Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-44077 State: PUBLISHED Published: 2021-11-29T03:17:45.000Z Last Updated: 2025-10-21T23:25:24.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up
n/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021 - https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above - https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529 - https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013 - http://packetstormsecurity.com/files
-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013 - http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html
CVE ID: CVE-2021-44078 State: PUBLISHED Published: 2021-12-26T04:28:31 Last Updated: 2024-08-04T04:10:17.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw exists within the virtual memory manager. The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block. An attacker can leverage this vulnerability to escape the sandbox and execute arb
o free part of a claimed memory block. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.unicorn-engine.org/changelog/ - https://gist.github.com/jwang-a/cb4b6e9551457aa299066076b836a2cd - https://github.com/unicorn-engine/unicorn/commit/c733bbada356b0373fa8aa72c044574bb855fd24 - https://github.com/jwang-a/CTF/blob/master/MyChallenges/Pwn/Unicorns_Aisle/UnicornsAisle.pdf - https://github.com/unicorn-engine/unicorn/compare/2.0.0-rc4...2.0.0-rc5
CVE ID: CVE-2021-44079 State: PUBLISHED Published: 2021-11-22T07:00:42 Last Updated: 2024-08-04T04:10:17.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wazuh/wazuh/issues/10858 - https://github.com/wazuh/wazuh/pull/10809 - https://github.com/wazuh/wazuh/issues/10858#issuecomment-991118254
CVE ID: CVE-2021-44080 State: PUBLISHED Published: 2022-06-01T00:45:48 Last Updated: 2024-08-04T04:10:17.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command Injection vulnerability in httpd web server (setup.cgi) in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators to arbitrary OS commands as root in the device via the connection_type parameter of the statussupport_diagnostic_tracing.json endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://www.sercomm.com - https://research.nccgroup.com/2022/05/24/technical-advisory-sercomm-h500s-authenticated-remote-command-execution-cve-2021-44080/
CVE ID: CVE-2021-44081 State: PUBLISHED Published: 2022-03-29T15:39:05 Last Updated: 2024-08-04T04:10:17.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4. When the length of MSIN in Supi exceeds 24 characters, it leads to AMF denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/open5gs/open5gs/issues/1206
CVE ID: CVE-2021-44082 State: PUBLISHED Published: 2022-03-29T22:50:40 Last Updated: 2024-08-04T04:10:17.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request. Additional Analyst Notes: - CVE Program Container: References: - https://www.pentest.co.uk - https://www.cornerpirate.com - https://pentest.co.uk/labs/leveraging-xss-to-get-rce-in-textpattern/
CVE ID: CVE-2021-44087 State: PUBLISHED Published: 2022-03-17T21:17:04 Last Updated: 2024-08-04T04:10:17.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows an unauthenticated remote attacker to upload a maliciously crafted PHP via photo upload. Additional Analyst Notes: - CVE Program Container: References: - http://sourcecodester.com - https://www.sourcecodester.com/sites/default/files/download/oretnom23/apsystem.zip - https://www.exploit-db.com/exploits/50801
CVE ID: CVE-2021-44088 State: PUBLISHED Published: 2022-03-17T21:07:34 Last Updated: 2024-08-04T04:10:17.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authentication via unsanitized login parameters. Additional Analyst Notes: - CVE Program Container: References: - http://sourcecodester.com - https://www.sourcecodester.com/sites/default/files/download/oretnom23/apsystem.zip - https://www.exploit-db.com/exploits/50802
CVE ID: CVE-2021-44090 State: PUBLISHED Published: 2022-01-20T18:43:17 Last Updated: 2024-08-04T04:10:17.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in Sourcecodester Online Reviewer System 1.0 via the password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Sourcecodester-Online-Reviewer-System-1.0
CVE ID: CVE-2021-44091 State: PUBLISHED Published: 2022-01-20T17:20:56 Last Updated: 2024-08-04T04:10:17.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in register.php via the (1) fullname, (2) phone, and (3) address parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Multi%20Restaurant%20Table%20Reservation%20System - https://www.nu11secur1ty.com/2021/11/multi-restaurant-table-reservation.html
CVE ID: CVE-2021-44092 State: PUBLISHED Published: 2022-01-20T18:03:20 Last Updated: 2024-08-04T04:10:17.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in code-projects Pharmacy Management 1.0 via the username parameter in the administer login form. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/code-projects/Pharmacy-Management
CVE ID: CVE-2021-44093 State: PUBLISHED Published: 2021-11-28T20:27:43 Last Updated: 2024-08-04T04:10:17.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell Additional Analyst Notes: - CVE Program Container: References: - https://github.com/94fzb/zrlog/issues/115
CVE ID: CVE-2021-44094 State: PUBLISHED Published: 2021-11-28T20:29:20 Last Updated: 2024-08-04T04:10:17.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file Additional Analyst Notes: - CVE Program Container: References: - https://github.com/94fzb/zrlog/issues/116
CVE ID: CVE-2021-44095 State: PUBLISHED Published: 2022-05-31T23:38:07 Last Updated: 2024-08-04T04:10:17.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in ProjectWorlds Hospital Management System in php 1.0 on login page that allows a remote attacker to compromise Application SQL database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/hospital-management-system-in-php - https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/1 - https://medium.com/%40shubhamvpandey/cve-2021-44095-481059d14470
CVE ID: CVE-2021-44096 State: PUBLISHED Published: 2022-05-31T23:38:00 Last Updated: 2024-08-04T04:10:17.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile_action - update_user. This allows a remote attacker to compromise Application SQL database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EGavilan-Media/User-Registration-and-Login-System-With-Admin-Panel/issues/2 - https://medium.com/%40shubhamvpandey/cve-2021-44096-c8874ee47656
CVE ID: CVE-2021-44097 State: PUBLISHED Published: 2022-05-31T23:37:54 Last Updated: 2024-08-04T04:10:17.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGavilan Media Contact-Form-With-Messages-Entry-Management 1.0 is vulnerable to SQL Injection via Addmessage.php. This allows a remote attacker to compromise Application SQL database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EGavilan-Media/Contact-Form-With-Messages-Entry-Management/issues/1 - https://medium.com/%40shubhamvpandey/cve-2021-44097-d51c11258571
CVE ID: CVE-2021-44098 State: PUBLISHED Published: 2022-05-31T23:37:50 Last Updated: 2024-08-04T04:10:17.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expense_action.php. This allows a remote attacker to compromise Application SQL database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EGavilan-Media/Expense-Management-System/issues/1 - https://medium.com/%40shubhamvpandey/cve-2021-44098-8dbaced8b854
CVE ID: CVE-2021-44103 State: REJECTED Published: 2022-03-28T13:46:25 Last Updated: 2022-06-13T16:39:39 Description: No description available.
CVE ID: CVE-2021-44108 State: PUBLISHED Published: 2022-04-05T01:22:49 Last Updated: 2024-08-04T04:10:17.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference in src/amf/namf-handler.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request to amf. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/open5gs/open5gs/issues/1247 - https://github.com/open5gs/open5gs/commit/d919b2744cd05abae043490f0a3dd1946c1ccb8c
CVE ID: CVE-2021-44109 State: PUBLISHED Published: 2022-04-05T01:22:50 Last Updated: 2024-08-04T04:10:17.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in lib/sbi/message.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/open5gs/open5gs/issues/1247 - https://github.com/open5gs/open5gs/commit/d919b2744cd05abae043490f0a3dd1946c1ccb8c
CVE ID: CVE-2021-44111 State: PUBLISHED Published: 2022-02-11T17:21:46 Last Updated: 2024-08-04T04:10:17.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/s-cart/s-cart/issues/102
CVE ID: CVE-2021-44114 State: PUBLISHED Published: 2022-01-31T17:42:26 Last Updated: 2024-08-04T04:10:17.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows remote malicious users to execute arbitrary remote code execution via create user function. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15023/stock-management-system-phpoop-source-code.html - https://medium.com/%40mayhem7999/cve-2021-44114-957145c1773
CVE ID: CVE-2021-44116 State: PUBLISHED Published: 2021-12-15T22:00:46 Last Updated: 2024-08-04T04:10:17.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnblogs.com/unrealnumb/p/15573449.html
CVE ID: CVE-2021-44117 State: PUBLISHED Published: 2022-06-10T12:35:10 Last Updated: 2024-08-04T04:10:17.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4. Additional Analyst Notes: - CVE Program Container: References: - https://www.getfuelcms.com/ - https://github.com/warmachine-57/CVE-2021-44117/blob/main/CSRF%20in%20FuelCMS
CVE ID: CVE-2021-44118 State: PUBLISHED Published: 2022-01-26T11:07:57 Last Updated: 2024-08-04T04:10:17.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users (stored XSS). Additional Analyst Notes: - CVE Program Container: References: - https://git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47a - https://git.spip.net/spip/spip/commit/4ccf90a6912d7fab97e1bd5619770c9236cc7357 - ht
ef15966406ddd0488cf9d1ecd1ae82d47a - https://git.spip.net/spip/spip/commit/4ccf90a6912d7fab97e1bd5619770c9236cc7357 - https://git.spip.net/spip/medias/commit/13c293fabd35e2c152379522c29432423936cbba
CVE ID: CVE-2021-44120 State: PUBLISHED Published: 2022-01-26T11:26:27 Last Updated: 2024-08-04T04:10:17.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you" and "Website Name" fields are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://git.spip.net/spip/
Name" fields are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://git.spip.net/spip/spip/commit/d548391d799387d1e93cf1a369d385c72f7d5c81
CVE ID: CVE-2021-44121 State: REJECTED Published: 2022-01-27T10:59:43 Last Updated: 2022-01-27T10:59:43 Description: No description available.
CVE ID: CVE-2021-44122 State: PUBLISHED Published: 2022-01-26T11:47:55 Last Updated: 2024-08-04T04:10:17.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF). Additional Analyst Notes: - CVE Program Con
cute malicious code without the knowledge of the user on the website (CSRF). Additional Analyst Notes: - CVE Program Container: References: - https://git.spip.net/spip/spip/commit/1b8e4f404c2441c15ca6540b9a6d8e50cff219db
CVE ID: CVE-2021-44123 State: PUBLISHED Published: 2022-01-26T11:57:30 Last Updated: 2024-08-04T04:17:23.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it. Additional Analyst Notes: - CVE Program Container: References: - https://git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47a
CVE ID: CVE-2021-44124 State: PUBLISHED Published: 2022-03-28T15:08:21 Last Updated: 2024-08-04T04:17:23.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal - https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626
CVE ID: CVE-2021-44127 State: PUBLISHED Published: 2022-03-27T19:39:54 Last Updated: 2024-08-04T04:17:23.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: In DLink DAP-1360 F1 firmware version <=v6.10 in the "webupg" binary, an attacker can use the "file" parameter to execute arbitrary system commands when the parameter is "name=deleteFile" after being authorized. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/tgp-top/DAP-1360/blob/main/README.md
CVE ID: CVE-2021-44132 State: PUBLISHED Published: 2022-02-25T19:38:55 Last Updated: 2024-08-04T04:17:23.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://exploitwriter.wordpress.com/2021/11/19/remote-code-execution-in-c-data-onu4ferw/
CVE ID: CVE-2021-44135 State: PUBLISHED Published: 2022-04-01T13:22:47 Last Updated: 2024-08-04T04:17:23.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/82f09b08-ceeb-4249-8855-b8bc718c4868/
CVE ID: CVE-2021-44138 State: PUBLISHED Published: 2022-04-04T12:03:05 Last Updated: 2024-08-04T04:17:23.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maybe-why-not/reponame/issues/2
CVE ID: CVE-2021-44139 State: PUBLISHED Published: 2022-03-23T16:50:05 Last Updated: 2024-08-04T04:17:23.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alibaba/Sentinel/issues/2451
CVE ID: CVE-2021-44140 State: PUBLISHED Published: 2021-11-24T11:15:14 Last Updated: 2024-08-04T04:17:24.421Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: CVE-2021-44140 Description: Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later. Additional Analyst Notes: - CVE Program Container: References: - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-44140 - https://lists.apache.org/thread/5qglpjdhvobppx7j550lf1sk28f60
s://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-44140 - https://lists.apache.org/thread/5qglpjdhvobppx7j550lf1sk28f6011t
CVE ID: CVE-2021-44141 State: PUBLISHED Published: 2022-02-21T00:00:00 Last Updated: 2024-08-04T04:17:24.346Z Vendors: n/a Products: Samba Problem Types: CWE-200 Description: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2021-44141.html - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2021-44142 State: PUBLISHED Published: 2022-02-21T14:30:12.659Z Last Updated: 2025-04-23T19:02:19.767Z Vendors: Samba Products: Samba Problem Types: CWE-125, CWE-787 Description: The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root. Additional Analyst No
o extended file attributes can execute arbitrary code with the privileges of smbd, typically root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.samba.org/samba/security/CVE-2021-44142.html - https://www.zerodayinitiative.com/blog/2022/2/1/cve-2021-44142-details-on-a-samba-code-execution-bug-demonstrated-at-pwn2own-austin - https://kb.cert.org/vuls/id/119678 - https://bugzilla.samba.org/show_bug.cgi?id=14914 - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2021-44143 State: PUBLISHED Published: 2021-11-22T19:29:29 Last Updated: 2024-08-04T04:17:23.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804 - https://sourceforge.net/p/isync/isync/ref/master/tags/ - https://sourceforge.net/p/isync/isyn