Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-33226 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T19:05:39.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/saltstack/salt/blob/master/salt/modules/status.py - https://bugzilla.suse.com/show_bug.cgi?id=1208473
CVE ID: CVE-2021-33231 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-05-08T18:04:33.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbitrary code via the notes field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://easyvista.com - https://armysick.github.io/cve-2021-33231/
CVE ID: CVE-2021-33235 State: REJECTED Published: N/A Last Updated: 2024-05-06T21:35:26.135517 Description: No description available.
CVE ID: CVE-2021-33236 State: REJECTED Published: N/A Last Updated: 2024-05-06T21:32:36.418113 Description: No description available.
CVE ID: CVE-2021-33237 State: REJECTED Published: 2023-02-17T17:30:33.768Z Last Updated: 2025-02-13T15:46:16.111Z Description: No description available.
CVE ID: CVE-2021-33254 State: PUBLISHED Published: 2022-06-01T14:31:57 Last Updated: 2024-08-03T23:42:20.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramter to the parseUri function. Additional Analyst Notes: - CVE Program Container: References: - https://awxylitol.github.io/2021/05/09/embedthis-appweb-npd-bug.html
CVE ID: CVE-2021-33256 State: PUBLISHED Published: 2021-08-09T13:28:42 Last Updated: 2024-08-03T23:42:20.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Report" as CSV file. Note: The vendor disputes this vulnerability, claiming "This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side. Additional Analyst Notes: - CVE Program Container: Ref
ADSSP product. We don't see this as a security issue at our side. Additional Analyst Notes: - CVE Program Container: References: - https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection
CVE ID: CVE-2021-33259 State: PUBLISHED Published: 2021-10-31T18:32:52 Last Updated: 2024-08-03T23:42:20.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users' DNS query history. Additional Analyst Notes: - CVE Program Container: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin/ - http://dir-868lw.com - https://github.com/jayus0821/uai-poc/blob/main/D-Link/DIR-868L/webaccess_UAI.md
CVE ID: CVE-2021-33265 State: PUBLISHED Published: 2021-12-01T21:20:56 Last Updated: 2024-08-03T23:42:20.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_80046eb4 in /formSetPortTr. This vulnerability is triggered via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Lnkvct/IoT-poc/tree/master/D-Link-DIR809/vuln05
CVE ID: CVE-2021-33266 State: PUBLISHED Published: 2021-12-01T21:20:55 Last Updated: 2024-08-03T23:42:20.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_8004776c in /formVirtualApp. This vulnerability is triggered via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Lnkvct/IoT-poc/tree/master/D-Link-DIR809/vuln04
CVE ID: CVE-2021-33267 State: PUBLISHED Published: 2021-12-01T21:20:54 Last Updated: 2024-08-03T23:42:20.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_80034d60 in /formStaticDHCP. This vulnerability is triggered via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Lnkvct/IoT-poc/tree/master/D-Link-DIR809/vuln02
CVE ID: CVE-2021-33268 State: PUBLISHED Published: 2021-12-01T21:20:54 Last Updated: 2024-08-03T23:42:20.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function sub_8003183C in /fromLogin. This vulnerability is triggered via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Lnkvct/IoT-poc/tree/master/D-Link-DIR809/vuln03
CVE ID: CVE-2021-33269 State: PUBLISHED Published: 2021-12-01T21:20:53 Last Updated: 2024-08-03T23:42:20.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_8004776c in /formVirtualServ. This vulnerability is triggered via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Lnkvct/IoT-poc/tree/master/D-Link-DIR809/vuln01
CVE ID: CVE-2021-33270 State: PUBLISHED Published: 2021-12-01T21:20:52 Last Updated: 2024-08-03T23:42:20.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_800462c4 in /formAdvFirewall. This vulnerability is triggered via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Lnkvct/IoT-poc/tree/master/D-Link-DIR809/vuln06
CVE ID: CVE-2021-33271 State: PUBLISHED Published: 2021-12-01T21:20:52 Last Updated: 2024-08-03T23:42:20.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function sub_80046EB4 in /formSetPortTr. This vulnerability is triggered via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Lnkvct/IoT-poc/tree/master/D-Link-DIR809/vuln11
CVE ID: CVE-2021-33274 State: PUBLISHED Published: 2021-12-01T21:20:51 Last Updated: 2024-08-03T23:42:20.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_80040af8 in /formWlanSetup. This vulnerability is triggered via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Lnkvct/IoT-poc/tree/master/D-Link-DIR809/vuln07
CVE ID: CVE-2021-33285 State: PUBLISHED Published: 2021-09-07T00:00:00 Last Updated: 2024-08-03T23:42:20.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records pro
the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2021/08/30/1 - https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp - https://www.openwall.com/lists/oss-security/2021/08/30/1 - https://bugzilla.redhat.com/show_bug.cgi?id=2001608 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386 - https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/ - https:/
project.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html - https://security.gentoo.org/glsa/202301-01
CVE ID: CVE-2021-33286 State: PUBLISHED Published: 2021-09-07T00:00:00 Last Updated: 2024-08-03T23:42:20.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution. Additional Analyst Notes: - CVE Program Container: References: - http://ntfs-3g.com - http://www.openwall.com/lists/oss-security/2021/08/30/1 - https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp - https://www.debian.org/security/2021/dsa-4971 - https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html - https://security.gentoo.org/g
urity/2021/dsa-4971 - https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html - https://security.gentoo.org/glsa/202301-01
CVE ID: CVE-2021-33287 State: PUBLISHED Published: 2021-09-07T00:00:00 Last Updated: 2024-08-03T23:42:20.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application. Additional Analyst Notes: - CVE Program Container: References: - http://ntfs-3g.com - http://tuxera.com - http://www.openwall.com/lists/oss-security/2021/08/30/1 - https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp - https://www.debian.org/security/2021/dsa-4971 - https://lis
com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp - https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html - https://security.gentoo.org/glsa/202301-01
CVE ID: CVE-2021-33289 State: PUBLISHED Published: 2021-09-07T00:00:00 Last Updated: 2024-08-03T23:42:20.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution. Additional Analyst Notes: - CVE Program Container: References: - http://ntfs-3g.com - http://www.openwall.com/lists/oss-security/2021/08/30/1 - https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp - https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766I
ty/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html - https://security.gentoo.org/glsa/202301-01
CVE ID: CVE-2021-33293 State: PUBLISHED Published: 2022-03-10T14:50:28 Last Updated: 2024-08-03T23:42:20.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/u/1/g/hugin-ptx/c/gLtz2vweD74 - https://sourceforge.net/p/panotools/libpano13/ci/62aa7eed8fae5d8f247a2508a757f31000de386f/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00029.html
CVE ID: CVE-2021-33294 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T17:05:29.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=27501 - https://sourceware.org/pipermail/elfutils-devel/2021q1/003607.html
CVE ID: CVE-2021-33295 State: PUBLISHED Published: 2022-06-16T20:36:16 Last Updated: 2024-08-03T23:42:20.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html. Additional Analyst Notes: - CVE Program Container: References: - https://the-it-wonders.blogspot.com/2021/05/joplin-app-desktop-version-vulnerable.html - https://github.com/laurent22/joplin/releases/tag/v1.8.5 - https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf
CVE ID: CVE-2021-33304 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-20T14:05:49.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function pico_fragments_reassemble, allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/virtualsquare/picotcp/issues/6
CVE ID: CVE-2021-33315 State: PUBLISHED Published: 2022-05-11T17:34:24 Last Updated: 2024-08-03T23:50:41.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp related component. Due to lack of proper validation on length field of PortID TLV, by sending a crafted lldp packet to the device, integer underflow would occur and the negative number will be passed to memcpy() later, which may cause buffer overflow or invalid memory access. Additional Analyst Notes: - CVE Program Container: References: - https://www.trendnet.com/support/vi
alid memory access. Additional Analyst Notes: - CVE Program Container: References: - https://www.trendnet.com/support/view.asp?cat=4&id=81
CVE ID: CVE-2021-33316 State: PUBLISHED Published: 2022-05-11T17:34:24 Last Updated: 2024-08-03T23:50:41.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp related component. Due to lack of proper validation on length field of ChassisID TLV, by sending a crafted lldp packet to the device, integer underflow would occur and the negative number will be passed to memcpy() later, which may cause buffer overflow or invalid memory access. Additional Analyst Notes: - CVE Program Container: References: - https://www.trendnet.com/support
invalid memory access. Additional Analyst Notes: - CVE Program Container: References: - https://www.trendnet.com/support/view.asp?cat=4&id=81
CVE ID: CVE-2021-33317 State: PUBLISHED Published: 2022-05-11T17:34:25 Last Updated: 2024-08-03T23:50:41.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from a null pointer dereference vulnerability. This vulnerability exists in its lldp related component. Due to fail to check if ChassisID TLV is contained in the packet, by sending a crafted lldp packet to the device, an attacker can crash the process due to null pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://www.trendnet.com/support/view.asp?cat=4&id=81
CVE ID: CVE-2021-33318 State: PUBLISHED Published: 2022-05-16T15:12:33 Last Updated: 2024-08-03T23:50:41.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jchristn/IpMatcher - https://github.com/jchristn/WatsonWebserver - https://github.com/kaoudis/advisories/blob/main/0-2021.md - https://github.com/j
//github.com/jchristn/WatsonWebserver - https://github.com/kaoudis/advisories/blob/main/0-2021.md - https://github.com/jchristn/IpMatcher/commit/81d77c2f33aa912dbd032b34b9e184fc6e041d89
CVE ID: CVE-2021-33320 State: PUBLISHED Published: 2021-08-03T18:09:17 Last Updated: 2024-08-03T23:50:41.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590 - https://issues.liferay.com/browse/LPE-17007
CVE ID: CVE-2021-33321 State: PUBLISHED Published: 2021-08-03T18:12:26 Last Updated: 2024-08-03T23:50:41.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055 - https://help.liferay.com/hc/en-us/articles/360050785632
CVE ID: CVE-2021-33322 State: PUBLISHED Published: 2021-08-03T18:29:17 Last Updated: 2024-08-03T23:50:42.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020 - https://issues.liferay.com/browse/LPE-16981
CVE ID: CVE-2021-33323 State: PUBLISHED Published: 2021-08-03T18:19:24 Last Updated: 2024-08-03T23:50:41.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107 - https://issues.liferay.com/browse/LPE-17049
CVE ID: CVE-2021-33324 State: PUBLISHED Published: 2021-08-03T18:24:05 Last Updated: 2024-08-03T23:50:42.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063 - https://issues.liferay.com/browse/LPE-17001
CVE ID: CVE-2021-33325 State: PUBLISHED Published: 2021-08-03T18:33:34 Last Updated: 2024-08-03T23:50:42.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user's password. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389 - https://issues.l
.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389 - https://issues.liferay.com/browse/LPE-17042
CVE ID: CVE-2021-33326 State: PUBLISHED Published: 2021-08-03T18:37:32 Last Updated: 2024-08-03T23:50:41.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869 - https://issues.liferay.com/browse/LPE-17093
CVE ID: CVE-2021-33327 State: PUBLISHED Published: 2021-08-03T18:46:02 Last Updated: 2024-08-03T23:50:41.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840 - https://issues.liferay.com/browse/LP