Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-37847 State: PUBLISHED Published: 2021-08-02T19:45:46 Last Updated: 2024-08-04T01:30:08.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saschahauer/barebox/commit/0a9f9a7410681e55362f8311537ebc7be9ad0fbe - https://gist.github.com/gquere/816dfadbad98745090034100a8a651eb
CVE ID: CVE-2021-37848 State: PUBLISHED Published: 2021-08-02T19:46:02 Last Updated: 2024-08-04T01:30:09.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saschahauer/barebox/commit/a3337563c705bc8e0cf32f910b3e9e3c43d962ff - https://gist.github.com/gquere/816dfadbad98745090034100a8a651eb
CVE ID: CVE-2021-37850 State: PUBLISHED Published: 2021-11-08T13:35:49 Last Updated: 2024-08-04T01:30:09.156Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ESET, spol. s r.o. Products: ESET Cyber Security, ESET Cyber Security Pro, ESET Endpoint Antivirus for macOS, ESET Endpoint Security for macOS Problem Types: Denial Of Service Description: ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, effectively disabling the protection of the ESET security product until a system reboot. Additional Analyst Notes: - CVE Program Container: References: - https://s
ESET security product until a system reboot. Additional Analyst Notes: - CVE Program Container: References: - https://support.eset.com/en/ca8151
CVE ID: CVE-2021-37851 State: PUBLISHED Published: 2022-05-11T14:08:03.466440Z Last Updated: 2024-09-16T22:51:23.644Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: ESET, spol. s r.o. Products: ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security Premium, ESET Endpoint Antivirus, ESET Endpoint Security, ESET Server Security for Microsoft Windows Server, ESET File Security for Microsoft Windows Server, ESET Mail Security for Microsoft Exchange Server, ESET Mail Security for IBM Domino, ESET Security for Microsoft SharePoint Server Problem Types: CWE-280 Description: Local privilege escalation in Windows products of ESET allows user who is logged i
r Problem Types: CWE-280 Description: Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher privileges. This issue affects: ESET, spol. s r.o. ESET NOD32 Antivirus 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Internet Security 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Smart Security Premium 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Endpoint Antivirus 6.0 versions prior to 9.0.2046.0; 6.0 versions prior to 8.1.2050.0; 6.0 versions prior to 8.0.2053.0. ESET, spol. s r.o. ESET Endpoint Security 6.0 versions prior to 9.0.2046.0; 6.0
50.0; 6.0 versions prior to 8.0.2053.0. ESET, spol. s r.o. ESET Endpoint Security 6.0 versions prior to 9.0.2046.0; 6.0 versions prior to 8.1.2050.0; 6.0 versions prior to 8.0.2053.0. ESET, spol. s r.o. ESET Server Security for Microsoft Windows Server 8.0 versions prior to 9.0.12012.0. ESET, spol. s r.o. ESET File Security for Microsoft Windows Server 8.0.12013.0. ESET, spol. s r.o. ESET Mail Security for Microsoft Exchange Server 6.0 versions prior to 8.0.10020.0. ESET, spol. s r.o. ESET Mail Security for IBM Domino 6.0 versions prior to 8.0.14011.0. ESET, spol. s r.o. ESET Security for Microsoft SharePoint Server 6.0 versions prior to 8.0.15009.0. Additional Analyst Notes: - CVE Program C
ET Security for Microsoft SharePoint Server 6.0 versions prior to 8.0.15009.0. Additional Analyst Notes: - CVE Program Container: References: - https://support.eset.com/en/ca8268
CVE ID: CVE-2021-37852 State: PUBLISHED Published: 2022-02-09T05:14:13.627605Z Last Updated: 2024-09-16T23:02:00.516Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ESET Products: ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, ESET Endpoint Antivirus for Windows, ESET Endpoint Security for Windows, ESET Server Security for Microsoft Windows Server, ESET File Security for Microsoft Windows Server, ESET Server Security for Microsoft Azure, ESET Security for Microsoft SharePoint Server, ESET Mail Security for IBM Domino, ESET Mail Security for Microsoft Exchange Server Problem Types: Privilege Escalation Description: ESET products for Windows
T Mail Security for Microsoft Exchange Server Problem Types: Privilege Escalation Description: ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows - https://www.zerodayinitiative.com/advisories/ZDI-22-148/
CVE ID: CVE-2021-37853 State: REJECTED Published: 2022-02-09T15:20:00 Last Updated: 2022-02-09T15:20:00 Description: No description available.
CVE ID: CVE-2021-37854 State: REJECTED Published: 2022-02-09T15:20:39 Last Updated: 2022-02-09T15:20:39 Description: No description available.
CVE ID: CVE-2021-37855 State: REJECTED Published: 2022-02-09T15:20:51 Last Updated: 2022-02-09T15:20:51 Description: No description available.
CVE ID: CVE-2021-37856 State: REJECTED Published: 2022-02-09T15:20:57 Last Updated: 2022-02-09T15:20:57 Description: No description available.
CVE ID: CVE-2021-37857 State: REJECTED Published: 2022-02-09T15:21:08 Last Updated: 2022-02-09T15:21:08 Description: No description available.
CVE ID: CVE-2021-37858 State: REJECTED Published: 2022-02-09T15:21:14 Last Updated: 2022-02-09T15:21:14 Description: No description available.
CVE ID: CVE-2021-37859 State: PUBLISHED Published: 2021-08-05T19:40:10 Last Updated: 2024-08-04T01:30:09.121Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-79 Description: Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost. Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2021-37860 State: PUBLISHED Published: 2021-09-22T16:40:43 Last Updated: 2024-08-04T01:30:09.076Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-79 Description: Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP. Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2021-37861 State: PUBLISHED Published: 2021-12-09T21:32:28 Last Updated: 2024-08-04T01:30:08.712Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-532 Description: Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails. Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2021-37862 State: PUBLISHED Published: 2021-12-17T16:10:29 Last Updated: 2024-08-04T01:30:09.135Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-754 Description: Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token. Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/security-updates/ - https://hackerone.com/reports/1357013
CVE ID: CVE-2021-37863 State: PUBLISHED Published: 2021-12-17T16:10:30 Last Updated: 2024-08-04T01:30:08.631Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-20 Description: Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post. Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/security-updates/ - https://hackerone.com/reports/1253732
CVE ID: CVE-2021-37864 State: PUBLISHED Published: 2022-01-18T16:52:19 Last Updated: 2024-12-06T23:11:16.668Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2021-37865 State: PUBLISHED Published: 2022-01-18T16:51:48 Last Updated: 2024-12-06T23:11:51.183Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/ - https://hackerone.com/reports/1428260
CVE ID: CVE-2021-37866 State: PUBLISHED Published: 2022-01-18T16:52:16 Last Updated: 2024-12-06T23:11:40.140Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Boards Problem Types: CWE-613 Description: Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/ - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-37866
CVE ID: CVE-2021-37867 State: PUBLISHED Published: 2022-01-18T16:52:17 Last Updated: 2024-12-06T23:11:27.811Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Boards Problem Types: CWE-200 Description: Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2021-37909 State: PUBLISHED Published: 2021-09-15T19:10:22.691086Z Last Updated: 2024-09-17T00:42:01.361Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CHANGING Inc. Products: TSSServiSignAdapter Problem Types: CWE-20 Description: WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html
CVE ID: CVE-2021-37910 State: PUBLISHED Published: 2021-11-12T01:40:13.569980Z Last Updated: 2024-09-16T19:05:28.405Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ASUS Products: GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 Problem Types: CWE-799 Description: ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html
CVE ID: CVE-2021-37911 State: PUBLISHED Published: 2021-08-30T14:35:11.642555Z Last Updated: 2024-09-16T20:27:17.520Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BenQ Products: EH600 OTA Problem Types: CWE-269 Description: The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any system directory of this device through the interface and execute arbitrary commands if he enters the local subnetwork. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5047-7ef35-1.html
CVE ID: CVE-2021-37912 State: PUBLISHED Published: 2021-09-15T19:10:24.238885Z Last Updated: 2024-09-17T01:06:08.105Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: OAKlouds OAKSv2, OAKlouds OAKSv3 Problem Types: CWE-78 Description: The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5091-7e0c5-1.html
CVE ID: CVE-2021-37913 State: PUBLISHED Published: 2021-09-15T19:10:25.840309Z Last Updated: 2024-09-16T17:18:49.201Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: OAKlouds OAKSv2, OAKlouds OAKSv3 Problem Types: CWE-78 Description: The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5092-f88e2-1.html
CVE ID: CVE-2021-37914 State: PUBLISHED Published: 2021-08-02T23:17:45 Last Updated: 2024-08-04T01:30:09.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/argoproj/argo-workflows/issues/6441 - https://github.com/argoproj/argo-workflows/pull/6442
CVE ID: CVE-2021-37915 State: PUBLISHED Published: 2021-10-28T11:11:29 Last Updated: 2024-08-04T01:30:09.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_server variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined host. Additional Analyst Notes: - CVE Program Container: References: - http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801 - http://firmware.grandstream.com/BETA/Release_Note_HT80x_1.0.29.8.p
ys-and-atas/analog-telephone-adaptors/product/ht801 - http://firmware.grandstream.com/BETA/Release_Note_HT80x_1.0.29.8.pdf - https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/
CVE ID: CVE-2021-37916 State: PUBLISHED Published: 2021-08-02T23:35:37 Last Updated: 2024-08-04T01:30:09.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joplin before 2.0.9 allows XSS via button and form in the note body. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/laurent22/joplin/commit/feaecf765368f2c273bea3a9fa641ff0da7e6b26 - https://github.com/laurent22/joplin/releases/tag/v2.0.9
CVE ID: CVE-2021-37918 State: PUBLISHED Published: 2021-10-07T15:33:18 Last Updated: 2024-08-04T01:30:09.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37919 State: PUBLISHED Published: 2021-10-07T15:38:29 Last Updated: 2024-08-04T01:30:08.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37920 State: PUBLISHED Published: 2021-10-07T15:37:42 Last Updated: 2024-08-04T01:30:09.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37921 State: PUBLISHED Published: 2021-10-07T15:36:52 Last Updated: 2024-08-04T01:30:08.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37922 State: PUBLISHED Published: 2021-10-07T15:34:18 Last Updated: 2024-08-04T01:30:08.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to another. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37923 State: PUBLISHED Published: 2021-10-07T15:36:02 Last Updated: 2024-08-04T01:30:08.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37924 State: PUBLISHED Published: 2021-10-07T15:35:12 Last Updated: 2024-08-04T01:30:09.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37925 State: PUBLISHED Published: 2021-09-22T13:23:40 Last Updated: 2024-08-04T01:30:08.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37926 State: PUBLISHED Published: 2021-10-07T15:20:03 Last Updated: 2024-08-04T01:30:08.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37927 State: PUBLISHED Published: 2021-09-22T13:35:51 Last Updated: 2024-08-04T01:30:08.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111 - https://www.manageengine.com/products/self-service-password/release-notes.html#6110
CVE ID: CVE-2021-37928 State: PUBLISHED Published: 2021-10-07T15:21:30 Last Updated: 2024-08-04T01:30:08.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37929 State: PUBLISHED Published: 2021-10-07T15:22:26 Last Updated: 2024-08-04T01:30:09.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37930 State: PUBLISHED Published: 2021-10-07T15:30:34 Last Updated: 2024-08-04T01:30:08.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37931 State: PUBLISHED Published: 2021-10-07T15:31:37 Last Updated: 2024-08-04T01:30:09.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/ad-manager/release-notes.html#7111
CVE ID: CVE-2021-37933 State: PUBLISHED Published: 2021-10-14T15:02:20 Last Updated: 2024-08-04T01:30:08.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it to construct LDAP queries. An attacker could bypass authentication exploiting this vulnerability by sending login attempts in which there is a valid password but a wildcard character in email parameter. Additional Analyst Notes: - CV
attempts in which there is a valid password but a wildcard character in email parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/andrey-lomtev/cbf12bc8d8763996cf8d6d1641a0b049