Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-42119 State: PUBLISHED Published: 2021-11-30T11:28:11 Last Updated: 2024-08-04T03:30:37.901Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Business-DNA Solutions GmbH Products: TopEase Problem Types: CWE-79 Description: Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeo
n the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE ID: CVE-2021-42120 State: PUBLISHED Published: 2021-11-30T11:28:12 Last Updated: 2024-08-04T03:30:36.363Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Business-DNA Solutions GmbH Products: TopEase Problem Types: CWE-20 Description: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification privileges to insert arbitrarily long strings, eventually leading to exhaustion of the underlying resource. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confl
nderlying resource. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE ID: CVE-2021-42121 State: PUBLISHED Published: 2021-11-30T11:28:12 Last Updated: 2024-08-04T03:30:36.387Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Business-DNA Solutions GmbH Products: TopEase Problem Types: CWE-20 Description: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(s) allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format into date fields, which leads to breaking the object page that the date field is present. Additional Analyst Notes: - CVE Program Container: References: - htt
ing the object page that the date field is present. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE ID: CVE-2021-42122 State: PUBLISHED Published: 2021-11-30T11:28:13 Last Updated: 2024-08-04T03:30:37.576Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Business-DNA Solutions GmbH Products: TopEase Problem Types: CWE-20 Description: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format, which makes the affected attribute non-editable. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/
attribute non-editable. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE ID: CVE-2021-42123 State: PUBLISHED Published: 2021-11-30T11:28:14 Last Updated: 2024-08-04T03:30:37.552Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Business-DNA Solutions GmbH Products: TopEase Problem Types: CWE-434 Description: Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 in the File Upload Functions allows an authenticated remote attacker with Upload privileges to upload files with any file type, enabling client-side attacks. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE ID: CVE-2021-42124 State: PUBLISHED Published: 2021-12-07T13:12:44 Last Updated: 2024-08-04T03:30:37.573Z Vendors: n/a Products: Ivanti Avalanche Problem Types: CWE-284 Description: An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42125 State: PUBLISHED Published: 2021-12-07T13:12:49 Last Updated: 2024-08-04T03:30:36.382Z Vendors: n/a Products: Ivanti Avalance Problem Types: CWE-502 Description: An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42126 State: PUBLISHED Published: 2021-12-07T13:12:56 Last Updated: 2024-08-04T03:30:37.432Z Vendors: n/a Products: Ivanti Avalanche Problem Types: CWE-285 Description: An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42127 State: PUBLISHED Published: 2021-12-07T13:13:01 Last Updated: 2024-08-04T03:30:37.722Z Vendors: n/a Products: Ivanti Avalanche Problem Types: CWE-502 Description: A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42128 State: PUBLISHED Published: 2021-12-07T13:13:10 Last Updated: 2024-08-04T03:30:36.382Z Vendors: n/a Products: Ivanti Avalanche Problem Types: CWE-749 Description: An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42129 State: PUBLISHED Published: 2021-12-07T13:13:14 Last Updated: 2024-08-04T03:30:38.162Z Vendors: n/a Products: Ivanti Avalanche Problem Types: CWE-77 Description: A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42130 State: PUBLISHED Published: 2021-12-07T13:13:19 Last Updated: 2024-08-04T03:30:37.294Z Vendors: n/a Products: Ivanti Avalanche Problem Types: CWE-502 Description: A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42131 State: PUBLISHED Published: 2021-12-07T13:13:24 Last Updated: 2024-08-04T03:30:37.469Z Vendors: n/a Products: Ivanti Avalanche Problem Types: CWE-89 Description: A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42132 State: PUBLISHED Published: 2021-12-07T13:13:29 Last Updated: 2024-08-04T03:30:36.359Z Vendors: n/a Products: Ivanti Avalanche Problem Types: CWE-77 Description: A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42133 State: PUBLISHED Published: 2021-12-07T13:13:35 Last Updated: 2024-08-04T03:30:37.497Z Vendors: n/a Products: Ivanti Avalanche Problem Types: CWE-434 Description: An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3
CVE ID: CVE-2021-42134 State: PUBLISHED Published: 2021-10-11T00:55:43 Last Updated: 2024-08-04T03:30:36.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/adamghill/django-unicorn/commit/3a832a9e3f6455ddd3b87f646247269918ad10c6 - https://github.com/adamghill/django-unicorn/compare/0.36.0...0.36.1
CVE ID: CVE-2021-42135 State: PUBLISHED Published: 2021-10-11T02:52:59 Last Updated: 2024-08-04T03:30:38.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-ad
s: - https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards/
CVE ID: CVE-2021-42136 State: PUBLISHED Published: 2022-04-13T15:32:56 Last Updated: 2024-08-04T03:30:37.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.project-redcap.org/ - https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf - http://packe
ences: - https://www.project-redcap.org/ - https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf - http://packetstormsecurity.com/files/166723/REDCap-Cross-Site-Scripting.html
CVE ID: CVE-2021-42137 State: PUBLISHED Published: 2021-10-11T04:02:32 Last Updated: 2024-08-04T03:30:38.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-19
CVE ID: CVE-2021-42138 State: PUBLISHED Published: 2021-12-20T20:19:10 Last Updated: 2024-08-04T03:30:37.956Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Thales CPL Products: Safenet Authentication Service Problem Types: https://cwe.mitre.org/data/definitions/336.html Description: A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine. Additional Analyst Notes: - CVE Program Container: References: - https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a&id=kb_article_view&sysparm_rank=1&sysparm_tsqueryId=b3bdd932db33b010
.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a&id=kb_article_view&sysparm_rank=1&sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955 - https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb&id=kb_article_view&sysparm_rank=2&sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955 - https://cpl.thalesgroup.com/support/security-updates
CVE ID: CVE-2021-42139 State: PUBLISHED Published: 2021-10-11T04:14:16 Last Updated: 2024-08-04T03:30:37.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/denoland/deno_std/releases/tag/0.107.0 - https://github.com/denoland/deno_std/pull/1275 - https://vuln.ryotak.me/advisories/58
CVE ID: CVE-2021-42141 State: PUBLISHED Published: 2024-01-22T00:00:00.000Z Last Updated: 2025-06-20T18:34:42.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in the packets Client_Hello, Client_key_exchange, and Change_cipher_spec, which may cause denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/tinydtls/issues/27 - http://packetstormsecurity.com/files/176625/Contiki-NG-tinyDTLS-Denial-Of-Service.html - https://seclists.org/fulldisclosure/2024/Jan/14
CVE ID: CVE-2021-42142 State: PUBLISHED Published: 2024-01-23T00:00:00.000Z Last Updated: 2025-06-11T17:09:33.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability allows remote attackers to cause a denial of service and false-positive packet drops. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/tinydtls/issues/24 - https://seclists.org/fulldisclosure/2024/Jan/15
CVE ID: CVE-2021-42143 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-06-20T19:16:00.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
sclose sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2024/Jan/16
CVE ID: CVE-2021-42144 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-06-20T19:16:51.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafted input to dtls_ccm_decrypt_message(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2024/Jan/17
CVE ID: CVE-2021-42145 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-06-20T19:17:38.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2024/Jan/18
CVE ID: CVE-2021-42146 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-06-20T19:19:37.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability allows remote attackers to obtain sensitive application (data of connected clients). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2024/Jan/19
CVE ID: CVE-2021-42147 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-05-30T14:17:01.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 allows remote attackers to cause a denial of service via crafted data packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2024/Jan/20
CVE ID: CVE-2021-42165 State: PUBLISHED Published: 2022-05-03T11:25:48 Last Updated: 2024-08-04T03:30:37.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bash" because of incorrect sanitization of parameter "path". Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50351 - https://packetstormsecurity.com/files/164333/Mitrastar-GPT-2541GNAC-N1-Privilege-Escalation.html - https://github.com/leoservalli/Privilege-escalation-MitraStar/blob/main/README.md
CVE ID: CVE-2021-42168 State: PUBLISHED Published: 2022-01-24T18:17:03 Last Updated: 2024-08-04T03:30:38.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) by oretnom23, allows attackers to gain the PHPSESID or other unspecified impacts via the fullname parameter to the login_registration page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-17-092921
CVE ID: CVE-2021-42169 State: PUBLISHED Published: 2021-10-22T13:09:52 Last Updated: 2024-08-04T03:30:37.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable from remote SQL-Injection-Bypass-Authentication for the admin account. The parameter (username) from the login form is not protected correctly and there is no security and escaping from malicious payloads. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-21-100521 - https://www.exploit-db.com/exploits/50403
CVE ID: CVE-2021-42171 State: PUBLISHED Published: 2022-03-14T14:51:06 Last Updated: 2024-08-04T03:30:37.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth. Additional Analyst Notes: - CVE Program Container: References: - https://minhnq22.medium.com/file-upload-to-rce-on-zenario-9-0-54156-cms-fa05fcc6cf74 - https://github.com/hieuminhnv/Zenario-CMS-9.0-last-version/issues/2 - http://packetstormsecurity.com/files/166
cc6cf74 - https://github.com/hieuminhnv/Zenario-CMS-9.0-last-version/issues/2 - http://packetstormsecurity.com/files/166617/Zenario-CMS-9.0.54156-Remote-Code-Execution.html
CVE ID: CVE-2021-42183 State: PUBLISHED Published: 2022-05-05T13:02:49 Last Updated: 2024-08-04T03:30:37.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MasaCMS/MasaCMS - https://github.com/MasaCMS/MasaCMS/blob/9bff7989ab902b2c42499bd4d1582e30d1ec4fe9/core/mura/content/file/fileManager.cfc#L368 - https://github.com/0xRaw/CVE-2021-42183
CVE ID: CVE-2021-42185 State: PUBLISHED Published: 2022-05-04T11:06:30 Last Updated: 2024-08-04T03:30:37.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: wdja v2.1 is affected by a SQL injection vulnerability in the foreground search function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/XingHe0/Vulnerability-Report/blob/main/wdja%20v2.1.md - https://github.com/shadoweb/wdja/issues/12
CVE ID: CVE-2021-42186 State: REJECTED Published: 2022-03-07T13:01:06 Last Updated: 2022-04-19T20:26:40 Description: No description available.
CVE ID: CVE-2021-42192 State: PUBLISHED Published: 2022-05-04T00:00:00 Last Updated: 2024-08-04T03:30:37.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharing - https://github.com/pantsel/konga/ - https://www.exploit-db.com/exploits/50521 - https://github.com/whokilleddb/Konga-Privilege-Escalation-Exploit - https://github.com/pantsel/konga/commit/d61535277aced18b5be0313ab2d124f60f649978
CVE ID: CVE-2021-42193 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T19:02:31.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://nopcommerce.com - http://nop.com - https://cxsecurity.com/issue/WLB-2025100002
CVE ID: CVE-2021-42194 State: PUBLISHED Published: 2022-03-20T21:12:04 Last Updated: 2024-08-04T03:30:36.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/issues/19
CVE ID: CVE-2021-42195 State: PUBLISHED Published: 2022-05-31T16:31:33 Last Updated: 2024-08-04T03:30:37.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function handleEditText() located in swfdump.c. It allows an attacker to cause code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/174