Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-38564 State: PUBLISHED Published: 2021-08-11T21:15:40 Last Updated: 2024-08-04T01:44:23.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows an out-of-bounds read via util.scand. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38565 State: PUBLISHED Published: 2021-08-11T21:15:26 Last Updated: 2024-08-04T01:44:23.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows writing to arbitrary files via submitForm. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38566 State: PUBLISHED Published: 2021-08-11T21:15:16 Last Updated: 2024-08-04T01:44:23.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows stack consumption during recursive processing of embedded XML nodes. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38567 State: PUBLISHED Published: 2021-08-11T21:15:05 Last Updated: 2024-08-04T01:44:23.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit PDF Editor before 11.0.1 and PDF Reader before 11.0.1 on macOS. It mishandles missing dictionary entries, leading to a NULL pointer dereference, aka CNVD-C-2021-95204. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38568 State: PUBLISHED Published: 2021-08-11T21:14:51 Last Updated: 2024-08-04T01:44:23.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows memory corruption during conversion of a PDF document to a different document format. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38569 State: PUBLISHED Published: 2021-08-11T21:14:39 Last Updated: 2024-08-04T01:44:23.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms or link objects. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38570 State: PUBLISHED Published: 2021-08-11T21:14:25 Last Updated: 2024-08-04T01:44:23.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38571 State: PUBLISHED Published: 2021-08-11T21:14:13 Last Updated: 2024-08-04T01:44:23.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows DLL hijacking, aka CNVD-C-2021-68000 and CNVD-C-2021-68502. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38572 State: PUBLISHED Published: 2021-08-11T21:13:19 Last Updated: 2024-08-04T01:44:23.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38573 State: PUBLISHED Published: 2021-08-11T21:12:54 Last Updated: 2024-08-04T01:44:23.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38574 State: PUBLISHED Published: 2021-08-11T21:12:14 Last Updated: 2024-08-04T01:44:23.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2021-38575 State: PUBLISHED Published: 2021-12-01T00:00:00.000Z Last Updated: 2025-11-03T19:26:13.152Z Vendors: TianoCore Products: EDK II Problem Types: CWE-124 Description: NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.tianocore.org/show_bug.cgi?id=3356 - https://www.insyde.com/security-pledge/SA-2023025
CVE ID: CVE-2021-38576 State: PUBLISHED Published: 2022-01-03T21:07:45.000Z Last Updated: 2025-11-03T19:26:14.574Z Vendors: n/a Products: EDK II Problem Types: Security Feature Bypass Description: A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.tianocore.org/show_bug.cgi?id=3499
CVE ID: CVE-2021-38577 State: REJECTED Published: N/A Last Updated: 2022-11-30T00:00:00 Description: No description available.
CVE ID: CVE-2021-38578 State: PUBLISHED Published: 2022-03-03T21:53:37.000Z Last Updated: 2025-11-03T19:26:15.934Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: TianoCore Products: EDK II Problem Types: CWE-124 Description: Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.tianocore.org/show_bug.cgi?id=3387 - https://www.insyde.com/security-pledge/SA-2023024
CVE ID: CVE-2021-38583 State: PUBLISHED Published: 2021-08-13T13:36:53 Last Updated: 2024-08-04T01:44:23.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pages: hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view= and data=). Additional Analyst Notes: - CVE Program Container: References: - https://openbaraza.org - https://sourceforge.net/projects/obhrms/?source=directory - https://github.com/charlesbickel/CVE-2021-38583
CVE ID: CVE-2021-38584 State: PUBLISHED Published: 2021-08-11T22:56:10 Last Updated: 2024-08-04T01:44:23.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/98-change-log/
CVE ID: CVE-2021-38585 State: PUBLISHED Published: 2021-08-11T22:55:59 Last Updated: 2024-08-04T01:44:23.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/98-change-log/
CVE ID: CVE-2021-38586 State: PUBLISHED Published: 2021-08-11T22:55:47 Last Updated: 2024-08-04T01:44:23.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/98-change-log/
CVE ID: CVE-2021-38587 State: PUBLISHED Published: 2021-08-11T22:55:37 Last Updated: 2024-08-04T01:44:23.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/96-change-log/
CVE ID: CVE-2021-38588 State: PUBLISHED Published: 2021-08-11T22:55:25 Last Updated: 2024-08-04T01:44:23.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/96-change-log/
CVE ID: CVE-2021-38589 State: PUBLISHED Published: 2021-08-11T22:55:12 Last Updated: 2024-08-04T01:44:23.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/96-change-log/
CVE ID: CVE-2021-38590 State: PUBLISHED Published: 2021-08-11T22:54:59 Last Updated: 2024-08-04T01:44:23.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). Additional Analyst Notes: - CVE Program Container: References: - https://docs.cpanel.net/changelogs/96-change-log/
CVE ID: CVE-2021-38591 State: PUBLISHED Published: 2021-08-11T23:12:24 Last Updated: 2024-08-04T01:44:23.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS P and Q software for mt6762/mt6765/mt6883. Attackers can change some of the NvRAM content by leveraging the misconfiguration of a debug command. The LG ID is LVE-SMP-210005 (August 2021). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2021-38592 State: PUBLISHED Published: 2021-08-12T01:19:57 Last Updated: 2024-08-04T01:44:23.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (called from EvaluateExpression and m3_LoadModule). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33554 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wasm3/OSV-2021-676.yaml
CVE ID: CVE-2021-38593 State: PUBLISHED Published: 2021-08-12T00:00:00 Last Updated: 2024-08-04T01:44:23.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c - https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccd - https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566 -
t/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yaml - https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holders - https://wiki.qt.io/Qt_5.15_Release#Known_Issues - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36VN2WKMNQUSTF6ZW2X52NPAJVXJ4S5I/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HY5YCSDCTLHVMP3OXOM6HNTWHV6DBHDX/ - https://security.gentoo.org/glsa/202402-03
CVE ID: CVE-2021-38597 State: PUBLISHED Published: 2021-08-12T14:26:50 Last Updated: 2024-08-04T01:44:23.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension. Additional Analyst Notes: - CVE Program Container: References: - https://www.wolfssl.com/docs/wolfssl-changelog/ - https://github.com/wolfSSL/wolfssl/commit/f93083be72a3b3d956b52a7ec13f307a27b6e093
CVE ID: CVE-2021-38598 State: PUBLISHED Published: 2021-08-23T04:17:16 Last Updated: 2024-08-04T01:44:23.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Additional Analyst Notes: - CVE Program Container
ases possibly interception of traffic intended for other destinations. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1938670
CVE ID: CVE-2021-38599 State: PUBLISHED Published: 2021-08-12T15:01:17 Last Updated: 2024-08-04T01:44:23.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wal-g/wal-g/pull/1062 - https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3
CVE ID: CVE-2021-38602 State: PUBLISHED Published: 2021-08-12T22:03:45 Last Updated: 2024-08-04T01:44:23.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content. Additional Analyst Notes: - CVE Program Container: References: - https://pluxml.org/download/changelog.txt - https://github.com/KielVaughn/CVE-2021-38602
CVE ID: CVE-2021-38603 State: PUBLISHED Published: 2021-08-12T22:05:57 Last Updated: 2024-08-04T01:44:23.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field. Additional Analyst Notes: - CVE Program Container: References: - https://pluxml.org/download/changelog.txt - https://github.com/KielVaughn/CVE-2021-38603 - http://packetstormsecurity.com/files/163823/PluXML-5.8.7-Cross-Site-Scripting.html
CVE ID: CVE-2021-38604 State: PUBLISHED Published: 2021-08-12T15:43:34.000Z Last Updated: 2025-05-30T19:48:04.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=b805aebd42364fe696e417808a700fdb9800c9e8 - https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=4cc79c217744743077bf7a0ec5e0
bd42364fe696e417808a700fdb9800c9e8 - https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=4cc79c217744743077bf7a0ec5e0a4318f1e6641 - https://sourceware.org/bugzilla/show_bug.cgi?id=28213 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc - https://security.netapp.com/advisory/ntap-20210909-0005/ - https://security.gentoo.org/glsa/202208-24
CVE ID: CVE-2021-38606 State: PUBLISHED Published: 2021-08-12T15:57:18 Last Updated: 2024-08-04T01:44:23.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: reNgine through 0.5 relies on a predictable directory name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yogeshojha/rengine/commit/158367a231335026b8dba633a76b44de290ad37c
CVE ID: CVE-2021-38607 State: PUBLISHED Published: 2021-08-16T12:15:32 Last Updated: 2024-08-04T01:44:23.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input. Additional Analyst Notes: - CVE Program Container: References: - https://crocoblock.com/plugins/jetengine/ - https://crocoblock.com/changelog/?plugin=jet-engine
CVE ID: CVE-2021-38608 State: PUBLISHED Published: 2021-08-16T19:06:57 Last Updated: 2024-08-04T01:44:23.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in Tranquil WAPT Enterprise - before 1.8.2.7373 and before 2.0.0.9450 allows guest OS users to escalate privileges via WAPT Agent. Additional Analyst Notes: - CVE Program Container: References: - https://www.tranquil.it/en/manage-it-equipment/discover-wapt/ - https://www.wapt.fr/fr/doc/wapt-security-bulletin.html
CVE ID: CVE-2021-38611 State: PUBLISHED Published: 2021-08-24T11:05:42 Last Updated: 2024-08-04T01:44:23.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.nascent.com/single-post/2019/01/17/nascent-technology-releases-remkon-31-to-enhance-audio-experience - https://www.blacklanternsecurity.com/2021-08-23-Nascent-RemKon-CVEs/
CVE ID: CVE-2021-38612 State: PUBLISHED Published: 2021-08-24T11:05:49 Last Updated: 2024-08-04T01:44:23.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.nascent.com/single-post/2019/01/17/nascent-technology-releases-remkon-31-to-enhance-audio-experience - https://www.blacklanternsecurity.com/2021-08-23-Nascent-RemKon-CVEs/
CVE ID: CVE-2021-38613 State: PUBLISHED Published: 2021-08-24T11:05:57 Last Updated: 2024-08-04T01:44:23.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.nascent.com/single-post/2019/01/17/nascent-technology-releases-remkon-31-to-enhance-audio-experience - https://www.blacklanternsecurity.com/2021-08-23-Nascent-RemKon-CVEs/
CVE ID: CVE-2021-38614 State: PUBLISHED Published: 2021-08-12T22:17:55 Last Updated: 2024-08-04T01:44:23.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: Polipo through 1.1.1, when NDEBUG is used, allows a heap-based buffer overflow during parsing of a Range header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/07/28/2
CVE ID: CVE-2021-38615 State: PUBLISHED Published: 2021-09-07T11:10:51.000Z Last Updated: 2025-05-30T16:01:51.827Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest, standard, or admin) to view and modify information. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/ - https://eigentech.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2021-38615 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38615
CVE ID: CVE-2021-38616 State: PUBLISHED Published: 2021-09-07T11:21:28.000Z Last Updated: 2025-05-30T16:01:41.560Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AC:L/AV:N/A:L/C:L/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users' profiles and much more. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/ - https://eigentech.com/ - https://excellium-services.com/ce
rences: - https://excellium-services.com/cert-xlm-advisory/ - https://eigentech.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2021-38616 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38616
CVE ID: CVE-2021-38617 State: PUBLISHED Published: 2021-09-07T11:18:00.000Z Last Updated: 2025-05-30T16:01:55.222Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/ - https://eigentech.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2021-38617 - https://cds.thalesgroup.com/en/t
ps://eigentech.com/ - https://excellium-services.com/cert-xlm-advisory/CVE-2021-38617 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38617
CVE ID: CVE-2021-38618 State: PUBLISHED Published: 2021-10-04T17:23:49.000Z Last Updated: 2025-05-30T16:01:43.556Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AC:H/AV:N/A:N/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone (who knows a user's credentials except the password) to get access to an account. This occurs because of JSESSIONID mismanagement. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2021-38618/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38618
CVE ID: CVE-2021-38619 State: PUBLISHED Published: 2021-08-13T14:43:47 Last Updated: 2024-08-04T01:44:23.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) attack against an administrative user from hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view=). Additional Analyst Notes: - CVE Program Container: References: - https://openbaraza.org/ - https://sourceforge.net/projects/obhrms/ - https://github.com/charlesbickel/CVE-2021-38619
CVE ID: CVE-2021-38621 State: PUBLISHED Published: 2021-08-13T14:05:14 Last Updated: 2024-08-04T01:44:23.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netless-io/flat-server/commit/425aa970f6366874c61aa1466527fced5501e476