/cve-2021-3012-vulnerability-allowing-remote-html-javascript-code-injection-on-esri-arcgis-products/
CVE ID: CVE-2021-3013 State: PUBLISHED Published: 2021-06-11T11:19:37 Last Updated: 2024-08-03T16:45:50.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md - https://github.com/BurntSushi/ripgrep/blob/e48a17e1891e1ea9dd06ba0e48d5fb140ca7c0c4/CHANGELOG.md
CVE ID: CVE-2021-3014 State: PUBLISHED Published: 2021-01-04T18:38:07 Last Updated: 2024-08-03T16:45:50.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter. Additional Analyst Notes: - CVE Program Container: References: - https://m4dm0e.github.io/2021/01/04/mikrotik-xss-reflected.html - https://github.com/M4DM0e/m4dm0e.github.io/blob/gh-pages/_posts/2021-01-04-mikrotik-xss-reflected.md
CVE ID: CVE-2021-3017 State: PUBLISHED Published: 2021-04-14T17:17:51 Last Updated: 2024-08-03T16:45:50.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code. Additional Analyst Notes: - CVE Program Container: References: - https://www.intelbras.com/pt-br/ajuda-download/faq/roteador-wireless-veloz-wrn-342 - https://pastebin.com/cTYTf0Yn
CVE ID: CVE-2021-3018 State: PUBLISHED Published: 2021-01-05T04:37:24 Last Updated: 2024-08-03T16:45:50.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page. Additional Analyst Notes: - CVE Program Container: References: - https://m4dm0e.github.io/2020/12/07/ipeak-cms-sqli.html - https://github.com/M4DM0e/m4dm0e.github.io/blob/gh-pages/_posts/2020-12-07-ipeak-cms-sqli.md - https://www.amario.ch/cms/ - https://ipeak.ch - http://packetstormsecurity.com/files/160815/IPeakCMS-3.5-SQL-Injection.html
CVE ID: CVE-2021-3019 State: PUBLISHED Published: 2021-01-05T04:35:50 Last Updated: 2024-08-03T16:45:50.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maybe-why-not/lanproxy/issues/1 - https://github.com/ffay/lanproxy/commits/master
CVE ID: CVE-2021-3020 State: PUBLISHED Published: 2022-08-25T23:32:32 Last Updated: 2024-08-03T16:45:50.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root. Additional Analyst Notes: - CVE Program Container: References: - https://github.
wk_invoke, allowing escalation to root. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClusterLabs/hawk/releases - https://bugzilla.suse.com/show_bug.cgi?id=1180571 - https://github.com/ClusterLabs/crmsh/commit/c538024b8ebd138dc373b005189471d9b77e9c82
CVE ID: CVE-2021-3021 State: PUBLISHED Published: 2021-01-05T15:47:02 Last Updated: 2024-08-03T16:45:50.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: ISPConfig before 3.2.2 allows SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.ispconfig.org/blog/ispconfig-3-2-2-released-important-security-update/ - https://twitter.com/ispconfig/status/1346142615511724032
CVE ID: CVE-2021-3022 State: PUBLISHED Published: 2021-01-05T17:40:48 Last Updated: 2024-08-03T16:45:50.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 10 software. There was no write protection for the MTK protect2 partition. The LG ID is LVE-SMP-200028 (January 2021). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2021-3024 State: PUBLISHED Published: 2021-02-01T15:45:23 Last Updated: 2024-08-03T16:45:50.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2021-02-vault-api-endpoint-exposed-internal-ip-address-without-authentication/20334 - https://security.gentoo.org/glsa/202207-01
CVE ID: CVE-2021-3025 State: PUBLISHED Published: 2021-01-08T06:21:36 Last Updated: 2024-08-03T16:45:50.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php). Additional Analyst Notes: - CVE Program Container: References: - https://invisioncommunity.com/release-notes/ - http://packetstormsecurity.com/files/160830/IPS-Community-Suite-4.5.4-SQL-Injection.html
CVE ID: CVE-2021-3026 State: PUBLISHED Published: 2021-01-05T22:58:06 Last Updated: 2024-08-03T16:45:50.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. Additional Analyst Notes: - CVE Program Container: References: - https://invisioncommunity.com/release-notes/
CVE ID: CVE-2021-3027 State: PUBLISHED Published: 2021-03-26T01:58:15 Last Updated: 2024-08-03T16:45:50.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided search filter because user input gets no sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://jorgectf.gitlab.io/disclosure/cve-2021-3027/ - https://github.com/LibrIT/passhport/pull/562 - https://github.com/LibrIT/passhport/commit/366b03f607729c4538e91b634ecc57c8398522a1
CVE ID: CVE-2021-3028 State: PUBLISHED Published: 2021-01-13T16:14:20 Last Updated: 2024-08-03T16:45:50.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/git-big-picture/git-big-picture/pull/62 - https://github.com/git-big-picture/git-big-picture/pull/27 - https://github.com/git-big-picture/git-big-picture/releases/tag/v1.0.0
CVE ID: CVE-2021-3029 State: PUBLISHED Published: 2021-01-07T13:55:26 Last Updated: 2024-08-03T16:45:50.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://www.evolucare.com - https://shoxxdj.fr/ecsimaging-os-injection-cve-2021-3029/
CVE ID: CVE-2021-3031 State: PUBLISHED Published: 2021-01-13T18:10:13.174067Z Last Updated: 2024-09-16T16:48:43.134Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-200 Description: Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect potentially sensitive information f
s. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect potentially sensitive information from these packets. This issue is also known as Etherleak and is detected by security scanners as CVE-2003-0001. This issue impacts: PAN-OS 8.1 version earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3031
CVE ID: CVE-2021-3032 State: PUBLISHED Published: 2021-01-13T18:10:13.785838Z Last Updated: 2024-09-16T22:45:51.286Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-532 Description: An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in any certificate profiles set fo
ration including the username and password in an encrypted form and private keys used in any certificate profiles set for log forwarding server profiles. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3032
CVE ID: CVE-2021-3033 State: PUBLISHED Published: 2021-02-10T17:35:13.982321Z Last Updated: 2024-09-17T03:14:39.641Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Palo Alto Networks Products: Prisma Cloud Compute Problem Types: CWE-347 Description: An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud Compute console as any authorized user. This issue impacts: All versions of Prisma Cloud Compute 19.11, Prisma Cloud Compute 20.04, and Prisma Cloud Comp
user. This issue impacts: All versions of Prisma Cloud Compute 19.11, Prisma Cloud Compute 20.04, and Prisma Cloud Compute 20.09; Prisma Cloud Compute 20.12 before update 1. Prisma Cloud Compute SaaS version is not impacted by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3033
CVE ID: CVE-2021-3034 State: PUBLISHED Published: 2021-03-10T18:10:13.665033Z Last Updated: 2024-09-16T16:38:50.120Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Palo Alto Networks Products: Cortex XSOAR Problem Types: CWE-532 Description: An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on (SSO) integration can be logged to the '/var/log/demisto/' server logs when testing the integration during setup. This logged information includes the private key and identity provider certificate used to configure the SAML SSO integration. This issue impacts: Cortex XSOAR 5.5.0
key and identity provider certificate used to configure the SAML SSO integration. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 98622; Cortex XSOAR 6.0.1 builds earlier than 830029; Cortex XSOAR 6.0.2 builds earlier than 98623; Cortex XSOAR 6.1.0 builds earlier than 848144. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3034
CVE ID: CVE-2021-3035 State: PUBLISHED Published: 2021-04-20T03:15:16.551803Z Last Updated: 2024-09-17T03:17:34.411Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Palo Alto Networks Products: Bridgecrew Checkov Problem Types: CWE-502 Description: An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3035
CVE ID: CVE-2021-3036 State: PUBLISHED Published: 2021-04-20T03:15:17.198767Z Last Updated: 2024-09-17T04:28:51.940Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-532 Description: An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to use the PAN-OS XML API and exists only when a client includes a duplicate API parameter in API requests. Logged information include
-OS XML API and exists only when a client includes a duplicate API parameter in API requests. Logged information includes the cleartext username, password, and API key of the administrator making the PAN-OS XML API request. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3036
CVE ID: CVE-2021-3037 State: PUBLISHED Published: 2021-04-20T03:15:17.834239Z Last Updated: 2024-09-16T23:51:58.522Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-534 Description: An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS configuration to the destination server. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetwo
the destination server. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3037
CVE ID: CVE-2021-3038 State: PUBLISHED Published: 2021-04-20T03:15:18.565071Z Last Updated: 2024-09-16T17:49:11.570Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: GlobalProtect App Problem Types: CWE-20, CWE-248 Description: A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.8; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.4. Ad