Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/ - https://security.gentoo.org/glsa/202401-27
CVE ID: CVE-2021-41819 State: PUBLISHED Published: 2022-01-01T00:00:00.000Z Last Updated: 2025-05-22T15:00:52.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/910552 - https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/ - https://security.netapp.com/advisory/ntap-20220121-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
isory/ntap-20220121-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/ - https://security.gentoo.org/glsa/202401-27
CVE ID: CVE-2021-41821 State: PUBLISHED Published: 2021-09-29T22:59:02 Last Updated: 2024-08-04T03:22:24.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial of service. A crafted message must be sent from an authenticated agent to the manager. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.wazuh.com/current/release-notes/release_4_2_0.html - https://github.com/wazuh/wazuh/issues/9201
CVE ID: CVE-2021-41823 State: PUBLISHED Published: 2023-01-01T00:00:00.000Z Last Updated: 2025-04-11T14:44:50.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Application Firewall (WAF) in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pastebin.com/kpx9Nvbf
CVE ID: CVE-2021-41824 State: PUBLISHED Published: 2021-09-29T23:19:56 Last Updated: 2024-08-04T03:22:24.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS before 3.7.14 allows CSV injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28 - https://twitter.com/craftcmsupdates/status/1442928690145366018 - https://github.com/craftcms/cms/security/advisories/GHSA-h7vq-5qgw-jwwq
CVE ID: CVE-2021-41825 State: PUBLISHED Published: 2021-10-08T15:07:00 Last Updated: 2024-08-04T03:22:24.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.verint.com/engagement/our-offerings/solutions/workforce-optimization/ - https://0xy37.medium.com/my-first-cve-cve-2021-41825-verint-workforce-optimization-html-injection-6dd450e7f2af
CVE ID: CVE-2021-41826 State: PUBLISHED Published: 2021-09-29T23:41:16 Last Updated: 2024-08-04T03:22:24.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PlaceOS/auth/issues/36 - http://packetstormsecurity.com/files/164345/PlaceOS-1.2109.1-Open-Redirection.html
CVE ID: CVE-2021-41827 State: PUBLISHED Published: 2021-09-30T02:36:17 Last Updated: 2024-08-04T03:22:24.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds to the DCBackupRestore JAR archive. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/nestedif/vulnerability-disclosure-hardcoded-keys-password-zoho-r-a-p-318aa9bba2e - https://www.manageengine.com/remote-desktop-management/hotfix-readme.html
CVE ID: CVE-2021-41828 State: PUBLISHED Published: 2021-09-30T02:36:04 Last Updated: 2024-08-04T03:22:24.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/nestedif/vulnerability-disclosure-hardcoded-keys-password-zoho-r-a-p-318aa9bba2e - https://www.manageengine.com/remote-desktop-management/hotfix-readme.html
CVE ID: CVE-2021-41829 State: PUBLISHED Published: 2021-09-30T02:35:45 Last Updated: 2024-08-04T03:22:24.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/remote-desktop-management/hotfix-readme.html - https://medium.com/nestedif/vulnerability-disclosure-statically-derived-encryption-key-zoho-r-a-p-907088263197
CVE ID: CVE-2021-41830 State: PUBLISHED Published: 2021-10-11T08:10:12 Last Updated: 2024-08-04T03:22:24.927Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-347 Description: It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25633 for the LibreOffice advisory. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r97d287c88881aa581f1b18cb01e2cbedc4e6eae85958491acb89b12e%40%3Cusers.openoffice.apache.org%3E - https://lists.apache.
ml/r97d287c88881aa581f1b18cb01e2cbedc4e6eae85958491acb89b12e%40%3Cusers.openoffice.apache.org%3E - https://lists.apache.org/thread.html/raaab8a3b91f8d7b7ba14f873b8d0fd13952c823acc3385b7a374e754%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-41831 State: PUBLISHED Published: 2021-10-11T08:10:14 Last Updated: 2024-08-04T03:22:24.979Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-347 Description: It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25634 for the LibreOffice advisory. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ra74d5057cdc781a36286a83e8bcbc90a7678f030ae73339c35dfc4f9%40%3Cusers.openoffice.apache.org%3E - https://lists.apache.org/thread.html/rc5c277cb83e335696
0a7678f030ae73339c35dfc4f9%40%3Cusers.openoffice.apache.org%3E - https://lists.apache.org/thread.html/rc5c277cb83e335696657c5f27da1d1e2b5cb48346b0b55415a233757%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-41832 State: PUBLISHED Published: 2021-10-11T08:10:15 Last Updated: 2024-08-04T03:22:24.932Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-347 Description: It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25635 for the LibreOffice advisory. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rd3214a568b43dd335b5d558f521377f4bff750684dea18eb041fc1bb%40%3Cusers.openoffice.apache.org%3E - https://lists.apache.org/thread.html
3dd335b5d558f521377f4bff750684dea18eb041fc1bb%40%3Cusers.openoffice.apache.org%3E - https://lists.apache.org/thread.html/rfbc93cd7cea40e2ad3b6e080f688dd02566cdd2b1984fcbb6f8b0fb6%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-41833 State: PUBLISHED Published: 2021-11-11T04:30:52 Last Updated: 2024-08-04T03:22:24.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/en/community/topic/unauthenticated-remote-code-execution-vulnerability-solved - https://www.manageengine.com/sccm-third-party-patch-management/kb/unauthenticated-remote-code-execution.html
CVE ID: CVE-2021-41834 State: PUBLISHED Published: 2022-05-23T07:05:10 Last Updated: 2024-08-04T03:22:24.943Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: JFrog Products: Artifactory Problem Types: CWE-284 Description: JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.jfrog.com/confluence/display/JFROG/CVE-2021-41834%3A+Artifactory+Broken+Access+Control+on+Copy+Artif
nces: - https://www.jfrog.com/confluence/display/JFROG/CVE-2021-41834%3A+Artifactory+Broken+Access+Control+on+Copy+Artifact
CVE ID: CVE-2021-41835 State: PUBLISHED Published: 2022-01-21T18:17:44.000Z Last Updated: 2025-04-16T16:46:42.361Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Fresenius Kabi Products: Agilia Link+ Problem Types: CWE-327 Description: Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer encryption is offered on Port TCP/443, but the affected service does not perform an automated redirect from the unencrypted service on Port TCP/80 to the encrypted service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.
ncrypted service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
CVE ID: CVE-2021-41836 State: PUBLISHED Published: 2021-12-14T15:50:10.933Z Last Updated: 2025-02-10T14:55:13.698Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Fathom Analytics Products: Fathom Analytics Problem Types: CWE-79 Description: The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the $site_id parameter found in the ~/fathom-analytics.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.0.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and
to and including 3.0.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-41836 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2641005%40fathom-analytics&new=2641005%40fathom-analytics&sfp_email=&sfph_mail=
CVE ID: CVE-2021-41837 State: PUBLISHED Published: 2022-02-03T01:23:39.000Z Last Updated: 2025-11-04T19:12:34.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022024 - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf -
- https://www.insyde.com/security-pledge/SA-2022024 - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf - https://security.netapp.com/advisory/ntap-20220222-0003/
CVE ID: CVE-2021-41838 State: PUBLISHED Published: 2022-02-03T01:43:30.000Z Last Updated: 2025-11-04T19:12:35.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SdHostDriver in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of a Numeric Range Comparison Without a Minimum Check. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022023 - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf - https://security.netapp.
m/security-pledge/SA-2022023 - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf - https://security.netapp.com/advisory/ntap-20220222-0001/
CVE ID: CVE-2021-41839 State: PUBLISHED Published: 2022-02-03T01:37:10.000Z Last Updated: 2025-11-04T19:12:36.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022020 - https://security.netapp.com/advisory/ntap-20220217-0016/ - htt
dge - https://www.insyde.com/security-pledge/SA-2022020 - https://security.netapp.com/advisory/ntap-20220217-0016/ - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
CVE ID: CVE-2021-41840 State: PUBLISHED Published: 2022-02-03T01:20:07.000Z Last Updated: 2025-11-04T19:12:37.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022018 - https://security.netapp.com/advisory/ntap-20220217-0014/ - https://cert-portal.
.insyde.com/security-pledge/SA-2022018 - https://security.netapp.com/advisory/ntap-20220217-0014/ - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
CVE ID: CVE-2021-41841 State: PUBLISHED Published: 2022-02-03T01:04:57.000Z Last Updated: 2025-11-04T19:12:38.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022019 - https://security.netapp.com/advisory/ntap-20220217-0012/ - https://cert-portal.sie
syde.com/security-pledge/SA-2022019 - https://security.netapp.com/advisory/ntap-20220217-0012/ - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
CVE ID: CVE-2021-41842 State: PUBLISHED Published: 2022-01-05T23:07:11 Last Updated: 2024-08-04T03:22:25.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.4 before 05.43.46, and 5.5 before 05.51.45 in Insyde InsydeH2O. Code execution can occur because the SMI handler lacks a CommBuffer check. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://security.netapp.com/advisory/ntap-20220223-0002/
CVE ID: CVE-2021-41843 State: PUBLISHED Published: 2021-12-17T03:25:44 Last Updated: 2024-08-04T03:22:25.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter provider_id, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI. Additional Analyst Notes: - CVE Program Container: References: - https://trovent.io/security-advisory-2109-01 - https://trovent.github.io/security-advisories/TRSA-2109-01/TRSA-2109-01.txt - http://packetstormsecurity.com/files/165301/OpenEM
trovent.github.io/security-advisories/TRSA-2109-01/TRSA-2109-01.txt - http://packetstormsecurity.com/files/165301/OpenEMR-6.0.0-6.1.0-dev-SQL-Injection.html - http://seclists.org/fulldisclosure/2021/Dec/38
CVE ID: CVE-2021-41844 State: PUBLISHED Published: 2021-12-15T05:52:50 Last Updated: 2024-08-04T03:22:24.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. Additional Analyst Notes: - CVE Program Container: References: - https://crocoblock.com/changelog/?plugin=jet-engine
CVE ID: CVE-2021-41845 State: PUBLISHED Published: 2021-10-01T18:14:44 Last Updated: 2024-08-04T03:22:25.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007. The only affected versions are 10.9.000032 through 11.0.000006. Additional Analyst Notes: - CVE Program Container: References: - https://docs.thycotic.com/bulletins/current/2021/11.0.000007.md - https://docs.thycotic.com/ss/11.0.0/release-notes/ss-rn-11-0-000007.md
CVE ID: CVE-2021-41847 State: PUBLISHED Published: 2021-10-01T22:25:40 Last Updated: 2024-08-04T03:22:25.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and Prox card credentials. Also, an authorized user of one zone can send API requests to unlock electronic locks associated with zones they are unauthorized to have access to. They can also create new user logins for zones they were not authorized to access,
y are unauthorized to have access to. They can also create new user logins for zones they were not authorized to access, including the root zone of the software. Additional Analyst Notes: - CVE Program Container: References: - https://www.3xlogic.com/infinias-access-control - https://grant-rose.com/infinias-access-control-vulnerability/ - https://gitlab.com/grose88/infinias
CVE ID: CVE-2021-41848 State: PUBLISHED Published: 2022-03-11T22:17:42 Last Updated: 2024-08-04T03:22:25.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It mishandles software updates such that local third-party apps can provide a spoofed software update file that contains an arbitrary shell script and arbitrary ARM binary, where both will be executed as the root user with an SELinux domain named osi. To exploit this vulnerability, a local third-party app needs to have write access to external storage to write the spoofed update at the expected path. The vulnerable system binary (i.e., /system/bin/osi_bin) doe
l storage to write the spoofed update at the expected path. The vulnerable system binary (i.e., /system/bin/osi_bin) does not perform any authentication of the update file beyond ensuring that it is encrypted with an AES key (that is hard-coded in the vulnerable system binary). Processes executing with the osi SELinux domain can programmatically perform the following actions: install apps, grant runtime permissions to apps (including permissions with protection levels of dangerous and development), access extensive Personally Identifiable Information (PII) using the programmatically grant permissions, uninstall apps, set the default launcher app to a malicious launcher app that spoofs other
matically grant permissions, uninstall apps, set the default launcher app to a malicious launcher app that spoofs other apps, set a network proxy to intercept network traffic, unload kernel modules, set the default keyboard to a keyboard that has keylogging functionality, examine notification contents, send text messages, and more. The spoofed update can optionally contain an arbitrary ARM binary that will be locally stored in internal storage and executed at system startup to achieve persistent code execution as the root user with the osi SELinux domain. This ARM binary will continue to execute at startup even if the app that provided the spoofed update is uninstalled. Additional Analyst No
ll continue to execute at startup even if the app that provided the spoofed update is uninstalled. Additional Analyst Notes: - CVE Program Container: References: - https://simowireless.com/ - https://www.kryptowire.com/android-firmware-2022/ - https://athack.com/session-details/401 - https://www.kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed/
CVE ID: CVE-2021-41849 State: PUBLISHED Published: 2022-03-11T22:17:42 Last Updated: 2024-08-04T03:22:25.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to servers located in China: user's list of installed apps and device International Mobile Equipment Identity (IMEI). This PII is transmitted to log.skyroam.com.cn using HTTP, independent of whether the user uses the Simo software. Additional Analyst Notes: - CVE Program Container: References: - https://simowireless.com/ - https://www.kryptowire.com/android-firmware-2022/
s: - CVE Program Container: References: - https://simowireless.com/ - https://www.kryptowire.com/android-firmware-2022/ - https://athack.com/session-details/401 - https://www.kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed/
CVE ID: CVE-2021-41850 State: PUBLISHED Published: 2022-03-11T22:17:28 Last Updated: 2024-08-04T03:22:24.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Luna Simo PPR1.180610.011/202001031830. A pre-installed app with a package name of com.skyroam.silverhelper writes three IMEI values to system properties at system startup. The system property values can be obtained via getprop by all third-party applications co-located on the device, even those with no permissions granted, exposing the IMEI values to processes without enforcing any access control. Additional Analyst Notes: - CVE Program Container: References: - https://simowireless.com/ - https://w
y access control. Additional Analyst Notes: - CVE Program Container: References: - https://simowireless.com/ - https://www.kryptowire.com/android-firmware-2022/ - https://athack.com/session-details/401 - https://www.kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed/
CVE ID: CVE-2021-41851 State: REJECTED Published: N/A Last Updated: 2025-02-13T16:28:32.001Z Description: No description available.
CVE ID: CVE-2021-41852 State: REJECTED Published: N/A Last Updated: 2025-02-13T16:28:32.496Z Description: No description available.
CVE ID: CVE-2021-41853 State: REJECTED Published: N/A Last Updated: 2025-02-13T16:28:33.093Z Description: No description available.
CVE ID: CVE-2021-41854 State: REJECTED Published: N/A Last Updated: 2025-02-13T16:28:33.633Z Description: No description available.