Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-40060 State: PUBLISHED Published: 2022-03-07T13:49:47 Last Updated: 2024-08-04T02:27:31.872Z Vendors: Huawei Products: EMUI, Magic UI Problem Types: Heap-based buffer overflow vulnerability Description: There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE ID: CVE-2021-40061 State: PUBLISHED Published: 2022-03-07T13:49:40 Last Updated: 2024-08-04T02:27:31.652Z Vendors: Huawei Products: EMUI, Magic UI, HarmonyOS Problem Types: Type confusion vulnerability Description: There is a vulnerability of accessing resources using an incompatible type (type confusion) in the Bastet module. Successful exploitation of this vulnerability may affect integrity. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/3/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-0000001257385193
CVE ID: CVE-2021-40062 State: PUBLISHED Published: 2022-03-07T13:49:31 Last Updated: 2024-08-04T02:27:31.491Z Vendors: Huawei Products: EMUI, Magic UI Problem Types: Buffer Copy without Checking Size of Input Description: There is a vulnerability of copying input buffer without checking its size in the video framework. Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/3/
CVE ID: CVE-2021-40063 State: PUBLISHED Published: 2022-03-07T13:49:26 Last Updated: 2024-08-04T02:27:31.445Z Vendors: Huawei Products: EMUI, Magic UI, HarmonyOS Problem Types: Improper access control vulnerability Description: There is an improper access control vulnerability in the video module. Successful exploitation of this vulnerability may affect confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/3/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-0000001257385193
CVE ID: CVE-2021-40064 State: PUBLISHED Published: 2022-03-07T13:49:22 Last Updated: 2024-08-04T02:27:31.704Z Vendors: Huawei Products: EMUI, Magic UI, HarmonyOS Problem Types: Heap-based buffer overflow vulnerability Description: There is a heap-based buffer overflow vulnerability in system components. Successful exploitation of this vulnerability may affect system stability. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/3/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202203-0000001257385193
CVE ID: CVE-2021-40065 State: PUBLISHED Published: 2022-04-11T19:38:24 Last Updated: 2024-08-04T02:27:31.856Z Vendors: Huawei Products: HarmonyOS, EMUI, Magic UI Problem Types: Service logic error vulnerability Description: The communication module has a service logic error vulnerability.Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/4/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-0000001224076294
CVE ID: CVE-2021-40066 State: PUBLISHED Published: 2021-09-16T11:18:27 Last Updated: 2024-08-04T02:27:31.554Z Vendors: n/a Products: NetMotion Mobility Problem Types: Incorrect access control in Mobility read-only API Description: The access controls on the Mobility read-only API improperly validate user access permissions. Attackers with both network access to the API and valid credentials can read data from it; regardless of access control group membership settings. This vulnerability is fixed in Mobility v11.76 and Mobility v12.14. Additional Analyst Notes: - CVE Program Container: References: - https://www.netmotionsoftware.com/security-advisories/cve-2021-40066
CVE ID: CVE-2021-40067 State: PUBLISHED Published: 2021-09-16T11:25:21 Last Updated: 2024-08-04T02:27:31.644Z Vendors: n/a Products: NetMotion Mobility Problem Types: Incorrect access control in Mobility read-write API Description: The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default. If the API is manually enabled, attackers with both network access to the API and valid credentials can read and write data to it; regardless of access control group membership settings. This vulnerability is fixed in Mobility v12.14. Additional Analyst Notes: - CVE Program Container: References: - https://www.netmotionsoftware.com/secur
obility v12.14. Additional Analyst Notes: - CVE Program Container: References: - https://www.netmotionsoftware.com/security-advisories/cve-2021-40067
CVE ID: CVE-2021-40083 State: PUBLISHED Published: 2021-08-25T00:21:43 Last Updated: 2024-08-04T02:27:31.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a remote attacker in an edge case (NSEC3 with too many iterations used for a positive wildcard proof). Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1169
CVE ID: CVE-2021-40084 State: PUBLISHED Published: 2021-08-25T00:21:25 Last Updated: 2024-08-04T02:27:31.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/992058 - https://github.com/artix-linux/opensysusers/releases
CVE ID: CVE-2021-40085 State: PUBLISHED Published: 2021-08-31T17:32:24 Last Updated: 2024-08-04T02:27:31.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1939733 - http://www.openwall.com/lists/oss-security/2021/08/31/2 - https://security.openstack.org/ossa/OSSA-2021-005.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00005.html - https://www.debian.org/security/2021/dsa-4983 - https://
://lists.debian.org/debian-lts-announce/2021/10/msg00005.html - https://www.debian.org/security/2021/dsa-4983 - https://lists.debian.org/debian-lts-announce/2022/05/msg00038.html
CVE ID: CVE-2021-40086 State: PUBLISHED Published: 2021-08-25T01:25:18 Last Updated: 2024-08-04T02:27:31.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page (that can only be viewed by an administrator). While hidden from direct view, checking the page source would reveal the secret. Additional Analyst Notes: - CVE Program Container: References: - https://support.primekey.com/news/posts/52
CVE ID: CVE-2021-40087 State: PUBLISHED Published: 2021-08-25T01:24:59 Last Updated: 2024-08-04T02:27:31.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log (that can only be viewed by an administrator). This affects use of any of the following protocols: SCEP, CMP, or EST. Additional Analyst Notes: - CVE Program Container: References: - https://support.primekey.com/news/posts/53
CVE ID: CVE-2021-40088 State: PUBLISHED Published: 2021-08-25T01:24:49 Last Updated: 2024-08-04T02:27:31.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant. Ad
en authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant. Additional Analyst Notes: - CVE Program Container: References: - https://support.primekey.com/news/posts/51
CVE ID: CVE-2021-40089 State: PUBLISHED Published: 2021-08-25T01:24:31 Last Updated: 2024-08-04T02:27:31.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run. Additional Analyst Notes: - CVE Program Container: References: - https://support.primekey.com/news/posts/54
CVE ID: CVE-2021-40091 State: PUBLISHED Published: 2021-12-06T20:08:24 Last Updated: 2024-08-04T02:27:31.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654. Additional Analyst Notes: - CVE Program Container: References: - https://support.squaredup.com - https://support.squaredup.com/hc/en-us/articles/4410656394129-CVE-2021-40091-SSRF-issue
CVE ID: CVE-2021-40092 State: PUBLISHED Published: 2021-12-07T12:42:44 Last Updated: 2024-08-04T02:27:31.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an SVG file. Additional Analyst Notes: - CVE Program Container: References: - https://support.squaredup.com - https://support.squaredup.com/hc/en-us/articles/4410635417233-CVE-2021-40092-Stored-cross-site-scripting-Image-tile-
CVE ID: CVE-2021-40093 State: PUBLISHED Published: 2021-12-07T12:48:40 Last Updated: 2024-08-04T02:27:31.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via dashboard actions. Additional Analyst Notes: - CVE Program Container: References: - https://support.squaredup.com - https://support.squaredup.com/hc/en-us/articles/4410635418257-CVE-2021-40093-Stored-cross-site-scripting-Action-Buttons-
CVE ID: CVE-2021-40094 State: PUBLISHED Published: 2021-12-07T12:51:54 Last Updated: 2024-08-04T02:27:31.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device. Additional Analyst Notes: - CVE Program Container: References: - https://support.squaredup.com - https://support.squaredup.com/hc/en-us/articles/4410656395537-CVE-2021-40094-DOM-based-stored-cross-site-scripting
CVE ID: CVE-2021-40095 State: PUBLISHED Published: 2021-12-07T12:54:16 Last Updated: 2024-08-04T02:27:31.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SquaredUp for SCOM 5.2.1.6654. The Download Log feature in System / Maintenance was susceptible to a local file inclusion vulnerability (when processing remote input in the log files downloaded by an authenticated administrator user), leading to the ability to read arbitrary files on the server filesystems. Additional Analyst Notes: - CVE Program Container: References: - https://support.squaredup.com - https://support.squaredup.com/hc/en-us/articles/4410635419153-CVE-2021-40095-Reading-arbitrary-fil
pport.squaredup.com - https://support.squaredup.com/hc/en-us/articles/4410635419153-CVE-2021-40095-Reading-arbitrary-files
CVE ID: CVE-2021-40096 State: PUBLISHED Published: 2021-12-07T12:58:33 Last Updated: 2024-08-04T02:27:31.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via modification of the authorisationUrl in some integration configurations. Additional Analyst Notes: - CVE Program Container: References: - https://support.squaredup.com - https://support.squaredup.com/hc/en-us/articles/4410656396817-CVE-2021-40096-Stored-cross-site-scripting-provider-configuration-
CVE ID: CVE-2021-40097 State: PUBLISHED Published: 2021-09-27T11:06:08 Last Updated: 2024-08-04T02:27:31.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. Authenticated path traversal leads to to remote code execution via uploaded PHP code, related to the bFilename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1102067 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40098 State: PUBLISHED Published: 2021-09-27T11:08:16 Last Updated: 2024-08-04T02:27:31.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regular expression. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1102080 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40099 State: PUBLISHED Published: 2021-09-24T14:58:32 Last Updated: 2024-08-04T02:27:31.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/982130 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40100 State: PUBLISHED Published: 2021-09-24T14:57:20 Last Updated: 2024-08-04T02:27:31.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/616770 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40101 State: PUBLISHED Published: 2021-11-30T19:38:32 Last Updated: 2024-08-04T02:27:31.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1065577 - https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes
CVE ID: CVE-2021-40102 State: PUBLISHED Published: 2021-09-24T14:55:42 Last Updated: 2024-08-04T02:27:31.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_dir (PHP Object Injection associated with the __wakeup magic method). Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/921288 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40103 State: PUBLISHED Published: 2021-09-27T11:10:19 Last Updated: 2024-08-04T02:27:31.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1102211 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40104 State: PUBLISHED Published: 2021-09-27T11:56:40 Last Updated: 2024-08-04T02:27:31.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. There is an SVG sanitizer bypass. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1102088 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40105 State: PUBLISHED Published: 2021-09-27T11:58:14 Last Updated: 2024-08-04T02:27:31.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. There is XSS via Markdown Comments. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1102054 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40106 State: PUBLISHED Published: 2021-09-27T11:59:46 Last Updated: 2024-08-04T02:27:31.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the website field. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1102042 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40108 State: PUBLISHED Published: 2021-09-27T12:01:34 Last Updated: 2024-08-04T02:27:31.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on the ccm/calendar/dialogs/event/add/save endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1102018 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40109 State: PUBLISHED Published: 2021-09-27T12:04:54 Last Updated: 2024-08-04T02:27:31.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents of the file from the redirected-to server. Files of disallowed types can be uploaded. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1102105 - https://documentation.concretecms.org/deve
CVE Program Container: References: - https://hackerone.com/reports/1102105 - https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE ID: CVE-2021-40110 State: PUBLISHED Published: 2022-01-04T08:55:22 Last Updated: 2024-08-04T02:27:31.846Z Vendors: Apache Software Foundation Products: Apache James Problem Types: Regular expression Denial of service Description: In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwa
n linear time without back-tracking. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/01/04/2 - http://www.openwall.com/lists/oss-security/2022/01/04/2
CVE ID: CVE-2021-40111 State: PUBLISHED Published: 2022-01-04T08:55:24 Last Updated: 2024-08-04T02:27:31.847Z Vendors: Apache Software Foundation Products: Apache James Problem Types: Denial Of Service Description: In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend
Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/01/04/3 - http://www.openwall.com/lists/oss-security/2022/01/04/3
CVE ID: CVE-2021-40112 State: PUBLISHED Published: 2021-11-04T15:35:33.328991Z Last Updated: 2024-11-07T21:57:28.796Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Catalyst PON Series Problem Types: CWE-284 Description: Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the D
CVE ID: CVE-2021-40113 State: PUBLISHED Published: 2021-11-04T15:35:39.174158Z Last Updated: 2024-11-07T21:53:19.817Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Catalyst PON Series Problem Types: CWE-284 Description: Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the D
CVE ID: CVE-2021-40114 State: PUBLISHED Published: 2021-10-27T18:56:37.380285Z Last Updated: 2024-11-07T21:43:47.611Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Firepower Threat Defense Software Problem Types: CWE-770 Description: Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability
ce management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-s2R7W9UU - https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html - https://www.debian.org/security/2023/dsa-5354