Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-42299 State: PUBLISHED Published: 2021-10-20T21:15:10 Last Updated: 2024-08-04T03:30:38.347Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N/E:P/RL:U/RC:C) Vendors: Microsoft Products: Microsoft Surface Pro 3 Problem Types: Security Feature Bypass Description: Microsoft Surface Pro 3 Security Feature Bypass Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42299
CVE ID: CVE-2021-42300 State: PUBLISHED Published: 2021-11-10T00:47:31 Last Updated: 2024-08-04T03:30:38.200Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Sphere Problem Types: Tampering Description: Azure Sphere Tampering Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42300
CVE ID: CVE-2021-42301 State: PUBLISHED Published: 2021-11-10T00:47:32 Last Updated: 2024-08-04T03:30:38.126Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Real Time Operating System Problem Types: Information Disclosure Description: Azure RTOS Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42301
CVE ID: CVE-2021-42302 State: PUBLISHED Published: 2021-11-10T00:47:34 Last Updated: 2024-08-04T03:30:38.336Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Real Time Operating System Problem Types: Elevation of Privilege Description: Azure RTOS Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42302
CVE ID: CVE-2021-42303 State: PUBLISHED Published: 2021-11-10T00:47:35 Last Updated: 2024-11-18T20:29:39.576Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Real Time Operating System Problem Types: Elevation of Privilege Description: Azure RTOS Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42303
CVE ID: CVE-2021-42304 State: PUBLISHED Published: 2021-11-10T00:47:37 Last Updated: 2024-08-04T03:30:38.251Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Real Time Operating System Problem Types: Elevation of Privilege Description: Azure RTOS Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42304
CVE ID: CVE-2021-42305 State: PUBLISHED Published: 2021-11-10T00:47:38 Last Updated: 2024-08-04T03:30:38.241Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 21, Microsoft Exchange Server 2019 Cumulative Update 10, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11 Problem Types: Spoofing Description: Microsoft Exchange Server Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/a
tional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42305
CVE ID: CVE-2021-42306 State: PUBLISHED Published: 2021-11-24T01:05:13 Last Updated: 2024-08-04T03:30:38.252Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Automation, Azure Active Directory, Azure Site Recovery, Azure Migrate Problem Types: Elevation of Privilege Description: An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential on an Azure AD Application or Service Principal (which is not recommended). This vulnerability allows a user or service in the tenant with application read access to read the p
s not recommended). This vulnerability allows a user or service in the tenant with application read access to read the private key data that was added to the application. Azure AD addressed this vulnerability by preventing disclosure of any private key values added to the application. Microsoft has identified services that could manifest this vulnerability, and steps that customers should take to be protected. Refer to the FAQ section for more information. For more details on this issue, please refer to the MSRC Blog Entry. Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42306
CVE ID: CVE-2021-42307 State: PUBLISHED Published: 2023-06-30T23:08:37.767Z Last Updated: 2025-04-14T22:46:49.741Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: Information Disclosure Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42307
CVE ID: CVE-2021-42308 State: PUBLISHED Published: 2021-11-24T01:05:13 Last Updated: 2024-08-04T03:30:38.247Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: Spoofing Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42308
CVE ID: CVE-2021-42309 State: PUBLISHED Published: 2021-12-15T14:14:56 Last Updated: 2024-08-04T03:30:38.283Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, Microsoft SharePoint Foundation 2013 Service Pack 1 Problem Types: Remote Code Execution Description: Microsoft SharePoint Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42309 - https://www.zerodayinitiative.co
: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42309 - https://www.zerodayinitiative.com/advisories/ZDI-22-074/
CVE ID: CVE-2021-42310 State: PUBLISHED Published: 2021-12-15T14:14:57 Last Updated: 2024-08-04T03:30:38.339Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for IoT Problem Types: Remote Code Execution Description: Microsoft Defender for IoT Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42310
CVE ID: CVE-2021-42311 State: PUBLISHED Published: 2021-12-15T14:14:57 Last Updated: 2024-08-04T03:30:38.362Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for IoT Problem Types: Remote Code Execution Description: Microsoft Defender for IoT Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42311 - https://www.zerodayinitiative.com/advisories/ZDI-21-1556/
CVE ID: CVE-2021-42312 State: PUBLISHED Published: 2021-12-15T14:14:58 Last Updated: 2024-08-04T03:30:38.263Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for IoT Problem Types: Elevation of Privilege Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42312
CVE ID: CVE-2021-42313 State: PUBLISHED Published: 2021-12-15T14:14:59 Last Updated: 2024-08-04T03:30:38.201Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for IoT Problem Types: Remote Code Execution Description: Microsoft Defender for IoT Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42313 - https://www.zerodayinitiative.com/advisories/ZDI-21-1555/
CVE ID: CVE-2021-42314 State: PUBLISHED Published: 2021-12-15T14:15:00 Last Updated: 2024-11-18T20:18:53.365Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for IoT Problem Types: Remote Code Execution Description: Microsoft Defender for IoT Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42314
CVE ID: CVE-2021-42315 State: PUBLISHED Published: 2021-12-15T14:15:01 Last Updated: 2024-08-04T03:30:38.448Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for IoT Problem Types: Remote Code Execution Description: Microsoft Defender for IoT Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42315
CVE ID: CVE-2021-42316 State: PUBLISHED Published: 2021-11-10T00:47:40 Last Updated: 2024-08-04T03:30:38.453Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Dynamics 365 (on-premises) version 9.1, Microsoft Dynamics 365 (on-premises) version 9.0 Problem Types: Remote Code Execution Description: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42316
CVE ID: CVE-2021-42319 State: PUBLISHED Published: 2021-11-10T00:47:41 Last Updated: 2024-08-04T03:30:38.244Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6), Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8), Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Problem Types: Elevation of Privilege Description: Visual Studio Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/se
ulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42319
CVE ID: CVE-2021-42320 State: PUBLISHED Published: 2021-12-15T14:15:02 Last Updated: 2024-08-04T03:30:38.654Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition Problem Types: Spoofing Description: Microsoft SharePoint Server Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42320
CVE ID: CVE-2021-42321 State: PUBLISHED Published: 2021-11-10T00:47:43.000Z Last Updated: 2025-10-21T23:25:25.274Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Exchange Server 2016 Cumulative Update 21, Microsoft Exchange Server 2019 Cumulative Update 10, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11 Problem Types: Remote Code Execution Description: Microsoft Exchange Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/
CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42321 - http://packetstormsecurity.com/files/166153/Microsoft-Exchange-Server-Remote-Code-Execution.html - http://packetstormsecurity.com/files/168131/Microsoft-Exchange-Server-ChainedSerializationBinder-Remote-Code-Execution.html
CVE ID: CVE-2021-42322 State: PUBLISHED Published: 2021-11-10T00:47:45 Last Updated: 2024-08-04T03:30:38.334Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Visual Studio Code Problem Types: Elevation of Privilege Description: Visual Studio Code Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42322
CVE ID: CVE-2021-42323 State: PUBLISHED Published: 2021-11-10T00:47:46 Last Updated: 2024-08-04T03:30:38.358Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Real Time Operating System Problem Types: Information Disclosure Description: Azure RTOS Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42323
CVE ID: CVE-2021-42324 State: PUBLISHED Published: 2022-04-05T01:05:29 Last Updated: 2024-08-04T03:30:38.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470. Due to improper parameter validation in the console interface, it is possible for a low-privileged authenticated attacker to escape the sandbox environment and execute system commands as root via shell metacharacters in the capture command parameters. Command output will be shown on the Serial interface of the device. Exploitation requires both credentials and physical access. Additional Analyst Notes: - CVE Program Container: Refe
ice. Exploitation requires both credentials and physical access. Additional Analyst Notes: - CVE Program Container: References: - https://www.dcneurope.eu/products/switches/s4600-10p-si - https://exatel.pl/cve-2021-42324-metacharacter-injection-w-przelacznikach-dcn-s4600-10p-si/
CVE ID: CVE-2021-42325 State: PUBLISHED Published: 2021-10-12T19:01:48 Last Updated: 2024-08-04T03:30:38.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Froxlor/Froxlor/commit/eb592340b022298f62a0a3e8450dbfbe29585782 - http://packetstormsecurity.com/files/164800/Froxlor-0.10.29.1-SQL-Injection.html - https://www.exploit-db.com/exploits/50502
CVE ID: CVE-2021-42326 State: PUBLISHED Published: 2021-10-12T18:08:53 Last Updated: 2024-08-04T03:30:38.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter. Additional Analyst Notes: - CVE Program Container: References: - https://www.redmine.org/projects/redmine/wiki/Security_Advisories - https://www.redmine.org/news/133 - https://www.redmine.org/projects/redmine/wiki/Changelog_4_2#423-2021-10-10 - https://www.redmine.org/projects/redmine/wiki/Changelog_4_1#415-2021-10-10 - https://lists.debian.org/debian-lts-announce/2021/10/msg00013.html
CVE ID: CVE-2021-42327 State: PUBLISHED Published: 2021-10-21T00:00:00 Last Updated: 2024-08-04T03:30:38.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
nal Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c - https://www.mail-archive.com/amd-gfx%40lists.freedesktop.org/msg69080.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/ - https://security.netapp.com/advisory/ntap-20211118-0005/ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f23750b5b3d98653b31d4469592935ef6364ad67
CVE ID: CVE-2021-42329 State: PUBLISHED Published: 2021-10-15T12:10:29.738803Z Last Updated: 2024-09-17T00:00:29.574Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: ShinHer Information Co., LTD. Products: ShinHer StudyOnline System Problem Types: CWE-79 Description: The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5199-61238-1.html
CVE ID: CVE-2021-42330 State: PUBLISHED Published: 2021-10-15T12:10:31.314922Z Last Updated: 2024-09-16T16:38:14.758Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ShinHer Information Co., LTD. Products: ShinHer StudyOnline System Problem Types: CWE-285 Description: The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5200-3d3ca-1.html
CVE ID: CVE-2021-42331 State: PUBLISHED Published: 2021-10-15T12:10:32.855088Z Last Updated: 2024-09-17T01:56:36.675Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: ShinHer Information Co., LTD. Products: ShinHer StudyOnline System Problem Types: CWE-285 Description: The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5201-dc534-1.html
CVE ID: CVE-2021-42332 State: PUBLISHED Published: 2021-10-15T12:10:34.347013Z Last Updated: 2024-09-17T01:52:02.907Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ShinHer Information Co., LTD. Products: ShinHer StudyOnline System Problem Types: CWE-285 Description: The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5202-49681-1.html
CVE ID: CVE-2021-42333 State: PUBLISHED Published: 2021-10-15T12:10:35.859495Z Last Updated: 2024-09-16T23:56:50.380Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Huachu Digital Technology Co.,Ltd. Products: Easytest Problem Types: CWE-89 Description: The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html
CVE ID: CVE-2021-42334 State: PUBLISHED Published: 2021-10-15T12:10:37.398994Z Last Updated: 2024-09-16T16:17:44.540Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Huachu Digital Technology Co.,Ltd. Products: Easytest Problem Types: CWE-89 Description: The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html
CVE ID: CVE-2021-42335 State: PUBLISHED Published: 2021-10-15T12:10:38.906387Z Last Updated: 2024-09-16T19:05:14.166Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Huachu Digital Technology Co.,Ltd. Products: Easytest Problem Types: CWE-79 Description: Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html
CVE ID: CVE-2021-42336 State: PUBLISHED Published: 2021-10-15T12:10:40.380159Z Last Updated: 2024-09-16T16:33:19.781Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Huachu Digital Technology Co.,Ltd. Products: Easytest Problem Types: CWE-285 Description: The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html
CVE ID: CVE-2021-42337 State: PUBLISHED Published: 2021-11-16T01:40:13.622076Z Last Updated: 2024-09-16T19:51:09.107Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: AIFU Information Technology Co. Products: CASH Problem Types: CWE-285 Description: The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5296-cbf80-1.html
CVE ID: CVE-2021-42338 State: PUBLISHED Published: 2021-11-19T09:05:12.132987Z Last Updated: 2024-09-17T00:21:46.974Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: 4MOSAn Products: GCB Doctor Problem Types: CWE-285 Description: 4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5313-45bde-1.html