Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-28955 State: PUBLISHED Published: 2021-03-22T06:19:43 Last Updated: 2024-08-03T21:55:12.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on Windows). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MichaelMure/git-bug/security/advisories/GHSA-m898-h4pm-pqfr - https://vuln.ryotak.me/advisories/18
CVE ID: CVE-2021-28956 State: PUBLISHED Published: 2021-03-22T06:11:13 Last Updated: 2024-08-03T21:55:12.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glen-84/vscode-sass-lint/releases - https://marketplace.visualstudio.com/items/glen-84.sass-lint/changelog - https://github.com/glen-84/vscode-sass-lint/compare/v1.0.6...v1
ace.visualstudio.com/items/glen-84.sass-lint/changelog - https://github.com/glen-84/vscode-sass-lint/compare/v1.0.6...v1.0.7 - https://vuln.ryotak.me/advisories/1
CVE ID: CVE-2021-28957 State: PUBLISHED Published: 2021-03-21T04:39:35 Last Updated: 2024-08-03T21:55:12.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/lxml/+bug/1888153 - https://github.
nal Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/lxml/+bug/1888153 - https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270 - https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html - https://www.debian.org/security/2021/dsa-4880 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f
ps://www.oracle.com/security-alerts/cpuoct2021.html - https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999 - https://security.netapp.com/advisory/ntap-20210521-0004/ - https://security.gentoo.org/glsa/202208-06
CVE ID: CVE-2021-28958 State: PUBLISHED Published: 2021-06-25T11:54:17 Last Updated: 2024-08-03T21:55:12.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/self-service-password/release-notes.html#6102 - https://blog.stmcyber.com/vulns/cve-2021-28958/ - https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6102-released-with-an-important-security-fix-21-3-2021
CVE ID: CVE-2021-28959 State: PUBLISHED Published: 2021-04-30T12:16:42 Last Updated: 2024-08-03T21:55:12.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/eventlog/features-new.html#release
CVE ID: CVE-2021-28960 State: PUBLISHED Published: 2021-09-21T12:46:18 Last Updated: 2024-08-03T21:55:12.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/desktop-central/unauthenticated-command-injection-vulnerability.html
CVE ID: CVE-2021-28961 State: PUBLISHED Published: 2021-03-21T05:10:19 Last Updated: 2024-08-03T21:55:12.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openwrt/luci/commit/9df7ea4d66644df69fcea18b36bc465912ffc - https://openwrt.org/advisory/2021-08-01-3
CVE ID: CVE-2021-28962 State: PUBLISHED Published: 2022-01-31T13:50:15 Last Updated: 2024-08-03T21:55:12.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.stormshield.eu/SNS/v4/en/Content/Release_Notes_SNS/Getting_Started_RNO.htm - https://advisories.stormshield.eu/ - https://advisories.stormshield.eu/2021-007/
CVE ID: CVE-2021-28963 State: PUBLISHED Published: 2021-03-22T07:02:05 Last Updated: 2024-08-03T21:55:12.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/985405 - https://shibboleth.net/community/advisories/secadv_20210317.txt - https://issues.shibboleth.net/jira/browse/SSPCPP-922 - https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=d1dbebfadc1bdb824fea63843c4c38fa69e54379 - https://www.debian.org/security/2021/dsa-4872
CVE ID: CVE-2021-28964 State: PUBLISHED Published: 2021-03-22T07:17:34 Last Updated: 2024-08-03T21:55:12.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dbcc7d57bffc0c8cac9dac11bec548597d59a6a5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.or
fc0c8cac9dac11bec548597d59a6a5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTRNPQTZ4GVS46SZ4OBXY5YDOGVPSTGQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VCKIOXCOZGXBEZMO5LGGV5MWCHO6FT3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/ - https://security.netapp.com/advisory/ntap-20210430-0003/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html - https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
CVE ID: CVE-2021-28965 State: PUBLISHED Published: 2021-04-21T06:55:24 Last Updated: 2024-08-03T21:55:12.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. Additional Analyst Notes: - CVE Program Container: References: - https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/ - https://security.netapp.
ves/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/ - https://security.netapp.com/advisory/ntap-20210528-0003/
CVE ID: CVE-2021-28966 State: PUBLISHED Published: 2021-07-27T16:01:12 Last Updated: 2024-08-03T21:55:12.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1131465 - https://security.netapp.com/advisory/ntap-20210902-0004/
CVE ID: CVE-2021-28967 State: PUBLISHED Published: 2021-03-24T06:19:25 Last Updated: 2024-08-03T21:55:12.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unofficial MATLAB extension before 2.0.1 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace because of lint configuration settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Gimly/vscode-matlab/releases - https://github.com/Gimly/vscode-matlab/commit/fc5dc53397677464099e80629e785a25718bf5ec - https://marketplace.visualstudio.com/items/Gimly81.matlab/changelog - https://vuln.ryotak.me/advisories/2
CVE ID: CVE-2021-28968 State: PUBLISHED Published: 2021-03-22T15:10:07 Last Updated: 2024-08-03T21:55:12.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authentication) injecting arbitrary JavaScript into any forum message. Additional Analyst Notes: - CVE Program Container: References: - https://punbb.informer.com/
CVE ID: CVE-2021-28969 State: PUBLISHED Published: 2021-04-01T19:47:48 Last Updated: 2024-08-03T21:55:12.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort_by parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3. NOTE: this is different from CVE-2020-25034 and affects newer versions of the software. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-005.txt
CVE ID: CVE-2021-28970 State: PUBLISHED Published: 2021-04-01T19:50:51 Last Updated: 2024-08-03T21:55:12.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the job_id parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-006.txt
CVE ID: CVE-2021-28971 State: PUBLISHED Published: 2021-03-22T16:53:28 Last Updated: 2024-08-03T21:55:12.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d88d05a9e0b6d9356e97129d4ff9942d765f46ea - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproje
5a9e0b6d9356e97129d4ff9942d765f46ea - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTRNPQTZ4GVS46SZ4OBXY5YDOGVPSTGQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VCKIOXCOZGXBEZMO5LGGV5MWCHO6FT3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/ - https://security.netapp.com/advisory/ntap-20210430-0003/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html - https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
CVE ID: CVE-2021-28972 State: PUBLISHED Published: 2021-03-22T16:53:17 Last Updated: 2024-08-03T21:55:12.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc
- CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc7a0bb058b85ea03db87169c60c7cfdd5d34678 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTRNPQTZ4GVS46SZ4OBXY5YDOGVPSTGQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VCKIOXCOZGXBEZMO5LGGV5MWCHO6FT3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/ - https://security.netapp.com/advisory/ntap-20210430-0003/
CVE ID: CVE-2021-28973 State: PUBLISHED Published: 2021-04-13T16:42:03 Last Updated: 2024-08-03T21:55:12.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.compass-security.com/fileadmin/Research/Advisories/2021-01_CSNC-2021-005_Helix_ALM_XXE.txt
CVE ID: CVE-2021-28975 State: PUBLISHED Published: 2021-10-21T15:44:30 Last Updated: 2024-08-03T21:55:12.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_parameter parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.compass-security.com/en/research/advisories/ - https://www.compass-security.com/fileadmin/Research/Advisories/2021-18_CSNC-2021-018-WPMailster_XSS_CSRF.txt
CVE ID: CVE-2021-28976 State: PUBLISHED Published: 2021-06-23T12:36:08 Last Updated: 2024-08-03T21:55:12.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1335
CVE ID: CVE-2021-28977 State: PUBLISHED Published: 2021-06-23T12:44:04 Last Updated: 2024-08-03T21:55:12.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files, Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1336
CVE ID: CVE-2021-28979 State: PUBLISHED Published: 2021-06-16T11:32:44 Last Updated: 2024-08-03T21:55:12.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. Additional Analyst Notes: - CVE Program Container: References: - http://thales.com - https://www.gruppotim.it/redteam - http://safenet.com
CVE ID: CVE-2021-28993 State: PUBLISHED Published: 2021-06-30T12:18:39 Last Updated: 2024-08-03T21:55:12.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plixer Scrutinizer 19.0.2 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). Additional Analyst Notes: - CVE Program Container: References: - http://plixer.com - https://docs.plixer.com/projects/scrutinizer/en/19.1.0/system/changelog.html
CVE ID: CVE-2021-28994 State: PUBLISHED Published: 2021-03-31T22:11:56 Last Updated: 2024-08-03T21:55:12.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/03/19/6 - http://www.openwall.com/lists/oss-security/2021/04/01/1 - http://www.openwall.com/lists/oss-security/2021/04/25/1
CVE ID: CVE-2021-28998 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T14:51:27.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2021/Mar/50 - https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/file_upload_RCE/File_upload_to_RCE.md
CVE ID: CVE-2021-28999 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T16:21:36.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2021/Mar/49 - https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md
CVE ID: CVE-2021-29002 State: PUBLISHED Published: 2021-03-24T14:22:30 Last Updated: 2024-08-03T21:55:12.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49668 - https://github.com/plone/Products.CMFPlone/issues/3255
CVE ID: CVE-2021-29003 State: PUBLISHED Published: 2021-04-13T05:40:12 Last Updated: 2024-08-03T21:55:12.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI. Additional Analyst Notes: - CVE Program Container: References: - https://hackerworld.home.blog/2021/03/19/rce-in-genexis-router/ - http://packetstormsecurity.com/files/162174/Genexis-PLATINUM-4410-2.1-P4410-V2-1.28-Remote-Command-Execution.html
CVE ID: CVE-2021-29004 State: PUBLISHED Published: 2021-10-11T11:58:33 Last Updated: 2024-08-03T21:55:12.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely. Additional Analyst Notes: - CVE Program Container: References: - http://rconfig.com - https://rconfig.com - https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29004-POC-req.txt - https://github.com/mrojz/rconfig-exploit/blob/main/README.md
CVE ID: CVE-2021-29005 State: PUBLISHED Published: 2021-10-11T12:04:49 Last Updated: 2024-08-03T21:55:12.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may let an attacker with low privilege to gain root access on server. Additional Analyst Notes: - CVE Program Container: References: - http://rconfig.com - https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29005-POC.sh
CVE ID: CVE-2021-29006 State: PUBLISHED Published: 2021-10-11T12:02:32 Last Updated: 2024-08-03T21:55:12.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server. Additional Analyst Notes: - CVE Program Container: References: - http://rconfig.com - https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29006-POC.py
CVE ID: CVE-2021-29008 State: PUBLISHED Published: 2021-03-25T19:21:39 Last Updated: 2024-08-03T21:55:12.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the "to_time" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seopanel/Seo-Panel/issues/211
CVE ID: CVE-2021-29009 State: PUBLISHED Published: 2021-03-25T19:21:45 Last Updated: 2024-08-03T21:55:12.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "type" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seopanel/Seo-Panel/issues/210
CVE ID: CVE-2021-29010 State: PUBLISHED Published: 2021-03-25T19:21:50 Last Updated: 2024-08-03T21:55:12.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "report_type" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seopanel/Seo-Panel/issues/212
CVE ID: CVE-2021-29011 State: PUBLISHED Published: 2021-04-02T12:53:26 Last Updated: 2024-08-03T21:55:12.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php). Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/radiusmanager/ - https://github.com/1d8/publications/tree/main/cve-2021-29011 - http://packetstormsecurity.com/files/164154/DMA-Softlab-Radius-Manager-4.4.0-Session-Management-Cross-Site-Scripting.html
CVE ID: CVE-2021-29012 State: PUBLISHED Published: 2021-04-02T12:51:29 Last Updated: 2024-08-03T21:55:12.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid (temporarily) during times when the admin is logged out. In other words, the cookie is functionally equivalent to a static password, and thus provides permanent access if stolen. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/radiusmanager/ - https://github.com/1d8/publications/tree/main/cve-2021-29012 - http://packetstormsec