Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43579 State: PUBLISHED Published: 2021-11-12T17:49:37 Last Updated: 2024-08-04T04:03:08.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML document linking to a crafted BMP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/michaelrsweet/htmldoc/issues/453 - https://github.com/michaelrsweet/htmldoc/commit/27d08989a5a567155d506ac870ae7d8cc88fa58b - https://github.com/michaelrsweet/htmldoc/compare/v1.9.12...v1.9.13 - https://github.com/michaelrsweet/htmldoc/issues/456 - https://lists.debian.or
rsweet/htmldoc/compare/v1.9.12...v1.9.13 - https://github.com/michaelrsweet/htmldoc/issues/456 - https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html
CVE ID: CVE-2021-43581 State: PUBLISHED Published: 2021-11-22T08:55:31 Last Updated: 2024-08-04T04:03:08.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. The specific issue exists within the parsing of U3D files. Incorrect use of the LibJpeg source manager inside the U3D library, and crafted data in a U3D file, can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/securit
the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-43582 State: PUBLISHED Published: 2021-11-22T08:55:56 Last Updated: 2024-08-04T04:03:08.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Use-After-Free Remote Vulnerability exists when reading a DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DWG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories - https://www.zer
l Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories - https://www.zerodayinitiative.com/advisories/ZDI-21-1353/
CVE ID: CVE-2021-43584 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-06-16T19:40:17.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: DOM-based Cross Site Scripting (XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent (NCPA) before 2.4.0 allows attackers to run arbitrary code via the name element when filtering for a log. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NagiosEnterprises/ncpa/issues/830
CVE ID: CVE-2021-43587 State: PUBLISHED Published: 2021-12-21T17:05:32.037059Z Last Updated: 2024-09-17T03:44:02.072Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: PowerPath Management Appliance Problem Types: CWE-321 Description: Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malicious user may potentially exploit this vulnerability to gain access to secrets and elevate to gain higher privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000194083/dsa-2021-260
CVE ID: CVE-2021-43588 State: PUBLISHED Published: 2022-01-24T20:10:22.321102Z Last Updated: 2024-09-16T20:12:50.097Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: Data Protection Central Problem Types: CWE-20 Description: Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000195103
CVE ID: CVE-2021-43589 State: PUBLISHED Published: 2022-01-24T20:10:23.923128Z Last Updated: 2024-09-17T00:21:04.462Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-77 Description: Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A locally authenticated user with high privileges may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the Unity underlying OS, with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege. Additional Analys
with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000194836/dsa-2021-271-dell-emc-unity-dell-emc-unity-vsa-and-dell-emc-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2021-43590 State: PUBLISHED Published: 2022-03-04T20:35:09.399838Z Last Updated: 2024-09-16T23:40:29.977Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Dell Products: Dell EMC Enterprise Storage Analytics for vRealize Operations Problem Types: CWE-256 Description: Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability. A local high privileged malicious user may potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges o
dentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000196329/dsa-2021
CVE ID: CVE-2021-43608 State: PUBLISHED Published: 2021-12-09T19:02:59 Last Updated: 2024-08-04T04:03:08.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d - https://www.doctri
ner: References: - https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d - https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html - https://github.com/doctrine/dbal/releases - https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622
CVE ID: CVE-2021-43609 State: PUBLISHED Published: 2023-11-08T00:00:00 Last Updated: 2024-09-17T13:02:40.223Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app/models/reporting/database_query.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be leveraged to leak local files from the host system, leading to remote code execution (RCE) through deserialization of malicious data. Additional Analyst Notes
host system, leading to remote code execution (RCE) through deserialization of malicious data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/pulse/cve-2021-43609-write-up-division5-security-4lgwe - https://github.com/d5sec/CVE-2021-43609-POC - https://community.spiceworks.com/blogs/help-desk-server-release-notes/3610-1-3-2-1-3-3
CVE ID: CVE-2021-43610 State: PUBLISHED Published: 2021-11-12T21:53:49 Last Updated: 2024-08-04T04:03:08.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in an unauthenticated SIP message, a different issue than CVE-2021-33056. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BelledonneCommunications/belle-sip/commit/d3f0651531e45e91c2e60f3a16a8b612802e5d2d - https://github.com/BelledonneCommunications/belle-sip/compare/5.0.18...5.0.20
CVE ID: CVE-2021-43611 State: PUBLISHED Published: 2021-11-12T21:53:17 Last Updated: 2024-08-04T04:03:08.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \ " in the display name of a From header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BelledonneCommunications/belle-sip/commit/d3f0651531e45e91c2e60f3a16a8b612802e5d2d - https://github.com/BelledonneCommunications/belle-sip/compare/5.0.18...5.0.20
CVE ID: CVE-2021-43612 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-13T16:28:43.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lldpd.github.io/security.html - https://github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7 - https://github.com/lldpd/lldpd/compare/1.0.12...1.0.13 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JY
re/1.0.12...1.0.13 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D/
CVE ID: CVE-2021-43615 State: PUBLISHED Published: 2022-02-03T01:09:57.000Z Last Updated: 2025-11-04T19:12:46.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 before 05.35.23, 5.4 before 05.43.22, and 5.5 before 05.51.22. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022013 - https://security.ne
nces: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022013 - https://security.netapp.com/advisory/ntap-20220216-0010/ - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
CVE ID: CVE-2021-43616 State: PUBLISHED Published: 2021-11-13T00:00:00 Last Updated: 2024-08-04T04:03:08.795Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to social
rement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to socially engineer package.json which has different dependencies than package-lock.json. That user would have to have file system or write access to change dependencies. The npm team states preventing malicious actors from socially engineering or gaining file system access is outside the scope of the npm CLI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/npm/cli/issues/2701 - https://docs.npmjs.com/cli/v7/commands/npm-ci - https://github.com/icatalina/CVE-2021-43616 - https://medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0 - https://
tps://github.com/icatalina/CVE-2021-43616 - https://medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0 - https://security.netapp.com/advisory/ntap-20211210-0002/ - https://github.com/npm/cli/commit/457e0ae61bbc55846f5af44afa4066921923490f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXNVFKOF5ZYH5NIRWHKN6O6UBCHDV6FE/ - https://docs.npmjs.com/cli/v8/commands/npm-ci - https://github.com/npm/cli/issues/2701#issuecomment-979054224 - https://github.com/npm/cli/issues/2701#issuecomment-972900511
CVE ID: CVE-2021-43617 State: PUBLISHED Published: 2021-11-14T15:32:39 Last Updated: 2024-08-04T04:03:08.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/laravel/framework/blob/2049de73aa09
Additional Analyst Notes: - CVE Program Container: References: - https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1331-L1333 - https://salsa.debian.org/php-team/php/-/commit/dc253886b5b2e9bc8d9e36db787abb083a667fd8 - https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6
CVE ID: CVE-2021-43618 State: PUBLISHED Published: 2021-11-15T00:00:00 Last Updated: 2024-08-04T04:03:08.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms. Additional Analyst Notes: - CVE Program Container: References: - https://gmplib.org/list-archives/gmp-bugs/2021-September/005077.html - https://bugs.debian.org/994405 - https://gmplib.org/repo/gmp-6.2/rev/561a9c25298e - https://lists.debian.org/debian-lts-announce/2021/12/msg00001.html - http://www.openwall.com/lists/oss-securi
9c25298e - https://lists.debian.org/debian-lts-announce/2021/12/msg00001.html - http://www.openwall.com/lists/oss-security/2022/10/13/3 - http://seclists.org/fulldisclosure/2022/Oct/8 - https://security.netapp.com/advisory/ntap-20221111-0001/ - https://security.gentoo.org/glsa/202309-13
CVE ID: CVE-2021-43619 State: PUBLISHED Published: 2022-03-01T04:31:25 Last Updated: 2024-08-04T04:03:08.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/support/arm-security-updates - https://www.trustedfirmware.org - https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/ - https://tf-m-user-guide.trustedfirmware.org/docs/security/security_advisories/fwu_write_vulnerability.html
CVE ID: CVE-2021-43620 State: PUBLISHED Published: 2021-11-15T04:16:20 Last Updated: 2024-08-04T04:03:08.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::from_ptr on a pointer to the string buffer, the string is terminated at the first '\0' byte, which might not be the end of the string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nvzqz/fruity/issues/14 - https://github.com/rustsec/advisory-db/pull/
rogram Container: References: - https://github.com/nvzqz/fruity/issues/14 - https://github.com/rustsec/advisory-db/pull/1102 - https://rustsec.org/advisories/RUSTSEC-2021-0123.html
CVE ID: CVE-2021-43628 State: PUBLISHED Published: 2021-12-22T17:17:09 Last Updated: 2024-08-04T04:03:08.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/2 - https://projectworlds.in/free-projects/php-projects/hospital-management-system-in-php/
CVE ID: CVE-2021-43629 State: PUBLISHED Published: 2021-12-22T17:18:32 Last Updated: 2024-08-04T04:03:08.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php. Additional Analyst Notes: - CVE Program Container: References: - https://projectworlds.in/free-projects/php-projects/hospital-management-system-in-php/ - https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/3
CVE ID: CVE-2021-43630 State: PUBLISHED Published: 2021-12-22T17:19:15 Last Updated: 2024-08-04T04:03:08.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php. As a result, an authenticated malicious user can compromise the databases system and in some cases leverage this vulnerability to get remote code execution on the remote web server. Additional Analyst Notes: - CVE Program Container: References: - https://projectworlds.in/free-projects/php-projects/hospital-management-system-in-php/ - https://github.com/projectworldsofficial/hospital-management-system-in-php
projects/hospital-management-system-in-php/ - https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/4
CVE ID: CVE-2021-43631 State: PUBLISHED Published: 2021-12-22T17:20:07 Last Updated: 2024-08-04T04:03:08.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment.php. Additional Analyst Notes: - CVE Program Container: References: - https://projectworlds.in/free-projects/php-projects/hospital-management-system-in-php/ - https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/5
CVE ID: CVE-2021-43633 State: PUBLISHED Published: 2022-04-14T12:18:16 Last Updated: 2024-08-04T04:03:08.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat, the script will be executed on the receiver chat. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14996/messaging-web-application-phpoop-free-source-code.html - https://medium.com/%40shaunwhorton/how-i-found-two-different-xss-vulnerabilities-a491144e8494
CVE ID: CVE-2021-43635 State: PUBLISHED Published: 2022-02-04T17:40:40 Last Updated: 2024-08-04T04:03:08.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jcv8000/Codex - https://github.com/jcv8000/Codex/issues/8 - https://github.com/jcv8000/Codex/releases/tag/v1.4.1
CVE ID: CVE-2021-43636 State: PUBLISHED Published: 2022-03-25T17:55:41 Last Updated: 2024-08-04T04:03:08.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function when processing host data in the HTTP request process. Additional Analyst Notes: - CVE Program Container: References: - https://note.youdao.com/s/918vCBNT
CVE ID: CVE-2021-43637 State: PUBLISHED Published: 2021-12-07T19:59:33 Last Updated: 2024-08-04T04:03:08.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon WorkSpaces agent is affected by Buffer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE ID: CVE-2021-43638 State: PUBLISHED Published: 2021-12-07T20:00:51 Last Updated: 2024-08-04T04:03:08.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE ID: CVE-2021-43650 State: PUBLISHED Published: 2022-03-22T15:05:34 Last Updated: 2024-08-04T04:03:08.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50542
CVE ID: CVE-2021-43657 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:52:14.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to inject arbitrary web script or HTML via the vulnerable input fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/c0n5n3d/CVE-2021-43657/blob/main/Info.txt
CVE ID: CVE-2021-43659 State: PUBLISHED Published: 2022-03-24T13:09:12 Last Updated: 2024-08-04T04:03:08.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/halo-dev/halo/issues/1522