Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-20790 State: PUBLISHED Published: 2021-09-17T01:40:23 Last Updated: 2024-08-03T17:53:22.375Z Vendors: J’s Communication Co., Ltd. Products: RevoWorks Browser Problem Types: Process Control Description: Improper control of program execution vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to execute an arbitrary command or code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jscom.jp/news-20210910_2/ - https://jvn.jp/en/jp/JVN81658818/index.html
CVE ID: CVE-2021-20791 State: PUBLISHED Published: 2021-09-17T01:40:25 Last Updated: 2024-08-03T17:53:22.425Z Vendors: J’s Communication Co., Ltd. Products: RevoWorks Browser Problem Types: Improper Access Control Description: Improper access control vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to bypass access restriction and to exchange unauthorized files between the local environment and the isolated environment or settings of the web browser via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jscom.jp/news-20210910_2/ - https://jvn.jp/en/jp/JVN81658818/index.html
CVE ID: CVE-2021-20792 State: PUBLISHED Published: 2021-08-18T05:36:26 Last Updated: 2024-08-03T17:53:22.414Z Vendors: ExpressTech Products: Quiz And Survey Master Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://quizandsurveymaster.com/ - https://wordpress.org/plugins/quiz-master-next/ - https://plugins.trac.wordpress.org/changeset?new=2503364%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php&old=2490516%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fqu
64%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php&old=2490516%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php - https://jvn.jp/en/jp/JVN65388002/index.html
CVE ID: CVE-2021-20793 State: PUBLISHED Published: 2021-08-26T01:20:31 Last Updated: 2024-08-03T17:53:22.532Z Vendors: Sony Corporation Products: The installers of multiple Sony products Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.sony.co.uk/electronics/support/software/00266749 - https://www.sony.co.uk/electronics/support/softwar
ces: - https://www.sony.co.uk/electronics/support/software/00266749 - https://www.sony.co.uk/electronics/support/software/00266758 - https://www.sony.co.uk/electronics/support/software/00266642 - https://jvn.jp/en/jp/JVN80288258/index.html
CVE ID: CVE-2021-20795 State: PUBLISHED Published: 2021-10-13T08:30:47 Last Updated: 2024-08-03T17:53:23.059Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to hijack the authentication of administrators and unintended operations may be performed via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cybozu.support/article/37422 - https://jvn.jp/en/jp/JVN52694228/index.html
CVE ID: CVE-2021-20796 State: PUBLISHED Published: 2021-10-13T08:30:49 Last Updated: 2024-08-03T17:53:22.583Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Directory traversal Description: Directory traversal vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to upload an arbitrary file via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37427
CVE ID: CVE-2021-20797 State: PUBLISHED Published: 2021-10-13T08:30:50 Last Updated: 2024-08-03T17:53:23.130Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Cross-site script inclusion vulnerability Description: Cross-site script inclusion vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to obtain the information stored in the product. This issue occurs only when using Mozilla Firefox. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37429
CVE ID: CVE-2021-20798 State: PUBLISHED Published: 2021-10-13T08:30:52 Last Updated: 2024-08-03T17:53:22.814Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37424
CVE ID: CVE-2021-20799 State: PUBLISHED Published: 2021-10-13T08:30:53 Last Updated: 2024-08-03T17:53:22.605Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37425
CVE ID: CVE-2021-20800 State: PUBLISHED Published: 2021-10-13T08:30:55 Last Updated: 2024-08-03T17:53:22.451Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37420
CVE ID: CVE-2021-20801 State: PUBLISHED Published: 2021-10-13T08:30:57 Last Updated: 2024-08-03T17:53:22.673Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: XML external entities (XXE) Description: Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Firefox. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37423
CVE ID: CVE-2021-20802 State: PUBLISHED Published: 2021-10-13T08:30:58 Last Updated: 2024-08-03T17:53:22.625Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: HTTP header injection Description: HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37428
CVE ID: CVE-2021-20803 State: PUBLISHED Published: 2021-10-13T08:31:00 Last Updated: 2024-08-03T17:53:22.318Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Access controls issue Description: Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the management screen. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37421
CVE ID: CVE-2021-20804 State: PUBLISHED Published: 2021-10-13T08:31:01 Last Updated: 2024-08-03T17:53:22.817Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Denial-of-service (DoS) Description: Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to cause a denial of service (DoS) condition via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37426
CVE ID: CVE-2021-20805 State: PUBLISHED Published: 2021-10-13T08:31:03 Last Updated: 2024-08-03T17:53:22.671Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.7 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37431
CVE ID: CVE-2021-20806 State: PUBLISHED Published: 2021-10-13T08:31:04 Last Updated: 2024-08-03T17:53:22.509Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Open Redirect Description: Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37419
CVE ID: CVE-2021-20807 State: PUBLISHED Published: 2021-10-13T08:31:06 Last Updated: 2024-08-03T17:53:22.642Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.0.0 to 3.1.9 allows a remote attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN52694228/index.html - https://kb.cybozu.support/article/37430
CVE ID: CVE-2021-20808 State: PUBLISHED Published: 2021-08-26T01:20:32 Last Updated: 2024-08-03T17:53:23.060Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: Referen
s to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://movabletype.org/news/2021/08/mt-780-681-released.html - https://jvn.jp/en/jp/JVN97545738/index.html
CVE ID: CVE-2021-20809 State: PUBLISHED Published: 2021-08-26T01:20:35 Last Updated: 2024-08-03T17:53:22.889Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes
nd earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://movabletype.org/news/2021/08/mt-780-681-released.html - https://jvn.jp/en/jp/JVN97545738/index.html
CVE ID: CVE-2021-20810 State: PUBLISHED Published: 2021-08-26T01:20:38 Last Updated: 2024-08-03T17:53:22.466Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Contai
ote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://movabletype.org/news/2021/08/mt-780-681-released.html - https://jvn.jp/en/jp/JVN97545738/index.html
CVE ID: CVE-2021-20811 State: PUBLISHED Published: 2021-08-26T01:20:39 Last Updated: 2024-08-03T17:53:22.560Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container:
attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://movabletype.org/news/2021/08/mt-780-681-released.html - https://jvn.jp/en/jp/JVN97545738/index.html
CVE ID: CVE-2021-20812 State: PUBLISHED Published: 2021-08-26T01:20:41 Last Updated: 2024-08-03T17:53:22.692Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://movabletype.org/news/2021/08/mt-780-681-released.html - https://jvn.jp/en/jp/JVN97545738/index.html
CVE ID: CVE-2021-20813 State: PUBLISHED Published: 2021-08-26T01:20:42 Last Updated: 2024-08-03T17:53:22.533Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) and Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series)) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://movabletype.org/news/2021/08/mt-780-681-released.html - https://jvn.jp/en/jp/JVN97545738/index.html
CVE ID: CVE-2021-20814 State: PUBLISHED Published: 2021-08-26T01:20:44 Last Updated: 2024-08-03T17:53:22.733Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), and Movable Type Premium 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://movabletype.org/news/2021/08/mt-780-681-release
Additional Analyst Notes: - CVE Program Container: References: - https://movabletype.org/news/2021/08/mt-780-681-released.html - https://jvn.jp/en/jp/JVN97545738/index.html
CVE ID: CVE-2021-20815 State: PUBLISHED Published: 2021-08-26T01:20:46 Last Updated: 2024-08-03T17:53:22.622Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Containe
e attackers to inject arbitrary script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://movabletype.org/news/2021/08/mt-780-681-released.html - https://jvn.jp/en/jp/JVN97545738/index.html
CVE ID: CVE-2021-20825 State: PUBLISHED Published: 2021-09-17T01:40:26 Last Updated: 2024-08-03T17:53:22.783Z Vendors: shiro8 Co., Ltd. Products: List (order management) item change plug-in (for EC-CUBE 3.0 series) Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.ec-cube.net/products/detail.php?product_id=1419 - https://jvn.jp/en/jp/JVN46313661/index.html
CVE ID: CVE-2021-20826 State: PUBLISHED Published: 2021-12-24T06:30:26 Last Updated: 2024-08-03T17:53:22.508Z Vendors: IDEC Corporation Products: IDEC PLC Problem Types: Unprotected transport of credentials Description: Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from the communication between the PLC and the software. As a result, the complete access privileges to the PLC Web server
om the communication between the PLC and the software. As a result, the complete access privileges to the PLC Web server may be obtained, and manipulation of the PLC output and/or suspension of the PLC may be conducted. Additional Analyst Notes: - CVE Program Container: References: - https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf - https://jvn.jp/en/vu/JVNVU92279973/index.html
CVE ID: CVE-2021-20827 State: PUBLISHED Published: 2021-12-24T06:30:27 Last Updated: 2024-08-03T17:53:22.806Z Vendors: IDEC Corporation Products: IDEC PLC Problem Types: Plaintext storage of a password Description: Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the attacker may access the PLC Web server and
rvers, backup repositories, or ZLD files saved in SD cards. As a result, the attacker may access the PLC Web server and hijack the PLC, and manipulation of the PLC output and/or suspension of the PLC may be conducted. Additional Analyst Notes: - CVE Program Container: References: - https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf - https://jvn.jp/en/vu/JVNVU92279973/index.html
CVE ID: CVE-2021-20828 State: PUBLISHED Published: 2021-09-17T01:40:28 Last Updated: 2024-08-03T17:53:22.655Z Vendors: ActiveFusions Co., Ltd. Products: Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a remote attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.activefusions.com/news/2021/20210915.html - https://jvn.jp/en/jp/JVN23406150/index.html
CVE ID: CVE-2021-20829 State: PUBLISHED Published: 2021-09-21T09:25:10 Last Updated: 2024-08-03T17:53:23.057Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/vu/JVNVU94889258/index.html - https://weseek.co.jp/security/2021/09/17/vulnerability/growi-prevent-multiple-xss-addition/
CVE ID: CVE-2021-20831 State: PUBLISHED Published: 2021-10-13T08:31:07 Last Updated: 2024-08-03T17:53:22.824Z Vendors: Mario Valney Products: OG Tags Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of administrators and unintended operation may be performed via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/og-tags/ - https://jvn.jp/en/jp/JVN29428319/index.html
CVE ID: CVE-2021-20832 State: PUBLISHED Published: 2021-10-13T08:31:09 Last Updated: 2024-08-03T17:53:23.074Z Vendors: InBody Japan Inc. Products: InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510) Problem Types: Information Disclosure Description: InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510) contain a vulnerability which may lead to information disclosure only when it works with the body composition analyzer InBody Dial. This may allow an attacker who can connect to the InBody Dial with InBody App may obtain a victim's measurement result measured by InBody Dial. Additional Analyst Notes
e InBody Dial with InBody App may obtain a victim's measurement result measured by InBody Dial. Additional Analyst Notes: - CVE Program Container: References: - https://www.inbody.co.jp/inbody-news/?uid=55&mod=document&pageid=1 - https://jvn.jp/en/jp/JVN63023305/index.html
CVE ID: CVE-2021-20833 State: PUBLISHED Published: 2021-10-13T08:31:11 Last Updated: 2024-08-03T17:53:22.674Z Vendors: SODA, Inc. Products: SNKRDUNK Market Place App for iOS Problem Types: Improper server certificate verification Description: The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle attackers to eavesdrop on and/or alter encrypted communication via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://snkrdunk.com/information/37/ - https://jvn.jp/en/jp/JVN10168753/index.html
CVE ID: CVE-2021-20834 State: PUBLISHED Published: 2021-10-13T08:31:12 Last Updated: 2024-08-03T17:53:23.062Z Vendors: Nike, Inc. Products: Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2.177.1 Problem Types: Improper Authorization in Handler for Custom URL Scheme Description: Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2.177.1 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.nike.omeg
tional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=com.nike.omega - https://apps.apple.com/app/nike/id1095459556 - https://jvn.jp/en/jp/JVN89126639/index.html