Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-35132 State: PUBLISHED Published: 2022-09-02T11:31:00 Last Updated: 2024-08-04T00:33:51.259Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables Problem Types: Use of Out-of-range Pointer Offset in DSP Service Description: Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables Additiona
agon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/july-2022-bulletin
CVE ID: CVE-2021-35133 State: PUBLISHED Published: 2022-09-02T11:31:00 Last Updated: 2024-08-04T00:33:51.177Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile Problem Types: Use After Free in Automotive OS Description: Use after free in the synx driver issue while performing other functions during multiple invocation of synx release calls in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/july-2022-bulletin
CVE ID: CVE-2021-35134 State: PUBLISHED Published: 2022-09-02T11:31:01 Last Updated: 2024-08-04T00:33:51.174Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile Problem Types: Incorrect Calculation of Buffer Size in Boot Description: Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/august-202
yst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/august-2022-bulletin
CVE ID: CVE-2021-35135 State: PUBLISHED Published: 2022-09-02T11:31:03 Last Updated: 2024-08-04T00:33:51.106Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Problem Types: NULL Pointer Dereference in QTEE Description: A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdrago
Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/july-2022-bulletin
CVE ID: CVE-2021-35193 State: PUBLISHED Published: 2021-07-30T18:32:55 Last Updated: 2024-08-04T00:33:51.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers' installations (that have the same software version). This provides remote access to SQL database credentials. (In the normal use of the product, retrieving those credentials only occurs after a username/password authentication step; however, this authentication step is on the client side, and an attacker can develop their own client that skips this step.) Additional Analyst Notes: - CVE Pr
the client side, and an attacker can develop their own client that skips this step.) Additional Analyst Notes: - CVE Program Container: References: - http://patterson.eaglesoft.net/Home/Contact-Us - https://justinshafer.blogspot.com/2021/07/eaglesoft-18-through-21-vulnerability.html - https://github.com/jshafer817/Eaglesoft
CVE ID: CVE-2021-35196 State: PUBLISHED Published: 2021-06-21T22:21:39 Last Updated: 2024-08-04T00:33:51.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's position is that the product is not intended for opening an untrusted project file Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/olivierkes/manuskript/issues/891 - https://www.pizzapower.me/2021/06/20/arbitrary-code-execution-in-m
https://github.com/olivierkes/manuskript/issues/891 - https://www.pizzapower.me/2021/06/20/arbitrary-code-execution-in-manuskript-0-12/
CVE ID: CVE-2021-35197 State: PUBLISHED Published: 2021-07-02T12:28:45 Last Updated: 2024-08-04T00:33:51.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented). Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T280226 - https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6AP
ttps://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6APXHP/ - https://security.gentoo.org/glsa/202107-40 - https://www.debian.org/security/2021/dsa-4979 - https://lists.debian.org/debian-lts-announce/2021/10/msg00003.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
CVE ID: CVE-2021-35198 State: PUBLISHED Published: 2021-09-30T17:52:19 Last Updated: 2024-08-04T00:33:51.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2021-35199 State: PUBLISHED Published: 2021-09-30T17:57:05 Last Updated: 2024-08-04T00:33:51.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2021-35200 State: PUBLISHED Published: 2021-09-30T17:28:32 Last Updated: 2024-08-04T00:33:51.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2021-35201 State: PUBLISHED Published: 2021-09-30T17:21:19 Last Updated: 2024-08-04T00:33:51.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2021-35202 State: PUBLISHED Published: 2021-09-30T17:19:20 Last Updated: 2024-08-04T00:33:51.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2021-35203 State: PUBLISHED Published: 2021-09-30T17:14:40 Last Updated: 2024-08-04T00:33:51.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2021-35204 State: PUBLISHED Published: 2021-09-30T17:12:38 Last Updated: 2024-08-04T00:33:51.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2021-35205 State: PUBLISHED Published: 2021-09-30T17:46:24 Last Updated: 2024-08-04T00:33:51.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2021-35206 State: PUBLISHED Published: 2021-06-22T13:38:50 Last Updated: 2024-08-04T00:33:51.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitpod before 0.6.0 allows unvalidated redirects. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gitpod-io/gitpod/pull/2879 - https://github.com/gitpod-io/gitpod/pull/2879#issuecomment-865662372 - https://github.com/gitpod-io/gitpod/pull/4567 - https://www.gitpod.io/changelog - https://github.com/gitpod-io/gitpod/blob/main/CHANGELOG.md - https://github.com/gitpod-io/gitpod/commit/8ca431f86ae3a6f9a17afcfed51cdd065fcff1a5 - https://github.com/gitpod-io/gitpod/compare/0.6.0-beta5...0.6.0 - ht
d/commit/8ca431f86ae3a6f9a17afcfed51cdd065fcff1a5 - https://github.com/gitpod-io/gitpod/compare/0.6.0-beta5...0.6.0 - https://github.com/gitpod-io/gitpod/pull/4567/commits/f78b7d18e509e28e71b65bbd4dfd52c16ca57c18
CVE ID: CVE-2021-35207 State: PUBLISHED Published: 2021-07-02T18:55:00 Last Updated: 2024-08-04T00:33:51.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Rele
iki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16 - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23
CVE ID: CVE-2021-35208 State: PUBLISHED Published: 2021-07-02T18:54:54 Last Updated: 2024-08-04T00:33:51.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/
imbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16 - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23 - https://blog.sonarsource.com/zimbra-webmail-compromise-via-email
CVE ID: CVE-2021-35209 State: PUBLISHED Published: 2021-07-02T18:54:43 Last Updated: 2024-08-04T00:33:51.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against the whitelist of hosts Zimbra is allowed to proxy to (the zimbraProxyAllowedDomains setting). Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimb
otes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16 - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23 - https://blog.sonarsource.com/zimbra-webmail-compromise-via-email
CVE ID: CVE-2021-35210 State: PUBLISHED Published: 2021-06-23T09:34:44 Last Updated: 2024-08-04T00:33:51.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end. Additional Analyst Notes: - CVE Program Container: References: - https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021.html - https://github.com/contao/contao/security/advisories/GHSA-h58v-c6rf-g9f7
CVE ID: CVE-2021-35211 State: PUBLISHED Published: 2021-07-14T20:55:25.167Z Last Updated: 2025-10-21T23:25:40.369Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U Managed File Transfer Server and Serv-U Secured FTP Problem Types: Memory Escape Vulnerability in Solarwinds Serv-U Description: Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are a
e hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211 - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit
CVE ID: CVE-2021-35212 State: PUBLISHED Published: 2021-08-31T17:00:15 Last Updated: 2024-08-04T00:33:51.205Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: SolarWinds Products: Orion Platform Problem Types: Blind SQL injection Vulnerability Description: An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/conte
Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35212 - https://www.zerodayinitiative.com/advisories/ZDI-21-1243/
CVE ID: CVE-2021-35213 State: PUBLISHED Published: 2021-08-31T15:58:48.612191Z Last Updated: 2024-09-16T20:26:26.768Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: SolarWinds Products: Orion Platform Problem Types: CWE-284 Description: An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-s
CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35213 - https://www.zerodayinitiative.com/advisories/ZDI-21-1244/
CVE ID: CVE-2021-35214 State: PUBLISHED Published: 2021-10-12T15:18:07 Last Updated: 2024-08-04T00:33:51.181Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: SolarWinds Products: Pingdom Problem Types: Session Management Vulnerability in Pingdom Description: The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021. Additional Analyst Notes: - CVE Program Contai
ing the user session. This issue has been resolved on September 13, 2021. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214
CVE ID: CVE-2021-35215 State: PUBLISHED Published: 2021-09-01T14:21:46.258591Z Last Updated: 2024-09-16T19:52:15.792Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: SolarWinds Products: Orion Platform Problem Types: CWE-502 Description: Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35215 - https://do
/core-secure-configuration.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35215 - https://documentation.solarwinds.co/enm/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm - https://www.zerodayinitiative.com/advisories/ZDI-21-1245/
CVE ID: CVE-2021-35216 State: PUBLISHED Published: 2021-09-01T14:23:01 Last Updated: 2024-08-04T00:33:51.219Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: SolarWinds Products: Patch Manager Problem Types: CWE-502 Description: Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-
er: References: - https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35216 - https://www.zerodayinitiative.com/advisories/ZDI-21-1246/
CVE ID: CVE-2021-35217 State: PUBLISHED Published: 2021-09-08T13:15:03.615945Z Last Updated: 2024-09-16T20:58:13.615Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: SolarWinds Products: Orion Platform Problem Types: Insecure Deserialization of untrusted data causing Remote code execution vulnerability. Description: Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data. Additional Analyst Notes: - CVE Program Container: References: - htt
syncExecuteTasks deserialization of untrusted data. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217 - https://www.zerodayinitiative.com/advisories/ZDI-21-1247/
CVE ID: CVE-2021-35218 State: PUBLISHED Published: 2021-09-01T14:24:13 Last Updated: 2024-08-04T00:33:51.326Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: SolarWinds Products: Patch Manager Problem Types: CWE-502 Description: Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm - htt
/documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35218 - https://www.zerodayinitiative.com/advisories/ZDI-21-1248/
CVE ID: CVE-2021-35219 State: PUBLISHED Published: 2021-08-31T11:01:50 Last Updated: 2024-08-04T00:33:51.192Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: SolarWinds Products: Orion Platform Problem Types: Remote Command Injection Description: ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35219 - https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-ExportToPdfCmd-Arbitrary-File-Read-Information-Disclosure-CVE-2021-35219?langua
com/SuccessCenter/s/article/Mitigate-the-ExportToPdfCmd-Arbitrary-File-Read-Information-Disclosure-CVE-2021-35219?language=en_US - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US
CVE ID: CVE-2021-35220 State: PUBLISHED Published: 2021-08-31T11:03:45 Last Updated: 2024-08-04T00:33:51.199Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: SolarWinds Products: Orion Platform Problem Types: Remote Command Injection Description: Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35220 - https://support.solarwinds.com/SuccessCente