Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rior to 2.2.1.6. Hitachi ABB Power Grids Relion 650 1.1; 1.2; 1.3 versions prior to 1.3.0.7. Hitachi ABB Power Grids REB500 7.3; 7.4; 7.5; 7.6; 8.2; 8.3. Hitachi ABB Power Grids RTU500 Series 7.x version 7.x and prior versions; 8.x version 8.x and prior versions; 9.x version 9.x and prior versions; 10.x version 10.x and prior versions; 11.x version 11.x and prior versions; 12.x version 12.x and prior versions. Hitachi ABB Power Grids FOX615 (TEGO1) R1D02 version R1D02 and prior versions. Hitachi ABB Power Grids MSM 2.1.0 versions prior to 2.1.0. Hitachi ABB Power Grids GMS600 1.3.0 version 1.3.0 and prior versions. Hitachi ABB Power Grids PWC600 1.0 versions prior to 1.0.1.4; 1.1 versions pr
00 1.3.0 version 1.3.0 and prior versions. Hitachi ABB Power Grids PWC600 1.0 versions prior to 1.0.1.4; 1.1 versions prior to 1.1.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A8932&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A8936&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A8934&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A8937&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.
com/library/Download.aspx?DocumentID=9AKK107991A8937&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A9057&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A9058&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A9059&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-27197 State: PUBLISHED Published: 2021-02-12T15:51:13 Last Updated: 2024-08-03T20:40:47.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with "OBJECT classid=" and "<SCRIPT language='vbscript'>") to overwrite arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-rev
CVE Program Container: References: - https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-revision-history - https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server_AFW.txt
CVE ID: CVE-2021-27198 State: PUBLISHED Published: 2021-02-26T22:53:27 Last Updated: 2024-08-03T20:40:47.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbitrary File Upload in the web service when using a myspeed/sf?filename= URI. This application is written in Java and is thus cross-platform. The Windows installation runs as SYSTEM, which means that exploitation gives one Administrator privileges on the target system. Additional Analyst Notes: - CVE Program Container: References: - https://myconnectionserver.visualware.com/download.html - https://myc
lyst Notes: - CVE Program Container: References: - https://myconnectionserver.visualware.com/download.html - https://myconnectionserver.visualware.com/support/newrelease.html - http://seclists.org/fulldisclosure/2021/Feb/81 - http://packetstormsecurity.com/files/161571/VisualWare-MyConnection-Server-11.x-Remote-Code-Execution.html - https://www.securifera.com/advisories/cve-2021-27198/
CVE ID: CVE-2021-27200 State: PUBLISHED Published: 2021-06-11T17:40:45 Last Updated: 2024-08-03T20:40:47.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day. Additional Analyst Notes: - CVE Program Container: References: - https://www.wowonder.com - https://securityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-27200 - https://www.exploit-db.com/exploits/49989
CVE ID: CVE-2021-27201 State: PUBLISHED Published: 2021-02-15T18:17:00 Last Updated: 2024-08-03T20:40:47.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MucahitSaratar/endian_firewall_authenticated_rce - https://www.endian.com/company/news/endian-community-releases-new-version-332-148/ - https://sourceforge.net/projects/efw/files/Development/EFW-3.3.2/
CVE ID: CVE-2021-27203 State: PUBLISHED Published: 2021-02-16T19:52:37 Last Updated: 2024-08-03T20:40:47.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Dekart Private Disk 2.15, invalid use of the Type3 user buffer for IOCTL codes using METHOD_NEITHER results in arbitrary memory dereferencing. Additional Analyst Notes: - CVE Program Container: References: - https://www.dekart.com/products/encryption/private_disk - https://www.rootshellsecurity.net/rootshell-discover-denial-of-service-flaw-dekart-private-disk-encryption-software/
CVE ID: CVE-2021-27204 State: PUBLISHED Published: 2021-02-12T07:48:51 Last Updated: 2024-08-03T20:40:47.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html - https://www.youtube.com/watch?v=zEt-_5b4OaA
CVE ID: CVE-2021-27205 State: PUBLISHED Published: 2021-02-12T07:48:39 Last Updated: 2024-08-03T20:40:47.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html - https://www.youtube.com/watch?v=Go-4srm_1fQ
CVE ID: CVE-2021-27208 State: PUBLISHED Published: 2021-03-15T12:27:26 Last Updated: 2024-08-03T20:40:47.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: When booting a Zync-7000 SOC device from nand flash memory, the nand driver in the ROM does not validate the inputs when reading in any parameters in the nand’s parameter page. IF a field read in from the parameter page is too large, this causes a buffer overflow that could lead to arbitrary code execution. Physical access and modification of the board assembly on which the Zynq-7000 SoC device mounted is needed to replace the original NAND flash memory with a NAND flash emulation device for this attack to be successful. Addi
eded to replace the original NAND flash memory with a NAND flash emulation device for this attack to be successful. Additional Analyst Notes: - CVE Program Container: References: - https://www.xilinx.com/products/silicon-devices/soc/zynq-7000.html - https://www.xilinx.com/support/answers/76201.html - http://www.onfi.org/specifications
CVE ID: CVE-2021-27209 State: PUBLISHED Published: 2021-02-13T00:05:15 Last Updated: 2024-08-03T20:40:47.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the management interface on TP-Link Archer C5v 1.7_181221 devices, credentials are sent in a base64 format over cleartext HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://gokay.org/tp-link-archer-c5v-base64-cookie/
CVE ID: CVE-2021-27210 State: PUBLISHED Published: 2021-02-13T00:04:57 Last Updated: 2024-08-03T20:40:47.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Archer C5v 1.7_181221 devices allows remote attackers to retrieve cleartext credentials via [USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0 to the /cgi?1&5 URI. Additional Analyst Notes: - CVE Program Container: References: - https://gokay.org/tp-links-archer-c5v-improper-authorization/
CVE ID: CVE-2021-27211 State: PUBLISHED Published: 2021-02-15T18:40:48 Last Updated: 2024-08-03T20:40:47.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/steghide/files/steghide/0.5.1/ - https://github.com/StefanoDeVuono/steghide - https://github.com/b4shfire/stegcrack - http://packetstormsecurity.com/files/165199/Steghide-Hidden-Data-Extraction.html
CVE ID: CVE-2021-27212 State: PUBLISHED Published: 2021-02-14T02:53:26 Last Updated: 2024-08-03T20:40:47.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.openldap.org/show_bug.cgi?id=9454 - https://git.openldap.org/openldap/openldap/-/commit/3539fc33212b528c56b716584f2c2994af7c30b0 - https://git.openldap.org/openldap/openldap/-
p.org/openldap/openldap/-/commit/3539fc33212b528c56b716584f2c2994af7c30b0 - https://git.openldap.org/openldap/openldap/-/commit/9badb73425a67768c09bcaed1a9c26c684af6c30 - https://lists.debian.org/debian-lts-announce/2021/02/msg00035.html - https://www.debian.org/security/2021/dsa-4860 - https://security.netapp.com/advisory/ntap-20210319-0005/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2021-27213 State: PUBLISHED Published: 2021-02-14T03:05:22 Last Updated: 2024-08-03T20:40:47.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safe_load are not used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cvandeplas/pystemon/commit/dbeb87afefdb63de2f4cff69b6f10c5965d14b54 - https://www.huntr.dev/bounties/1-other-pystemon/
CVE ID: CVE-2021-27214 State: PUBLISHED Published: 2021-02-19T18:39:28 Last Updated: 2024-08-03T20:40:47.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/release-notes.html - https://www.horizonsecurity.i
rences: - https://www.manageengine.com/products/self-service-password/release-notes.html - https://www.horizonsecurity.it/lang_EN/advisories/?a=20&title=ManageEngine+ADSelfService+Plus+privilege+escalation++CVE202127214
CVE ID: CVE-2021-27215 State: PUBLISHED Published: 2021-03-03T15:45:53 Last Updated: 2024-08-03T20:40:47.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces (Admin, Userweb, Sidechannel) can use different methods to perform the authentication of a user. A specific authentication method during login does not check the provided data (when a certain manipulation occurs) and returns OK for any authentication request. This allows an attacker to login to the admin panel as a user of his choice, e.g., the root user (with highest privileges) or even a
an attacker to login to the admin panel as a user of his choice, e.g., the root user (with highest privileges) or even a non-existing user. Additional Analyst Notes: - CVE Program Container: References: - https://www.genua.de/en/it-security-solutions/high-resistance-firewall-genugate - https://kunde.genua.de/en/overview/genugate.html - https://sec-consult.com/vulnerability-lab/advisory/authentication-bypass-genua-genugate/
CVE ID: CVE-2021-27216 State: PUBLISHED Published: 2021-05-06T04:44:50 Last Updated: 2024-08-03T20:40:47.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options. Additional Analyst Notes: - CVE Program Container: References: - https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28007-LFDIR.txt
CVE ID: CVE-2021-27217 State: PUBLISHED Published: 2021-03-04T17:45:33 Last Updated: 2024-08-03T20:40:47.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device. Out-of-bounds reads performed by aes_remove_padding() can crash the running process, depending on the memory layout. This could be used by an attacker to cause a client-side denial of service. The yubihsm-shell project is included in the YubiHSM 2 SDK product. Additional Analyst Notes: - CVE Program Container:
The yubihsm-shell project is included in the YubiHSM 2 SDK product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yubico/yubihsm-shell/releases - https://www.yubico.com/support/security-advisories/ysa-2021-01/ - https://blog.inhq.net/posts/yubico-libyubihsm-vuln2
CVE ID: CVE-2021-27218 State: PUBLISHED Published: 2021-02-15T16:27:20 Last Updated: 2024-08-03T20:40:47.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1942 - https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1944 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40
/merge_requests/1944 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2REA7RVKN7ZHRLJOEGBRQKJIPZQPAELZ/ - https://security.netapp.com/advisory/ntap-20210319-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJMPNDO4GDVURYQFYKFOWY5HAF4FTEPN/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696
bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E - https://security.gentoo.org/glsa/202107-13 - https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html
CVE ID: CVE-2021-27219 State: PUBLISHED Published: 2021-02-15T16:27:38 Last Updated: 2024-08-03T20:40:47.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/glib/-/issues/2319 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://lists.fedoraproject.org/arc
fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2REA7RVKN7ZHRLJOEGBRQKJIPZQPAELZ/ - https://security.netapp.com/advisory/ntap-20210319-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJMPNDO4GDVURYQFYKFOWY5HAF4FTEPN/ - https://security.gentoo.org/glsa/202107-13 - https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html
CVE ID: CVE-2021-27220 State: PUBLISHED Published: 2021-03-31T21:50:56 Last Updated: 2024-08-03T20:40:47.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PRTG Network Monitor before 21.1.66.1623. By invoking the screenshot functionality with prepared context paths, an attacker is able to verify the existence of certain files on the filesystem of the PRTG's Web server. Additional Analyst Notes: - CVE Program Container: References: - https://www.paessler.com/prtg/history/stable#21.1.66.1623
CVE ID: CVE-2021-27221 State: PUBLISHED Published: 2021-03-19T02:28:41 Last Updated: 2024-08-03T20:40:47.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work Additional Analyst Notes: - CVE Program Container: References: - https://onovy.medium.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfe
CVE ID: CVE-2021-27222 State: PUBLISHED Published: 2021-03-08T14:01:02 Last Updated: 2024-08-03T20:40:47.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the "Time in Status" app before 4.13.0 for Jira, remote authenticated attackers can cause Stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/1211756/time-in-status/version-history - https://dev.obss.com.tr/confluence/display/MD/2021-02-25+Time+in+Status+for+Jira+Server+and+Data+Center+Security+Advisory - https://dev.obss.com.tr/jira/browse/APDTIS-1097?src=confmacro
CVE ID: CVE-2021-27223 State: PUBLISHED Published: 2022-04-01T22:17:48 Last Updated: 2024-08-03T20:40:47.509Z Vendors: n/a Products: Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security Problem Types: Denial-of-Service (DoS) Description: A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security. A local user could cause Windows crash by running a specially crafted binary module. The fix was delivered automatically. Credits: (Straghkov Denis, Kurmangaleev Shamil, Fedotov Andrey, Kuts Daniil, Mishechkin Maxim, Akolzin Vitaliy) @ ISPRAS Additional Analyst Notes: - CVE Program Container: R
ov Andrey, Kuts Daniil, Mishechkin Maxim, Akolzin Vitaliy) @ ISPRAS Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_1
CVE ID: CVE-2021-27224 State: PUBLISHED Published: 2021-02-17T15:44:24 Last Updated: 2024-08-03T20:48:15.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a user-mode write access violation starting at WPG+0x0000000000012ec6, which might allow remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.irfanview.com/plugins.htm - https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-irfanview-wpg/ - http://packetstormsecurity.com/files/161449/IrfanView-4.57-Denial-Of-Service-Code-Execution.html
CVE ID: CVE-2021-27225 State: PUBLISHED Published: 2021-03-01T00:24:18 Last Updated: 2024-08-03T20:48:15.867Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite notebooks in projects that they are not authorized to access. Additional Analyst Notes: - CVE Program Container: References: - https://doc.dataiku.com/dss/latest/ - https://doc.dataiku.com/dss/8.0/security/advisories/cve-2021-27225.html
CVE ID: CVE-2021-27228 State: PUBLISHED Published: 2021-02-22T16:16:53 Last Updated: 2024-08-03T20:48:16.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names (such as constructor or hasOwnProperty) to convince the System that the supplied API Key exists in the underlying JS object, and consequently achieve complete access to User/Admin/Super API functions, as demonstrated by a /super/constructor/accounts/list URI. Additional Analyst Notes: - CVE Program Container: References: - ht
onstrated by a /super/constructor/accounts/list URI. Additional Analyst Notes: - CVE Program Container: References: - https://shinobi.video/ - https://gitlab.com/Shinobi-Systems/Shinobi/-/tags - https://gitlab.com/Shinobi-Systems/Shinobi/-/merge_requests/286
CVE ID: CVE-2021-27229 State: PUBLISHED Published: 2021-02-16T03:04:01 Last Updated: 2024-08-03T20:48:15.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mumble-voip/mumble/compare/1.3.3...1.3.4 - https://github.com/mumble-voip/mumble/pull/4733 - https://github.com/mumble-voip/mumble/commit/e59ee87abe249f345908c7d568f6879d16bfd648 - https://lists.debian.org/debian-lts-announce/2021/02/msg00022.html - https://security.gentoo.org/glsa/202105-13
CVE ID: CVE-2021-27230 State: PUBLISHED Published: 2021-03-15T22:52:42 Last Updated: 2024-08-03T20:48:15.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1093444 - https://expressionengine.com/features - http://seclists.org/fulldisclosure/2021/Mar/32 - http://karmainsecurity.com/KIS-2021-03 - http://packetstormsecurity.com/files/161805/ExpressionEngine-6.0.2-PHP-Code-Injec
tp://karmainsecurity.com/KIS-2021-03 - http://packetstormsecurity.com/files/161805/ExpressionEngine-6.0.2-PHP-Code-Injection.html
CVE ID: CVE-2021-27231 State: PUBLISHED Published: 2021-02-16T03:19:56 Last Updated: 2024-08-03T20:48:15.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hestiacp/hestiacp/issues/1622 - https://www.hestiacp.com/ - https://sick.codes/sick-2021-006 - https://github.com/sickcodes/security/blob/master/advisories/sick-2021-006.md