Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
irmware for RS500-E9-RS4-U, BMC firmware for RS520-E9-RS12-E, BMC firmware for RS520-E9-RS8, BMC firmware for ESC8000 G4, BMC firmware for ESC8000 G4/10G, BMC firmware for RS720-E9-RS12-E, BMC firmware for WS C621E SAGE, BMC firmware for RS500A-E10-PS4, BMC firmware for RS500A-E10-RS4, BMC firmware for RS700A-E9-RS12V2, BMC firmware for RS700A-E9-RS4V2, BMC firmware for RS720A-E9-RS12V2, BMC firmware for RS720A-E9-RS24V2, BMC firmware for Z11PR-D16 Problem Types: CWE-120 Description: The Service configuration-2 function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permi
CVE ID: CVE-2021-28203 State: PUBLISHED Published: 2021-04-06T05:02:20.959775Z Last Updated: 2024-09-16T23:51:25.462Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-78 Description: The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - ht
Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4573-aa336-1.html
CVE ID: CVE-2021-28204 State: PUBLISHED Published: 2021-04-06T05:02:21.835796Z Last Updated: 2024-09-17T03:38:49.311Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-78 Description: The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Produ
mand arbitrary. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4574-b61a6-1.html
CVE ID: CVE-2021-28205 State: PUBLISHED Published: 2021-04-06T05:02:22.632520Z Last Updated: 2024-09-17T02:21:06.092Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-22 Description: The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Produc
system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4575-2e32d-1.html
CVE ID: CVE-2021-28206 State: PUBLISHED Published: 2021-04-06T05:02:23.403467Z Last Updated: 2024-09-16T20:26:15.698Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ASUS Products: BMC firmware for ASMB9-iKVM, BMC firmware for RS720A-E9-RS24-E, BMC firmware for RS700A-E9-RS4, BMC firmware for RS700-E9-RS4, BMC firmware for ESC4000 G4X, BMC firmware for RS700-E9-RS12, BMC firmware for RS100-E10-PI2, BMC firmware for RS300-E10-PS4, BMC firmware for RS300-E10-RS4, BMC firmware for RS500A-E9-PS4, BMC firmware for RS500A-E9-RS4, BMC firmware for RS500A-E9 RS4, BMC firmware for E700 G4, BMC firmware for WS C422 PRO/SE, BMC firmware for WS X299 PRO/SE, BMC firmware
irmware for RS500-E9-RS4-U, BMC firmware for RS520-E9-RS12-E, BMC firmware for RS520-E9-RS8, BMC firmware for ESC8000 G4, BMC firmware for ESC8000 G4/10G, BMC firmware for RS720-E9-RS12-E, BMC firmware for WS C621E SAGE, BMC firmware for RS500A-E10-PS4, BMC firmware for RS500A-E10-RS4, BMC firmware for RS700A-E9-RS12V2, BMC firmware for RS700A-E9-RS4V2, BMC firmware for RS720A-E9-RS12V2, BMC firmware for RS720A-E9-RS24V2, BMC firmware for Z11PR-D16 Problem Types: CWE-22 Description: The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means
) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4576-422ac-1.html
CVE ID: CVE-2021-28207 State: PUBLISHED Published: 2021-04-06T05:02:24.218556Z Last Updated: 2024-09-16T20:53:18.242Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ASUS Products: BMC firmware for ASMB9-iKVM, BMC firmware for RS720A-E9-RS24-E, BMC firmware for RS700A-E9-RS4, BMC firmware for RS700-E9-RS4, BMC firmware for ESC4000 G4X, BMC firmware for RS700-E9-RS12, BMC firmware for RS100-E10-PI2, BMC firmware for RS300-E10-PS4, BMC firmware for RS300-E10-RS4, BMC firmware for RS500A-E9-PS4, BMC firmware for RS500A-E9-RS4, BMC firmware for RS500A-E9 RS4, BMC firmware for E700 G4, BMC firmware for WS C422 PRO/SE, BMC firmware for WS X299 PRO/SE, BMC firmware
irmware for RS500-E9-RS4-U, BMC firmware for RS520-E9-RS12-E, BMC firmware for RS520-E9-RS8, BMC firmware for ESC8000 G4, BMC firmware for ESC8000 G4/10G, BMC firmware for RS720-E9-RS12-E, BMC firmware for WS C621E SAGE, BMC firmware for RS500A-E10-PS4, BMC firmware for RS500A-E10-RS4, BMC firmware for RS700A-E9-RS12V2, BMC firmware for RS700A-E9-RS4V2, BMC firmware for RS720A-E9-RS12V2, BMC firmware for RS720A-E9-RS24V2, BMC firmware for Z11PR-D16 Problem Types: CWE-22 Description: The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of p
es not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4577-60153-1.html
CVE ID: CVE-2021-28208 State: PUBLISHED Published: 2021-04-06T05:02:25.088577Z Last Updated: 2024-09-16T22:19:36.654Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ASUS Products: BMC firmware for ASMB9-iKVM, BMC firmware for RS720A-E9-RS24-E, BMC firmware for RS700A-E9-RS4, BMC firmware for RS700-E9-RS4, BMC firmware for ESC4000 G4X, BMC firmware for RS700-E9-RS12, BMC firmware for RS100-E10-PI2, BMC firmware for RS300-E10-PS4, BMC firmware for RS300-E10-RS4, BMC firmware for RS500A-E9-PS4, BMC firmware for RS500A-E9-RS4, BMC firmware for RS500A-E9 RS4, BMC firmware for E700 G4, BMC firmware for WS C422 PRO/SE, BMC firmware for WS X299 PRO/SE, BMC firmware
irmware for RS500-E9-RS4-U, BMC firmware for RS520-E9-RS12-E, BMC firmware for RS520-E9-RS8, BMC firmware for ESC8000 G4, BMC firmware for ESC8000 G4/10G, BMC firmware for RS720-E9-RS12-E, BMC firmware for WS C621E SAGE, BMC firmware for RS500A-E10-PS4, BMC firmware for RS500A-E10-RS4, BMC firmware for RS700A-E9-RS12V2, BMC firmware for RS700A-E9-RS4V2, BMC firmware for RS720A-E9-RS12V2, BMC firmware for RS720A-E9-RS24V2, BMC firmware for Z11PR-D16 Problem Types: CWE-22 Description: The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of
oes not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4578-e5d74-1.html
CVE ID: CVE-2021-28209 State: PUBLISHED Published: 2021-04-06T05:02:25.860876Z Last Updated: 2024-09-16T16:58:26.545Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ASUS Products: BMC firmware for ASMB9-iKVM, BMC firmware for RS720A-E9-RS24-E, BMC firmware for RS700A-E9-RS4, BMC firmware for RS700-E9-RS4, BMC firmware for ESC4000 G4X, BMC firmware for RS700-E9-RS12, BMC firmware for RS100-E10-PI2, BMC firmware for RS300-E10-PS4, BMC firmware for RS300-E10-RS4, BMC firmware for RS500A-E9-PS4, BMC firmware for RS500A-E9-RS4, BMC firmware for RS500A-E9 RS4, BMC firmware for E700 G4, BMC firmware for WS C422 PRO/SE, BMC firmware for WS X299 PRO/SE, BMC firmware
irmware for RS500-E9-RS4-U, BMC firmware for RS520-E9-RS12-E, BMC firmware for RS520-E9-RS8, BMC firmware for ESC8000 G4, BMC firmware for ESC8000 G4/10G, BMC firmware for RS720-E9-RS12-E, BMC firmware for WS C621E SAGE, BMC firmware for RS500A-E10-PS4, BMC firmware for RS500A-E10-RS4, BMC firmware for RS700A-E9-RS12V2, BMC firmware for RS700A-E9-RS4V2, BMC firmware for RS720A-E9-RS12V2, BMC firmware for RS720A-E9-RS24V2, BMC firmware for Z11PR-D16 Problem Types: CWE-22 Description: The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means
) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4579-c8827-1.html
CVE ID: CVE-2021-28210 State: PUBLISHED Published: 2021-06-11T15:11:23 Last Updated: 2024-08-03T21:40:12.971Z Vendors: TianoCore Products: EDK II Problem Types: CWE-674 Description: An unlimited recursion in DxeCore in EDK II. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.tianocore.org/show_bug.cgi?id=1743
CVE ID: CVE-2021-28211 State: PUBLISHED Published: 2021-06-11T15:11:23 Last Updated: 2024-08-03T21:40:13.314Z Vendors: TianoCore Products: EDK II Problem Types: CWE-122 Description: A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.tianocore.org/show_bug.cgi?id=1816
CVE ID: CVE-2021-28213 State: PUBLISHED Published: 2021-06-11T15:11:23 Last Updated: 2024-08-03T21:40:12.905Z Vendors: TianoCore Products: EDK II Problem Types: Replacing example EDK II encrypted private key stored in PcdIpsecUefiCertificateKey presents potential security risks that will expose manufacturer key pair in EDK II. Description: Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.tianocore.org/show_bug.cgi?id=1866
CVE ID: CVE-2021-28216 State: PUBLISHED Published: 2021-08-05T20:44:13.000Z Last Updated: 2025-11-03T19:25:42.418Z Vendors: TianoCore Products: EDK II Problem Types: CWE-587 Description: BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.tianocore.org/show_bug.cgi?id=2957
CVE ID: CVE-2021-28233 State: PUBLISHED Published: 2021-08-27T18:34:18 Last Updated: 2024-08-03T21:40:13.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brackeen/ok-file-formats/issues/11
CVE ID: CVE-2021-28235 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-18T17:09:40.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://etcd.com - https://github.com/etcd-io/etcd - https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png - https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png - https://github.com/etcd-io/etcd/pull/15648
CVE ID: CVE-2021-28236 State: PUBLISHED Published: 2021-12-02T21:47:39 Last Updated: 2024-08-03T21:40:12.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/324
CVE ID: CVE-2021-28237 State: PUBLISHED Published: 2021-12-02T21:47:40 Last Updated: 2024-08-03T21:40:13.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/325
CVE ID: CVE-2021-28242 State: PUBLISHED Published: 2021-04-15T13:51:23 Last Updated: 2024-08-03T21:40:12.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cf_name" parameter when creating a new filter under the "Collections" tab. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/b2evolution/b2evolution/issues/109 - https://deadsh0t.medium.com/authenticated-boolean-based-blind-error-based-sql-injection-b752225f0644 - http://packetstormsecurity.com/files/162489/b2evolution-7-
-boolean-based-blind-error-based-sql-injection-b752225f0644 - http://packetstormsecurity.com/files/162489/b2evolution-7-2-2-SQL-Injection.html
CVE ID: CVE-2021-28245 State: PUBLISHED Published: 2021-03-31T13:32:10 Last Updated: 2024-08-03T21:40:12.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/M40k1n9/vulner/issues/1
CVE ID: CVE-2021-28246 State: PUBLISHED Published: 2021-03-26T07:04:46 Last Updated: 2024-08-03T21:40:13.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://n4nj0.github
aintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE ID: CVE-2021-28247 State: PUBLISHED Published: 2021-03-26T07:09:37 Last Updated: 2024-08-03T21:40:12.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the platform users. The affected endpoints are: cgi/nhWeb with the parameter report, aviewbin/filtermibobjects.pl with the parameter namefilter, and aviewbin/query.pl with the parameters System, SystemText, Group, and GroupText. NOTE: Th
h the parameter namefilter, and aviewbin/query.pl with the parameters System, SystemText, Group, and GroupText. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE ID: CVE-2021-28248 State: PUBLISHED Published: 2021-03-26T07:14:33 Last Updated: 2024-08-03T21:40:12.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://n4nj0.github.io/advisories/ca-ehealth-performance
CISA ADP Vulnrichment: - CVE Program Container: References: - https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE ID: CVE-2021-28249 State: PUBLISHED Published: 2021-03-26T07:11:42 Last Updated: 2024-08-03T21:40:13.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a malicious library in the writable RPATH, to be dynamically linked when the FtpCollector executable is run. The code in the library will be executed as the root user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://n4nj0
are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE ID: CVE-2021-28250 State: PUBLISHED Published: 2021-03-26T07:18:47 Last Updated: 2024-08-03T21:40:13.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the script code will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE ID: CVE-2021-28254 State: PUBLISHED Published: 2023-04-18T00:00:00.000Z Last Updated: 2025-03-05T18:53:58.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://s1mple-top.github.io/2021/03/09/Laravel8-new-pop-chain-mining-process/
CVE ID: CVE-2021-28269 State: PUBLISHED Published: 2021-04-27T14:59:30 Last Updated: 2024-08-03T21:40:14.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5634.php - https://www.exploit-db.com/exploits/49679
CVE ID: CVE-2021-28271 State: PUBLISHED Published: 2021-04-27T12:51:17 Last Updated: 2024-08-03T21:40:13.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: Soyal Technologies SOYAL 701Server 9.0.1 suffers from an elevation of privileges vulnerability which can be used by an authenticated user to change the executable file with a binary choice. The vulnerability is due to improper permissions with the 'F' flag (Full) for 'Everyone'and 'Authenticated Users' group. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities - https://www.exploit-db.com/exploits/49678 - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5633.php
CVE ID: CVE-2021-28275 State: PUBLISHED Published: 2022-03-23T00:00:00 Last Updated: 2024-08-03T21:40:14.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Matthias-Wandel/jhead/issues/17 - https://security.gentoo.org/glsa/202210-17
CVE ID: CVE-2021-28276 State: PUBLISHED Published: 2022-03-23T00:00:00 Last Updated: 2024-08-03T21:40:14.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service vulnerability exists in jhead 3.04 and 3.05 via a wild address read in the ProcessCanonMakerNoteDir function in makernote.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Matthias-Wandel/jhead/issues/1 - https://security.gentoo.org/glsa/202210-17
CVE ID: CVE-2021-28277 State: PUBLISHED Published: 2022-03-23T00:00:00 Last Updated: 2024-08-03T21:40:14.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Matthias-Wandel/jhead/issues/16 - https://security.gentoo.org/glsa/202210-17
CVE ID: CVE-2021-28278 State: PUBLISHED Published: 2022-03-23T00:00:00 Last Updated: 2024-08-03T21:40:12.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in jpgfile.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Matthias-Wandel/jhead/issues/15 - https://security.gentoo.org/glsa/202210-17
CVE ID: CVE-2021-28280 State: PUBLISHED Published: 2021-04-29T14:57:23 Last Updated: 2024-08-03T21:40:13.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML Additional Analyst Notes: - CVE Program Container: References: - https://anotepad.com/notes/2skndayt - https://github.com/PHPFusion/PHPFusion/commit/08d6c2ea49bd06fcce32275252f5f25abe61965c - https://github.com/PHPFusion/PHPFusion/commit/fda266c3bb35c650a8c4c51b6923abdfb66ef5cd - https://github.com/PHPFusion/PHPFusion/commit/1c2b32321cf11ed1cd3ff835f8da0d172c849ce6 - https://github
23abdfb66ef5cd - https://github.com/PHPFusion/PHPFusion/commit/1c2b32321cf11ed1cd3ff835f8da0d172c849ce6 - https://github.com/PHPFusion/PHPFusion/commit/da9f89ae70219f357fba6fffd2dae1ec886d8a3b