Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-44564 State: PUBLISHED Published: 2022-01-06T11:53:39 Last Updated: 2024-08-04T04:25:16.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security vulnerability originally reported in the SYNC2101 product, and applicable to specific sub-families of SYNC devices, allows an attacker to download the configuration file used in the device and apply a modified configuration file back to the device. The attack requires network access to the SYNC device and knowledge of its IP address. The attack exploits the unsecured communication channel used between the administration tool Easyconnect and the SYNC device (in the affected family of SYNC products). Additional Analy
ween the administration tool Easyconnect and the SYNC device (in the affected family of SYNC products). Additional Analyst Notes: - CVE Program Container: References: - https://www.kalkitech.com/cybersecurity/ - https://kalkitech.com/wp-content/uploads/CYB_33631_Advisory.pdf
CVE ID: CVE-2021-44565 State: PUBLISHED Published: 2022-02-22T19:58:33 Last Updated: 2024-08-04T04:25:16.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/francoisjacquet/rosariosis/-/issues/307 - https://gitlab.com/francoisjacquet/rosariosis/-/commit/0f5d1f1d193bc6b711d1644f172579d498ec1636 - https://gitlab.com/francoisjacquet/ro
com/francoisjacquet/rosariosis/-/commit/0f5d1f1d193bc6b711d1644f172579d498ec1636 - https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761
CVE ID: CVE-2021-44566 State: PUBLISHED Published: 2022-02-22T20:02:49 Last Updated: 2024-08-04T04:25:16.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/francoisjacquet/rosariosis/-/issues/259 - https://gitlab.com/francoisjacquet/rosariosis/-/commit/81886abb45a32e802151660de674f084afaef3aa - https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES_V3_4.md#changes-in-43
CVE ID: CVE-2021-44567 State: PUBLISHED Published: 2022-02-22T20:16:14 Last Updated: 2024-08-04T04:25:16.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761 - https://gitlab.com/francoisjacquet/rosariosis/-/issues/308 - https://gitlab.com/francoisjacquet/rosariosis/-/commit/519af055a4fdc1362657d75bca76f9c95a081eaa - https://gitlab.com/francoisjacquet/rosariosis/-/commit/e001430aa9fb5
-/commit/519af055a4fdc1362657d75bca76f9c95a081eaa - https://gitlab.com/francoisjacquet/rosariosis/-/commit/e001430aa9fb53d2502fb6f036f6c51c578d2016
CVE ID: CVE-2021-44568 State: PUBLISHED Published: 2022-02-21T17:38:57 Last Updated: 2024-08-04T04:25:16.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/libsolv/issues/425 - https://github.com/yangjiageng/PoC/blob/master/libsolv-PoCs/resolve_dependencies-1940 - https://github.com/yangjiageng/PoC/blob/master/libsolv-PoCs/resolve_dependencies-1995
CVE ID: CVE-2021-44569 State: REJECTED Published: 2022-02-21T18:15:03 Last Updated: 2022-06-13T16:17:24 Description: No description available.
CVE ID: CVE-2021-44570 State: REJECTED Published: 2022-02-21T18:53:01 Last Updated: 2022-06-13T16:17:25 Description: No description available.
CVE ID: CVE-2021-44571 State: REJECTED Published: 2022-02-21T19:03:10 Last Updated: 2022-06-13T16:17:25 Description: No description available.
CVE ID: CVE-2021-44573 State: REJECTED Published: 2022-02-21T19:14:03 Last Updated: 2022-06-13T16:17:26 Description: No description available.
CVE ID: CVE-2021-44574 State: REJECTED Published: 2022-02-21T19:18:14 Last Updated: 2022-06-13T16:17:26 Description: No description available.
CVE ID: CVE-2021-44575 State: REJECTED Published: 2022-02-21T19:22:21 Last Updated: 2022-06-13T16:17:26 Description: No description available.
CVE ID: CVE-2021-44576 State: REJECTED Published: 2022-02-21T19:33:07 Last Updated: 2022-06-13T16:17:26 Description: No description available.
CVE ID: CVE-2021-44577 State: REJECTED Published: 2022-02-21T19:38:26 Last Updated: 2022-06-13T16:17:27 Description: No description available.
CVE ID: CVE-2021-44581 State: PUBLISHED Published: 2022-03-29T00:45:16 Last Updated: 2024-08-04T04:25:16.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerabilty exists in Kreado Kreasfero 1.5 via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://pvu-netze.de/ - https://twitter.com/1ofThegutHakrs/status/1508455262885191682
CVE ID: CVE-2021-44582 State: PUBLISHED Published: 2022-06-10T12:32:12 Last Updated: 2024-08-04T04:25:16.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.html - https://github.com/warmachine-57/CVE-2021-44582/blob/main/Privilege%20Escalation%20via%20Forced%20Browsing%20in%20Sourcecodester%20Money%20Transfe
ine-57/CVE-2021-44582/blob/main/Privilege%20Escalation%20via%20Forced%20Browsing%20in%20Sourcecodester%20Money%20Transfer%20Management%20System
CVE ID: CVE-2021-44584 State: PUBLISHED Published: 2022-01-06T12:05:34 Last Updated: 2024-08-04T04:25:16.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/emlog/emlog/issues/113 - https://github.com/emlog/emlog/commit/3f89610f721120ded3ff491cb9cd99d9927c7582
CVE ID: CVE-2021-44585 State: PUBLISHED Published: 2022-03-10T20:02:44 Last Updated: 2024-08-04T04:25:16.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jeecgboot/jeecg-boot/issues/3223
CVE ID: CVE-2021-44586 State: PUBLISHED Published: 2022-01-10T14:18:37 Last Updated: 2024-08-04T04:25:16.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qinming99/dst-admin/issues/28
CVE ID: CVE-2021-44590 State: PUBLISHED Published: 2022-01-06T13:30:45 Last Updated: 2024-08-04T04:25:16.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libming 0.4.8, a memory exhaustion vulnerability exist in the function cws2fws in util/main.c. Remote attackers could launch denial of service attacks by submitting a crafted SWF file that exploits this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming - https://github.com/libming/libming/issues/236
CVE ID: CVE-2021-44591 State: PUBLISHED Published: 2022-01-06T13:38:59 Last Updated: 2024-08-04T04:25:16.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks via a crafted SWF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming - https://github.com/libming/libming/issues/235
CVE ID: CVE-2021-44593 State: PUBLISHED Published: 2022-01-21T18:08:55 Last Updated: 2024-08-04T04:25:16.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the username parameter on /admin/login.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html - https://github.com/Mister-Joe/CVE-2021-44593 - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44593 - https://www.nu11secur1ty.com/2022/01/cve-2021-44593.html
CVE ID: CVE-2021-44595 State: PUBLISHED Published: 2022-04-29T11:23:46 Last Updated: 2024-08-04T04:25:16.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the ElevationService.exe and execute arbitrary code without any validation with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - http://wondershare.com - http://dr.com - https://medium.com/%40tomerp_77017/wondershell-a82372914f26 - http://packetstormsecurity.com/files/167036/Wondershare-Dr.Fone-12.0.7-Privilege-Escalation.html
CVE ID: CVE-2021-44596 State: PUBLISHED Published: 2022-04-29T11:23:52 Last Updated: 2024-08-04T04:25:16.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the "InstallAssistService.exe" service(the service is running under SYSTEM privileges) and manipulate it to execute malicious executable without any validation from a remote location and gain SYSTEM privileges Additional Analyst Notes: - CVE Program Container: References: - http://wondershare.com - http://dr.com - https://medium.com/%40tomerp_77017/wondershe
E Program Container: References: - http://wondershare.com - http://dr.com - https://medium.com/%40tomerp_77017/wondershell-a82372914f26 - http://packetstormsecurity.com/files/167035/Wondershare-Dr.Fone-12.0.7-Privilege-Escalation.html
CVE ID: CVE-2021-44597 State: REJECTED Published: N/A Last Updated: 2022-10-31T00:00:00 Description: No description available.
CVE ID: CVE-2021-44598 State: PUBLISHED Published: 2021-12-26T14:41:35 Last Updated: 2024-08-04T04:25:16.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by using the XSS-reflected method, and then can store information by injecting the admin account on this system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44598
CVE ID: CVE-2021-44599 State: PUBLISHED Published: 2021-12-23T12:31:27 Last Updated: 2024-08-04T04:25:16.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve sensitive information for all users of this system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11s
for all users of this system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System
CVE ID: CVE-2021-44600 State: PUBLISHED Published: 2021-12-23T13:21:52 Last Updated: 2024-08-04T04:25:16.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through the password parameter. The predictive tests of this application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve all authentication and information about the users of this system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/MSMS
CVE ID: CVE-2021-44607 State: PUBLISHED Published: 2022-02-23T18:42:23 Last Updated: 2024-08-04T04:25:16.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daylightstudio/FUEL-CMS/issues/589
CVE ID: CVE-2021-44608 State: PUBLISHED Published: 2022-02-23T18:51:04 Last Updated: 2024-08-04T04:25:16.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter in an edit action in index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alexlang24/bloofoxCMS/issues/12
CVE ID: CVE-2021-44610 State: PUBLISHED Published: 2022-02-23T19:30:36 Last Updated: 2024-08-04T04:25:16.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, (4) mod_rewrite (5) eta_doctype. (6) meta_charset, (7) default_group, and (8) page group parameters in the settings mode in admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alexlang24/bloofoxCMS/issues/13
CVE ID: CVE-2021-44617 State: PUBLISHED Published: 2022-03-28T01:08:13 Last Updated: 2024-08-04T04:25:16.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/166285/Baixar-GLPI-Project-9.4.6-SQL-Injection.html
CVE ID: CVE-2021-44618 State: PUBLISHED Published: 2022-03-11T15:17:39 Last Updated: 2024-08-04T04:25:16.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nystudio107/craft-seomatic/releases/tag/3.4.12 - https://github.com/nystudio107/craft-seomatic/commit/0c5c0c0e0cb61000d12ec55ebf174745a5bf6469
CVE ID: CVE-2021-44620 State: PUBLISHED Published: 2022-03-11T15:54:20 Last Updated: 2024-08-04T04:25:16.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters. Additional Analyst Notes: - CVE Program Container: References: - http://totolink.com - http://a3100r.com - https://drive.google.com/file/d/1_9ru2GRZ13T1KQKXPq2E14-opgf9ih45/view?usp=sharing
CVE ID: CVE-2021-44622 State: PUBLISHED Published: 2022-03-09T20:47:28 Last Updated: 2024-08-04T04:25:16.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/check_reg_verify_code function which could let a remove malicious user execute arbitrary code via a crafted post request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/chkRegVeriRegister
CVE ID: CVE-2021-44623 State: PUBLISHED Published: 2022-03-09T21:18:12 Last Updated: 2024-08-04T04:25:16.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 via the /cloud_config/router_post/check_reset_pwd_verify_code interface. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/chkResetVeriRegister
CVE ID: CVE-2021-44625 State: PUBLISHED Published: 2022-03-09T21:31:44 Last Updated: 2024-08-04T04:25:16.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in /cloud_config/cloud_device/info interface, which allows a malicious user to executee arbitrary code on the system via a crafted post request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/deviceInfoRegister
CVE ID: CVE-2021-44626 State: PUBLISHED Published: 2022-03-09T21:37:41 Last Updated: 2024-08-04T04:25:16.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/get_reg_verify_code feature, which allows malicious users to execute arbitrary code on the system via a crafted post request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/getRegVeriRegister
CVE ID: CVE-2021-44627 State: PUBLISHED Published: 2022-03-09T21:44:59 Last Updated: 2024-08-04T04:25:16.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/get_reset_pwd_veirfy_code feature, which allows malicious users to execute arbitrary code on the system via a crafted post request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/getResetVeriRegister
CVE ID: CVE-2021-44628 State: PUBLISHED Published: 2022-03-09T21:48:00 Last Updated: 2024-08-04T04:25:16.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerabiltiy exists in TP-LINK WR-886N 20190826 2.3.8 in thee /cloud_config/router_post/login feature, which allows malicious users to execute arbitrary code on the system via a crafted post request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/loginRegister
CVE ID: CVE-2021-44629 State: PUBLISHED Published: 2022-03-09T21:50:44 Last Updated: 2024-08-04T04:25:16.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerabilitiy exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/register feature, which allows malicious users to execute arbitrary code on the system via a crafted post request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/registerRegister
CVE ID: CVE-2021-44630 State: PUBLISHED Published: 2022-03-09T21:52:59 Last Updated: 2024-08-04T04:25:16.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/modify_account_pwd feature, which allows malicious users to execute arbitrary code on the system via a crafted post request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/modifyAccPwdRegister
CVE ID: CVE-2021-44631 State: PUBLISHED Published: 2022-03-09T21:55:34 Last Updated: 2024-08-04T04:25:16.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/reset_cloud_pwd feature, which allows malicous users to execute arbitrary code on the system via a crafted post request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/resetCloudPwdRegister
CVE ID: CVE-2021-44632 State: PUBLISHED Published: 2022-03-09T21:58:06 Last Updated: 2024-08-04T04:25:17.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/upgrade_info feature, which allows malicious users to execute arbitrary code on the system via a crafted post request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/upgradeInfoRegister
CVE ID: CVE-2021-44647 State: PUBLISHED Published: 2022-01-11T00:00:00 Last Updated: 2024-08-04T04:25:16.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://lua-users.org/lists/lua-l/2021-11/msg00195.html - http://lua-users.org/lists/lua-l/2021-11/msg00204.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3EMGAQ5Y6GXJLY4K5DUOOEQT4MZ4J4F/ - https://access.redhat.com/security/cve/cve-2021-44647 - https://security.ge
/message/P3EMGAQ5Y6GXJLY4K5DUOOEQT4MZ4J4F/ - https://access.redhat.com/security/cve/cve-2021-44647 - https://security.gentoo.org/glsa/202305-23
CVE ID: CVE-2021-44648 State: PUBLISHED Published: 2022-01-12T12:31:26 Last Updated: 2024-08-04T04:25:16.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/136 - https://sahildhar.github.io/blogpost/GdkPixbuf-Heap-Buffer-Overflow-in-lzw_decoder_new/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/ -
.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEVTOGIJITK2N5AOOLKKMDIICZDQE6CH/ - https://www.debian.org/security/2022/dsa-5228
CVE ID: CVE-2021-44649 State: PUBLISHED Published: 2022-01-12T12:57:19 Last Updated: 2024-08-04T04:25:16.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user. Additional Analyst Notes: - CVE Program Container: References: - https://sahildhar.github.io/blogpost/Django-CMS-Reflected-XSS-Vulnerability/ - https://www.django-cms.org/en/blog/2020/07/22/django-cms-security-updates-1/