Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-42577 State: PUBLISHED Published: 2022-03-11T22:09:25 Last Updated: 2024-08-04T03:38:49.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://softing.com - https://industrial.softing.com/fileadmin/sof-files/pdf/ia/support/Security_Bulletin_CVE-2021-42577.pdf
CVE ID: CVE-2021-42580 State: PUBLISHED Published: 2021-11-15T15:57:28 Last Updated: 2024-08-04T03:38:49.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and authenticated file upload in (Master.php) file , we can craft these two vunlerablities to get unauthenticated remote command execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-07 - https://github.com/DjebbarAnon/online-learning-system-v2-sqli-authentication-bypass-file-upload-unaut
om23/CVE-nu11-07 - https://github.com/DjebbarAnon/online-learning-system-v2-sqli-authentication-bypass-file-upload-unauthenticated-RCE - http://packetstormsecurity.com/files/164985/Online-Learning-System-2.0-Remote-Code-Execution.html - https://www.nu11secur1ty.com/2021/09/cve-nu11-07-elearning-v2by-oretnom23-is.html - https://www.nu11secur1ty.com/2021/11/cve-2021-42580.html
CVE ID: CVE-2021-42581 State: PUBLISHED Published: 2022-05-10T10:08:13 Last Updated: 2024-08-04T03:38:49.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ramda/ramda/pull/3192 - https://j
es Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ramda/ramda/pull/3192 - https://jsfiddle.net/3pomzw5g/2/
CVE ID: CVE-2021-42583 State: PUBLISHED Published: 2021-12-28T18:12:42 Last Updated: 2024-08-04T03:38:49.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/foxcpp/maddy/blob/df40dce1284cd0fd0a9e8e7894029553d653d0a5/internal/auth/shadow/verify.go - https://github.com/foxcpp/maddy/releases/tag/v0.5.2
CVE ID: CVE-2021-42584 State: PUBLISHED Published: 2021-12-17T13:02:26 Last Updated: 2024-08-04T03:38:49.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) issue exists in Convos-Chat before 6.32. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/convos-chat/convos/commit/14a3b1e98cd1a3211c0ef3d4f5ffdbc60baaca54 - https://github.com/convos-chat/convos/issues/623 - https://dev696.github.io/Writeup/
CVE ID: CVE-2021-42585 State: PUBLISHED Published: 2022-05-23T10:35:43 Last Updated: 2024-08-04T03:38:49.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow was discovered in copy_compressed_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/351
CVE ID: CVE-2021-42586 State: PUBLISHED Published: 2022-05-23T10:39:30 Last Updated: 2024-08-04T03:38:49.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow was discovered in copy_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/350
CVE ID: CVE-2021-42597 State: PUBLISHED Published: 2022-09-16T16:23:15 Last Updated: 2024-08-04T03:38:49.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Storage Unit Rental Management System PHP 8.0.10 , Apache 2.4.14, SURMS V 1.0 via the Add New Tenant List Rent List form. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14932/storage-unit-rental-management-system-using-php-free-source-code.html - https://cxsecurity.com/issue/WLB-2022090036
CVE ID: CVE-2021-42612 State: PUBLISHED Published: 2022-05-24T18:02:24 Last Updated: 2024-08-04T03:38:49.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use after free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have other unspecified impact via a crafted text document. Additional Analyst Notes: - CVE Program Container: References: - https://carteryagemann.com/halibut-case-study.html#poc-halibut-text-uaf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CC7UZ7NRXDA7YSCSGWE2CBQM7OZS3K2R/
CVE ID: CVE-2021-42613 State: PUBLISHED Published: 2022-05-24T18:16:37 Last Updated: 2024-08-04T03:38:49.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: A double free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a denial of service or possibly have other unspecified impact via a crafted text document. Additional Analyst Notes: - CVE Program Container: References: - https://carteryagemann.com/halibut-case-study.html#poc-halibut-winhelp-df - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CC7UZ7NRXDA7YSCSGWE2CBQM7OZS3K2R/
CVE ID: CVE-2021-42614 State: PUBLISHED Published: 2022-05-24T18:30:27 Last Updated: 2024-08-04T03:38:50.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use after free in info_width_internal in bk_info.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document. Additional Analyst Notes: - CVE Program Container: References: - https://carteryagemann.com/halibut-case-study.html#poc-halibut-info-uaf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CC7UZ7NRXDA7YSCSGWE2CBQM7OZS3K2R/
CVE ID: CVE-2021-42624 State: PUBLISHED Published: 2021-11-04T10:36:48 Last Updated: 2024-08-04T03:38:49.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local buffer overflow vulnerability exists in the latest version of Miniftpd in ftpproto.c through the tmp variable, where a crafted payload can be sent to the affected function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Gabe-commiter/Miniftpd/issues/4
CVE ID: CVE-2021-42627 State: PUBLISHED Published: 2022-08-23T11:51:11 Last Updated: 2024-08-04T03:38:49.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page. Additional Analyst Notes: - CVE Program Container: References: - http://d-link.com - http://dlink.com - https://www.dlink.com/en/security-bulletin/ - https://github.com/sanjokkarki/D-Link-DIR-615/blob/main/CVE-2021-42627
CVE ID: CVE-2021-42631 State: PUBLISHED Published: 2022-01-31T17:48:05 Last Updated: 2024-08-04T03:38:49.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://printerlogic.com - https://www.printerlogic.com/security-bulletin/ - https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/p
nterlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html - https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints - https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite
CVE ID: CVE-2021-42633 State: PUBLISHED Published: 2022-02-02T17:10:08 Last Updated: 2024-08-04T03:38:49.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional audit records. Additional Analyst Notes: - CVE Program Container: References: - http://printerlogic.com - https://www.printerlogic.com/security-bulletin/ - https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpr
.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html - https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints - https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite
CVE ID: CVE-2021-42635 State: PUBLISHED Published: 2022-01-31T17:54:50 Last Updated: 2024-08-04T03:38:50.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://printerlogic.com - https://www.printerlogic.com/security-bulletin/ - https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/pri
erlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html - https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints - https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite
CVE ID: CVE-2021-42637 State: PUBLISHED Published: 2022-02-02T17:14:36 Last Updated: 2024-08-04T03:38:49.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a URL, resulting in a Server Side Request Forgery (SSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://printerlogic.com - https://www.printerlogic.com/security-bulletin/ - https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs
ttps://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html - https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints - https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite
CVE ID: CVE-2021-42638 State: PUBLISHED Published: 2022-02-01T22:08:54 Last Updated: 2024-08-04T03:38:49.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://printerlogic.com - https://www.printerlogic.com/security-bulletin/ - https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/print
logic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html - https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints - https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite
CVE ID: CVE-2021-42639 State: PUBLISHED Published: 2022-02-02T17:16:40 Last Updated: 2024-08-04T03:38:49.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to multiple reflected cross site scripting vulnerabilities. Attacker controlled input is reflected back in the page without sanitization. Additional Analyst Notes: - CVE Program Container: References: - http://printerlogic.com - https://www.printerlogic.com/security-bulletin/ - https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-prin
search-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html - https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints - https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite
CVE ID: CVE-2021-42640 State: PUBLISHED Published: 2022-02-02T17:18:46 Last Updated: 2024-08-04T03:38:49.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to reassign drivers for any printer. Additional Analyst Notes: - CVE Program Container: References: - http://printerlogic.com - https://www.printerlogic.com/security-bulletin/ - https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-print
earch-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html - https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints - https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite
CVE ID: CVE-2021-42641 State: PUBLISHED Published: 2022-02-02T17:21:27 Last Updated: 2024-08-04T03:38:49.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the username and email address of all users. Additional Analyst Notes: - CVE Program Container: References: - http://printerlogic.com - https://www.printerlogic.com/security-bulletin/ - https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-e
ds-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html - https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints - https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite
CVE ID: CVE-2021-42642 State: PUBLISHED Published: 2022-02-02T17:23:01 Last Updated: 2024-08-04T03:38:50.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the plaintext console username and password for a printer. Additional Analyst Notes: - CVE Program Container: References: - http://printerlogic.com - https://www.printerlogic.com/security-bulletin/ - https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-
anoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/ - https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite - https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html - https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints - https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite
CVE ID: CVE-2021-42643 State: PUBLISHED Published: 2022-05-17T11:15:54 Last Updated: 2024-08-04T03:38:49.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E5%92%8C%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/
CVE ID: CVE-2021-42644 State: PUBLISHED Published: 2022-05-17T11:21:58 Last Updated: 2024-08-04T03:38:50.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E5%92%8C%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/
CVE ID: CVE-2021-42645 State: PUBLISHED Published: 2022-05-10T11:14:13 Last Updated: 2024-08-04T03:38:50.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker must use the "File" parameter to upload a PHP payload to get a reverse shell from the vulnerable host. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Net-hunter121/CMSimple_XH-Unauth-RCE - https://github.com/cmsimple-xh/cmsimple-xh/releases/tag/1.7.5
CVE ID: CVE-2021-42646 State: PUBLISHED Published: 2022-05-11T00:00:00 Last Updated: 2024-08-04T03:38:49.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wso2/carbon-identity-framework/pul
. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wso2/carbon-identity-framework/pull/3472 - http://seclists.org/fulldisclosure/2022/Jun/7 - http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.html - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289/
CVE ID: CVE-2021-42648 State: PUBLISHED Published: 2022-05-11T17:34:38 Last Updated: 2024-08-04T03:38:49.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cdr/code-server/issues/4355
CVE ID: CVE-2021-42650 State: PUBLISHED Published: 2021-10-18T20:53:13 Last Updated: 2024-08-04T03:38:49.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/portainer/portainer/pull/5766 - https://github.com/purple-WL/Security-vulnerability/blob/main/Portainer%20Custom%20Templates%20xss
CVE ID: CVE-2021-42651 State: PUBLISHED Published: 2022-05-11T14:11:24 Last Updated: 2024-08-04T03:38:49.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/invuls/pentest-projects/pcf/-/commit/67ca59ff668a4f361a0c6b1327287e484987b6f1
CVE ID: CVE-2021-42654 State: PUBLISHED Published: 2022-05-24T12:41:13 Last Updated: 2024-08-04T03:38:50.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/siteserver/cms - https://github.com/siteserver/cms/issues/3236 - https://github.com/siteserver/cms/releases/download/siteserver-dev-v5.0.92/siteserver_install.zip