Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-42852 State: PUBLISHED Published: 2022-05-18T16:10:34 Last Updated: 2024-08-04T03:38:50.310Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Personal Cloud Storage A1, Personal Cloud Storage T1, Personal Cloud Storage X1, Personal Cloud Storage T2, Personal Cloud Storage T2Pro Problem Types: CWE-78 Description: A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_200017.h
device. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_200017.html
CVE ID: CVE-2021-42853 State: PUBLISHED Published: 2022-03-09T16:51:28.521040Z Last Updated: 2024-09-16T17:09:18.135Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Aternity Products: SteelCentral AppInternals Dynamic Sampling Agent Problem Types: CWE-20 Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected. Additional Analyst Notes: - CVE Program Container: References: - ht
nput that allows a malicious payload to be injected. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Delete-Read-at-AgentDiagnosticServlet-CVE-2021-42853
CVE ID: CVE-2021-42854 State: PUBLISHED Published: 2022-03-09T16:52:02.819876Z Last Updated: 2024-09-16T17:54:38.635Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Aternity Products: SteelCentral AppInternals Dynamic Sampling Agent Problem Types: CWE-20 Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/plugin/pmx" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.for
malicious payload to be injected. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Read-Write-Delete-at-PluginServlet-CVE-2021-42854
CVE ID: CVE-2021-42855 State: PUBLISHED Published: 2022-03-09T16:51:38.176848Z Last Updated: 2024-09-17T02:36:31.306Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Aternity Products: SteelCentral AppInternals Dynamic Sampling Agent Problem Types: CWE-284 Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed. Additional Analyst Notes: - CVE Program Container
guration" API to map the corresponding ID to a command to be executed. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/article/Local-privilege-escalation-due-to-misconfigured-write-permission-on-debug-command-config-file-CVE-2021-42855
CVE ID: CVE-2021-42856 State: PUBLISHED Published: 2022-03-09T16:51:56.184251Z Last Updated: 2024-09-17T04:18:57.454Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Aternity Products: SteelCentral AppInternals Dynamic Sampling Agent Problem Types: CWE-20 Description: It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger a XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/articl
ty. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/article/Reflected-Cross-site-Scripting-at-DsaDataTest-CVE-2021-42856
CVE ID: CVE-2021-42857 State: PUBLISHED Published: 2022-03-09T16:51:44.553702Z Last Updated: 2024-09-16T21:57:35.235Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Aternity Products: SteelCentral AppInternals Dynamic Sampling Agent Problem Types: CWE-20 Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/da/pcf" API. The affected endpoint does not have any validation of the user's input that allows a malicious payload to be injected. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.co
cious payload to be injected. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Partial-Write-at-AgentDaServlet-CVE-2021-42857
CVE ID: CVE-2021-42859 State: PUBLISHED Published: 2022-05-26T11:02:54 Last Updated: 2024-08-04T03:38:50.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the issue in both the 3.2 release and in the October 2021 development code, but others not seeing the issue in the 3.2 release Additional Analyst Notes: - CVE Program Container: References: - https://github.com/michaelrsweet/mxml/issues/286
CVE ID: CVE-2021-42860 State: PUBLISHED Published: 2022-05-26T11:23:28 Last Updated: 2024-08-04T03:38:50.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml_string_getc:2611. NOTE: it is unclear whether this input is allowed by the API specification Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/michaelrsweet/mxml/issues/286
CVE ID: CVE-2021-42863 State: PUBLISHED Published: 2022-05-12T12:33:16 Last Updated: 2024-08-04T03:38:50.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in ecma_builtin_typedarray_prototype_filter() in JerryScript version fe3a5c0 allows an attacker to construct a fake object or a fake arraybuffer with unlimited size. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4793 - https://github.com/jerryscript-project/jerryscript/pull/4794
CVE ID: CVE-2021-42866 State: PUBLISHED Published: 2022-03-31T17:52:59 Last Updated: 2024-08-04T03:38:50.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php Additional Analyst Notes: - CVE Program Container: References: - http://rlsec.xyz/vulns/CVE_2021_42866.html
CVE ID: CVE-2021-42867 State: PUBLISHED Published: 2022-03-31T17:53:05 Last Updated: 2024-08-04T03:38:50.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages. Additional Analyst Notes: - CVE Program Container: References: - https://rlsec.xyz/vulns/ - http://rlsec.xyz/vulns/CVE_2021_42867.html
CVE ID: CVE-2021-42868 State: PUBLISHED Published: 2022-03-31T17:53:11 Last Updated: 2024-08-04T03:38:50.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/insert, (2) patient_report, (3) appointment_report, (4) visit_report, and (5) bill_detail_report pages. . Additional Analyst Notes: - CVE Program Container: References: - http://chikista.com - http://rlsec.xyz/vulns/CVE_2021_42868.html
CVE ID: CVE-2021-42869 State: PUBLISHED Published: 2022-03-31T17:51:11 Last Updated: 2024-08-04T03:38:50.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patient/insert, (2) patient_report, (3) /appointment_report, (4) visit_report, and (5) /bill_detail_report pages. Additional Analyst Notes: - CVE Program Container: References: - https://rlsec.xyz/vulns/ - http://rlsec.xyz/vulns/CVE_2021_42869.html
CVE ID: CVE-2021-42870 State: PUBLISHED Published: 2022-05-16T14:01:21 Last Updated: 2024-08-04T03:38:50.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xebd/accel-ppp/issues/158
CVE ID: CVE-2021-42872 State: PUBLISHED Published: 2022-05-31T23:15:28 Last Updated: 2024-08-04T03:38:50.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://totolink.net/ - http://ex1200t.com - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_NoticeUrl_rce4.md
CVE ID: CVE-2021-42875 State: PUBLISHED Published: 2022-06-02T18:52:02 Last Updated: 2024-08-04T03:38:50.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin. Additional Analyst Notes: - CVE Program Container: References: - http://ex1200t.com - http://totolink.net - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_ipdoamin_rce.md
CVE ID: CVE-2021-42877 State: PUBLISHED Published: 2022-06-02T19:18:46 Last Updated: 2024-08-04T03:38:50.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system. Additional Analyst Notes: - CVE Program Container: References: - http://totolink.net/ - http://ex1200t.com - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_reboot.md
CVE ID: CVE-2021-42884 State: PUBLISHED Published: 2022-06-03T10:35:20 Last Updated: 2024-08-04T03:47:11.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceName to attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_devicename_rce.md
CVE ID: CVE-2021-42885 State: PUBLISHED Published: 2022-06-03T10:50:27 Last Updated: 2024-08-04T03:47:11.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_devicemac_rce.md
CVE ID: CVE-2021-42886 State: PUBLISHED Published: 2022-06-03T11:13:38 Last Updated: 2024-08-04T03:47:11.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, and usernames and passwords can be found in the decoded file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_exportsettings_leak.md
CVE ID: CVE-2021-42887 State: PUBLISHED Published: 2022-06-03T11:40:42 Last Updated: 2024-08-04T03:47:11.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_login_bypass.md
CVE ID: CVE-2021-42888 State: PUBLISHED Published: 2022-06-03T13:51:17 Last Updated: 2024-08-04T03:47:12.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can control langType to attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_langtype_rce.md
CVE ID: CVE-2021-42889 State: PUBLISHED Published: 2022-06-03T14:08:41 Last Updated: 2024-08-04T03:47:11.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, wifiname, etc.) without authorization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_getWiFiApConfig_leak.md
CVE ID: CVE-2021-42890 State: PUBLISHED Published: 2022-06-03T14:57:19 Last Updated: 2024-08-04T03:47:12.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime to attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_hosttime_rce.md
CVE ID: CVE-2021-42891 State: PUBLISHED Published: 2022-06-03T15:17:08 Last Updated: 2024-08-04T03:47:12.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_easywizard_leak.md
CVE ID: CVE-2021-42892 State: PUBLISHED Published: 2022-06-03T16:53:53 Last Updated: 2024-08-04T03:47:11.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_telnet_default.md
CVE ID: CVE-2021-42893 State: PUBLISHED Published: 2022-06-03T17:12:36 Last Updated: 2024-08-04T03:47:11.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCfg. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_sysstatus_leak.md
CVE ID: CVE-2021-42897 State: PUBLISHED Published: 2022-05-16T13:32:29 Last Updated: 2024-08-04T03:47:12.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $mysqlstr and is executed by exec. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FeMiner/wms/issues/12
CVE ID: CVE-2021-42911 State: PUBLISHED Published: 2022-03-29T19:30:16 Last Updated: 2024-08-04T03:47:12.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Cossack9989/e9c1c2d2e69b773ca4251acdd77f2835
CVE ID: CVE-2021-42912 State: PUBLISHED Published: 2021-12-16T16:54:08 Last Updated: 2024-08-04T03:47:12.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon. Additional Analyst Notes: - CVE Program Container: References: - http://fiberhome.com - http://onu.com - https://medium.com/%40windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2
CVE ID: CVE-2021-42913 State: PUBLISHED Published: 2021-12-20T08:23:40 Last Updated: 2024-08-04T03:47:12.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by reading the HTML source code. Authentication is not required. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - https://medium.com/%40windsormoreira/samsung-printer-scx-6x55x-improper-access-control-cve-2021-42913-bd50837e5e9a
CVE ID: CVE-2021-42917 State: PUBLISHED Published: 2021-11-01T00:00:00 Last Updated: 2024-11-18T20:46:55.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xbmc/xbmc/issues/20305 - https://github.com/xbmc/xbmc/pull/20306 - https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237 - https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3 - https://lists.debian.org/debian-lts-annou
https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3 - https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html
CVE ID: CVE-2021-42923 State: PUBLISHED Published: 2022-07-17T23:25:15 Last Updated: 2024-08-04T03:47:12.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability. If an attacker overwrites the file %temp%\ShowMyPC\-ShowMyPC3606\wodVPN.dll, it will run any malicious code contained in that file. The code will run with normal user privileges unless the user specifically runs ShowMyPC as administrator. Additional Analyst Notes: - CVE Program Container: References: - http://showmypc.com - https://f20.be/cves/showmypc-cve-2021-42923
CVE ID: CVE-2021-42940 State: PUBLISHED Published: 2022-02-11T15:54:30 Last Updated: 2024-08-04T03:47:12.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://www.projeqtor.org/en/ - https://truedigitalsecurity.com/services/penetration-testing-services/advisory-summary-2.2022-cve-2021-42940
CVE ID: CVE-2021-42943 State: PUBLISHED Published: 2022-05-17T10:47:03 Last Updated: 2024-08-04T03:47:12.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://devbrain.com.br/index.php/2022/05/16/cve-2021-42943/
CVE ID: CVE-2021-42945 State: PUBLISHED Published: 2021-12-15T06:27:18 Last Updated: 2024-08-04T03:47:12.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.zzcms.net/ - https://github.com/Boomingjacob/ZZCMS/blob/main/4.jpg
CVE ID: CVE-2021-42946 State: PUBLISHED Published: 2022-03-31T17:53:17 Last Updated: 2024-08-04T03:47:12.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page. Additional Analyst Notes: - CVE Program Container: References: - http://rlsec.xyz/vulns/CVE_2021_42946.html
CVE ID: CVE-2021-42948 State: PUBLISHED Published: 2022-09-16T15:14:35 Last Updated: 2024-08-04T03:47:12.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's. Additional Analyst Notes: - CVE Program Container: References: - https://www.hoteldruid.com/ - https://github.com/dhammon/Security - https://github.com/dhammon/HotelDruid-CVE-2021-42948
CVE ID: CVE-2021-42949 State: PUBLISHED Published: 2022-09-16T14:45:36.000Z Last Updated: 2025-06-03T18:17:17.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hoteldruid.com/ - https://github.com/dhammon/Security - https://github.com/dhammon/HotelDruid-CVE-2021-42949
CVE ID: CVE-2021-42950 State: PUBLISHED Published: 2022-03-03T02:10:57 Last Updated: 2024-08-04T03:47:12.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional users can be added for various collaboration abilities, which allows malicious user to create new Zepl Notebooks with various languages, contexts, and deployment scenarios. Upon creating a new notebook with specially crafted malici
s with various languages, contexts, and deployment scenarios. Upon creating a new notebook with specially crafted malicious code, a user can then launch remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://zepl.com - https://seclists.org/fulldisclosure/2022/Feb/31
CVE ID: CVE-2021-42951 State: PUBLISHED Published: 2022-03-01T01:40:31 Last Updated: 2024-08-04T03:47:12.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new, specially crafted Algorithm and subsequently launch remote code execution with their desired result. Additional Analyst Notes: - CVE Program Container: References: - http://algorithmia.com - https://seclists.org/fulldisclosure/2022/Feb/33