Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-29615 State: PUBLISHED Published: 2021-05-14T19:25:31 Last Updated: 2024-08-03T22:11:06.342Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-674 Description: TensorFlow is an end-to-end open source platform for machine learning. The implementation of `ParseAttrValue`(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack overflow due to recursion by giving in a specially crafted input. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.
cially crafted input. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qw5h-7f53-xrp6 - https://github.com/tensorflow/tensorflow/commit/e07e1c3d26492c06f078c7e5bf2d138043e199c1
CVE ID: CVE-2021-29616 State: PUBLISHED Published: 2021-05-14T19:25:27 Last Updated: 2024-08-03T22:11:06.093Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-476 Description: TensorFlow is an end-to-end open source platform for machine learning. The implementation of TrySimplify(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/grappler/optimizers/arithmetic_optimizer.cc#L390-L401) has undefined behavior due to dereferencing a null pointer in corner cases that result in optimizing a node with no inputs. The fix will be included in TensorFlow 2.5.0. We will al
n corner cases that result in optimizing a node with no inputs. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvv-7x94-7vq8 - https://github.com/tensorflow/tensorflow/commit/e6340f0665d53716ef3197ada88936c2a5f7a2d3
CVE ID: CVE-2021-29617 State: PUBLISHED Published: 2021-05-14T19:25:23 Last Updated: 2024-08-03T22:11:06.281Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-755 Description: TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container
orFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mmq6-q8r3-48fm - https://github.com/tensorflow/tensorflow/commit/890f7164b70354c57d40eda52dcdd7658677c09f - https://github.com/tensorflow/issues/46900 - https://github.com/tensorflow/issues/46974
CVE ID: CVE-2021-29618 State: PUBLISHED Published: 2021-05-14T19:25:18 Last Updated: 2024-08-03T22:11:06.261Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-755 Description: TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Prog
.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xqfj-cr6q-pc8w - https://github.com/tensorflow/tensorflow/commit/1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88 - https://github.com/tensorflow/issues/42105 - https://github.com/tensorflow/issues/46973
CVE ID: CVE-2021-29619 State: PUBLISHED Published: 2021-05-14T19:25:13 Last Updated: 2024-08-03T22:11:06.083Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-755 Description: TensorFlow is an end-to-end open source platform for machine learning. Passing invalid arguments (e.g., discovered via fuzzing) to `tf.raw_ops.SparseCountSparseOutput` results in segfault. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Progr
2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wvjw-p9f5-vq28 - https://github.com/tensorflow/tensorflow/commit/82e6203221865de4008445b13c69b6826d2b28d9
CVE ID: CVE-2021-29620 State: PUBLISHED Published: 2021-06-23T17:35:11 Last Updated: 2024-08-03T22:11:06.340Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: reportportal Products: reportportal Problem Types: CWE-611 Description: Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal servic
external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/reportportal/reportportal/security/advisories/GHSA-24wf-7vf2-pv59 - https://github.com/reportportal/service-api/pull/1392 - https://mvnrepository.com/artifact/com.epam.reportportal/service-api
CVE ID: CVE-2021-29621 State: PUBLISHED Published: 2021-06-07T19:00:12 Last Updated: 2024-08-03T22:11:06.246Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dpgaspar Products: Flask-AppBuilder Problem Types: CWE-203 Description: Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dpgaspar/Flask-AppBuilder/s
resolve. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-434h-p4gx-jm89 - https://github.com/dpgaspar/Flask-AppBuilder/commit/780bd0e8fbf2d36ada52edb769477e0a4edae580 - https://pypi.org/project/Flask-AppBuilder/ - https://lists.apache.org/thread.html/r5b754118ba4e996adf03863705d34168bffec202da5c6bdc9bf3add5%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r91067f953906d93aaa1c69fe2b5472754019cc6bd4f1ba81349d62a0%40%3Ccommits.airflow.apache.org%3E
CVE ID: CVE-2021-29622 State: PUBLISHED Published: 2021-05-19T20:00:13 Last Updated: 2024-08-03T22:11:06.291Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: prometheus Products: prometheus Problem Types: CWE-601 Description: Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an a
the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7 - https://github.com/prometheus/prometheus/releases/tag/v2.26.1 - https://github.com/prometheus/prometheus/releases/tag/v2.27.1
CVE ID: CVE-2021-29623 State: PUBLISHED Published: 2021-05-13T00:00:00 Last Updated: 2024-08-03T22:11:06.285Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-908 Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker cou
ad of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v - https://github.com/Exiv2/exiv2/pull/1627 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap
ssage/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/ - https://security.gentoo.org/glsa/202312-06
CVE ID: CVE-2021-29624 State: PUBLISHED Published: 2021-05-19T21:15:28 Last Updated: 2024-08-03T22:11:06.350Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: fastify Products: fastify-csrf Problem Types: CWE-565 Description: fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF tok
-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8 - https://github.com/fastify/csrf/pull/2 - https://github.com/fastify/fastify-csrf/pull/51 - https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html - https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0 - https://owasp.org/www-pdf-archive/David_Johansson-Double
- https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0 - https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf
CVE ID: CVE-2021-29625 State: PUBLISHED Published: 2021-05-19T21:35:11 Last Updated: 2024-08-03T22:11:06.269Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vrana Products: adminer Problem Types: CWE-79 Description: Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.
database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc - https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7 - https://sourceforge.net/p/adminer/bugs-and-features/797/
CVE ID: CVE-2021-29626 State: PUBLISHED Published: 2021-04-07T14:48:32 Last Updated: 2024-08-03T22:11:06.402Z Vendors: n/a Products: FreeBSD Problem Types: Use after free memory disclosure Description: In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, copy-on-write logic failed to invalidate shared memory page mappings between multiple processes allowing an unprivileged process to maintain a mapping after it is freed, allowing the process to read private data belonging to other processes or the kernel. Additional Analyst Notes: - CVE Program Container: References: - https://se
belonging to other processes or the kernel. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:08.vm.asc - https://security.netapp.com/advisory/ntap-20210423-0008/
CVE ID: CVE-2021-29627 State: PUBLISHED Published: 2021-04-07T14:45:52 Last Updated: 2024-08-03T22:11:06.343Z Vendors: n/a Products: FreeBSD Problem Types: Double free or use after free Description: In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, listening socket accept filters implementing the accf_create callback incorrectly freed a process supplied argument string. Additional operations on the socket can lead to a double free or use after free. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:09.accept_filter.asc - https://security.netapp.com/advisory/nt
: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:09.accept_filter.asc - https://security.netapp.com/advisory/ntap-20210423-0007/
CVE ID: CVE-2021-29628 State: PUBLISHED Published: 2021-05-28T14:06:12 Last Updated: 2024-08-03T22:11:06.340Z Vendors: n/a Products: FreeBSD Problem Types: Privilege Context Switching Error Description: In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a system call triggering a fault could cause SMAP protections to be disabled for the duration of the system call. This weakness could be combined with other kernel bugs to craft an exploit. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:11.smap.asc - https://security.netapp.com/advisory/ntap-
rences: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:11.smap.asc - https://security.netapp.com/advisory/ntap-20210713-0002/
CVE ID: CVE-2021-29629 State: PUBLISHED Published: 2021-05-28T14:06:47 Last Updated: 2024-08-03T22:11:06.353Z Vendors: n/a Products: FreeBSD Problem Types: Unchecked Input for Loop Condition Description: In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-RELEASE before p7, and 11.4-RELEASE before p10, missing message validation in libradius(3) could allow malicious clients or servers to trigger denial of service in vulnerable servers or clients respectively. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:12.libradius.asc - https://secur
Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:12.libradius.asc - https://security.netapp.com/advisory/ntap-20210713-0003/
CVE ID: CVE-2021-29630 State: PUBLISHED Published: 2021-08-30T18:01:08 Last Updated: 2024-08-03T22:11:06.118Z Vendors: n/a Products: FreeBSD Problem Types: Buffer Copy without Checking Size of Input Description: In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: -
tack of ggatec and potentially execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:14.ggatec.asc - https://security.netapp.com/advisory/ntap-20210923-0005/
CVE ID: CVE-2021-29631 State: PUBLISHED Published: 2021-08-30T18:00:15 Last Updated: 2024-08-03T22:11:06.287Z Vendors: n/a Products: FreeBSD Problem Types: Use of Uninitialized Resource Description: In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, certain VirtIO-based device models in bhyve failed to handle errors when fetching I/O descriptors. A malicious guest may cause the device model to operate on uninitialized I/O vectors leading to memory corruption, crashing of the bhyve process, and possibly arbitrary code execution in the bhyve process. Additional
memory corruption, crashing of the bhyve process, and possibly arbitrary code execution in the bhyve process. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:13.bhyve.asc - https://security.netapp.com/advisory/ntap-20210923-0004/
CVE ID: CVE-2021-29632 State: PUBLISHED Published: 2022-01-18T16:51:45 Last Updated: 2024-08-03T22:11:06.251Z Vendors: n/a Products: FreeBSD Problem Types: Kernel out-of-bounds write condition Description: In FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE before p6, and 12.2-RELEASE before p12, certain conditions involving use of the highlight buffer while text is scrolling on the console, console data may overwrite data structures associated with the system console or other kernel memory. Additional Analyst Notes: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:01.vt.asc - https://security.netapp.com/adv
ntainer: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:01.vt.asc - https://security.netapp.com/advisory/ntap-20220217-0004/
CVE ID: CVE-2021-29633 State: REJECTED Published: N/A Last Updated: 2024-02-15T05:29:48.086Z Description: No description available.
CVE ID: CVE-2021-29634 State: REJECTED Published: N/A Last Updated: 2024-02-15T05:31:17.501Z Description: No description available.
CVE ID: CVE-2021-29635 State: REJECTED Published: N/A Last Updated: 2024-02-15T05:31:20.690Z Description: No description available.
CVE ID: CVE-2021-29636 State: REJECTED Published: N/A Last Updated: 2024-02-15T05:31:23.926Z Description: No description available.
CVE ID: CVE-2021-29637 State: REJECTED Published: N/A Last Updated: 2024-02-15T05:31:27.139Z Description: No description available.
CVE ID: CVE-2021-29638 State: REJECTED Published: N/A Last Updated: 2024-02-15T05:31:30.379Z Description: No description available.
CVE ID: CVE-2021-29639 State: REJECTED Published: N/A Last Updated: 2024-02-15T05:31:33.581Z Description: No description available.
CVE ID: CVE-2021-29640 State: REJECTED Published: N/A Last Updated: 2024-02-15T05:31:36.776Z Description: No description available.
CVE ID: CVE-2021-29641 State: PUBLISHED Published: 2021-04-07T21:31:45 Last Updated: 2024-08-03T22:11:06.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain installations with the Apache HTTP Server and the local-storage driver (e.g., when the product was obtained from hub.docker.com). Additional Analyst Notes: - CVE Program Container: References: - https://hub.docker.com/layers/directus/direc
cker.com). Additional Analyst Notes: - CVE Program Container: References: - https://hub.docker.com/layers/directus/directus/v8.8.2-apache/images/sha256-d9898b6442b0150c3c377b50e706757f35d2d563bd82ddaf97f3ae4ba450a6e6?context=explore - http://seclists.org/fulldisclosure/2021/Apr/14 - https://sec-consult.com/de/vulnerability-lab/advisory/arbitrary-file-upload-and-bypassing-htaccess-rules-in-monospace-directus-headless-cms/ - https://sec-consult.com/vulnerability-lab/advisory/arbitrary-file-upload-and-bypassing-htaccess-rules-in-monospace-directus-headless-cms/ - http://packetstormsecurity.com/files/162118/Monospace-Directus-Headless-CMS-File-Upload-Rule-Bypass.html
CVE ID: CVE-2021-29642 State: PUBLISHED Published: 2021-03-30T18:48:05 Last Updated: 2024-08-03T22:11:06.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lostintangent/gistpad/commit/230b05e8dea8d7ac5aae998bbe0a591d7f081b70 - https://vuln.ryotak.me/advisories/7
CVE ID: CVE-2021-29643 State: PUBLISHED Published: 2021-09-13T14:42:26 Last Updated: 2024-08-03T22:11:06.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: PRTG Network Monitor before 21.3.69.1333 allows stored XSS via an unsanitized string imported from a User Object in a connected Active Directory instance. Additional Analyst Notes: - CVE Program Container: References: - https://raxis.com/blog/prtg-network-monitor-cve-2021-29643 - https://www.paessler.com/prtg/history/stable#21.3.69.1333