Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43158 State: PUBLISHED Published: 2021-12-22T17:27:07 Last Updated: 2024-08-04T03:47:13.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart. Additional Analyst Notes: - CVE Program Container: References: - https://projectworlds.in/free-projects/php-projects/free-download-online-shopping-system/ - https://github.com/projectworldsofficial/online-shopping-webvsite-in-php/issues/2
CVE ID: CVE-2021-43159 State: PUBLISHED Published: 2022-05-04T00:08:59 Last Updated: 2024-08-04T03:47:13.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the setSessionTime function in /cgi-bin/luci/api/common.. Additional Analyst Notes: - CVE Program Container: References: - http://ruijie.com - https://seclists.org/fulldisclosure/2022/May/0
CVE ID: CVE-2021-43160 State: PUBLISHED Published: 2022-05-04T00:08:46 Last Updated: 2024-08-04T03:47:13.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the switchFastDhcp function in /cgi-bin/luci/api/diagnose. Additional Analyst Notes: - CVE Program Container: References: - http://ruijie.com - https://seclists.org/fulldisclosure/2022/May/0
CVE ID: CVE-2021-43161 State: PUBLISHED Published: 2022-05-04T00:08:37 Last Updated: 2024-08-04T03:47:13.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi function in /cgi-bin/luci/api/switch. Additional Analyst Notes: - CVE Program Container: References: - http://ruijie.com - https://seclists.org/fulldisclosure/2022/May/0
CVE ID: CVE-2021-43162 State: PUBLISHED Published: 2022-05-04T00:08:50 Last Updated: 2024-08-04T03:47:13.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose. Additional Analyst Notes: - CVE Program Container: References: - http://ruijie.com - https://seclists.org/fulldisclosure/2022/May/0
CVE ID: CVE-2021-43163 State: PUBLISHED Published: 2022-05-04T00:08:24 Last Updated: 2024-08-04T03:47:13.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet function in /cgi-bin/luci/api/auth. Additional Analyst Notes: - CVE Program Container: References: - http://ruijie.com - https://seclists.org/fulldisclosure/2022/May/0
CVE ID: CVE-2021-43164 State: PUBLISHED Published: 2022-05-04T00:08:17 Last Updated: 2024-08-04T03:47:13.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless. Additional Analyst Notes: - CVE Program Container: References: - http://ruijie.com - https://seclists.org/fulldisclosure/2022/May/0 - http://packetstormsecurity.com/files/167099/Ruijie-Reyee-Mesh-Router-Remote-Code-Execution.html
CVE ID: CVE-2021-43171 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T17:59:12.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the application server to install malicious applications on user's systems by altering the server's API response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nervuri.net/e/apps - https://gitlab.e.foundation/e/os/releases/-/releases/v0.19-q#sparkles-we-embedded-other-improvements
CVE ID: CVE-2021-43172 State: PUBLISHED Published: 2021-11-09T16:41:39.328700Z Last Updated: 2024-09-16T17:03:32.303Z Vendors: NLnet Labs Products: Routinator Problem Types: CWE-674 Description: NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of another CA using a different RRDP repository, a malicious CA can create a chain of CAs of de-facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will
facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will therefore continue to process this chain forever. As a result, the validation run will never finish, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all. Additional Analyst Notes: - CVE Program Container: References: - https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt
CVE ID: CVE-2021-43173 State: PUBLISHED Published: 2021-11-09T16:41:40.253923Z Last Updated: 2024-09-16T18:18:51.653Z Vendors: NLnet Labs Products: Routinator Problem Types: CWE-755 Description: In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can
r than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all. Additional Analyst Notes: - CVE Program Container: References: - https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt - https://www.debian.org/security/2021/dsa-5033 - https://www.debian.org
VE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt - https://www.debian.org/security/2021/dsa-5033 - https://www.debian.org/security/2022/dsa-5041
CVE ID: CVE-2021-43174 State: PUBLISHED Published: 2021-11-09T16:41:41.211028Z Last Updated: 2024-09-16T21:08:21.566Z Vendors: NLnet Labs Products: Routinator Problem Types: CWE-1325 Description: NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough th
l, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element. Additional Analyst Notes: - CVE Program Container: References: - https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt - https://www.debian.org/security/2022/dsa-5041
CVE ID: CVE-2021-43175 State: PUBLISHED Published: 2021-12-07T17:25:11 Last Updated: 2024-08-04T03:47:13.636Z Vendors: GOautodial Products: GOautodial API Problem Types: CWE-305 Description: The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Additional Analyst Notes: - CVE Program Container: References:
SS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Additional Analyst Notes: - CVE Program Container: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities
CVE ID: CVE-2021-43176 State: PUBLISHED Published: 2021-12-07T17:26:38 Last Updated: 2024-08-04T03:47:13.542Z Vendors: GOautodial Products: GOautodial API Problem Types: CWE-23 Description: The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for
present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C Additional Analyst Notes: - CVE Program Container: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities
CVE ID: CVE-2021-43177 State: PUBLISHED Published: 2022-04-11T19:37:40 Last Updated: 2024-08-04T03:47:13.623Z Vendors: Tinfoil Products: devise-two-factor Problem Types: CWE-254 Description: As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tinfoil/devise-two-factor/security/advisories/GHSA-jm35-h8q2-73mp
CVE ID: CVE-2021-43178 State: REJECTED Published: 2022-08-03T19:41:51 Last Updated: 2022-08-03T19:41:51 Description: No description available.
CVE ID: CVE-2021-43179 State: REJECTED Published: 2022-08-03T19:42:20 Last Updated: 2022-08-03T19:42:20 Description: No description available.
CVE ID: CVE-2021-43180 State: PUBLISHED Published: 2021-11-09T15:08:09 Last Updated: 2024-08-04T03:47:13.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43181 State: PUBLISHED Published: 2021-11-09T15:06:12 Last Updated: 2024-08-04T03:47:13.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub before 2021.1.13690, stored XSS is possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43182 State: PUBLISHED Published: 2021-11-09T15:07:18 Last Updated: 2024-08-04T03:47:13.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub before 2021.1.13415, a DoS via user information is possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43183 State: PUBLISHED Published: 2021-11-09T14:53:44 Last Updated: 2024-08-04T03:47:13.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43184 State: PUBLISHED Published: 2021-11-09T14:33:39 Last Updated: 2024-08-04T03:47:13.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2021.3.21051, stored XSS is possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43185 State: PUBLISHED Published: 2021-11-09T14:32:04 Last Updated: 2024-08-04T03:47:13.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43186 State: PUBLISHED Published: 2021-11-09T14:25:45 Last Updated: 2024-08-04T03:47:13.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43187 State: PUBLISHED Published: 2021-11-09T14:40:27 Last Updated: 2024-08-04T03:47:13.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43188 State: PUBLISHED Published: 2021-11-09T14:39:26 Last Updated: 2024-08-04T03:47:13.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43189 State: PUBLISHED Published: 2021-11-09T14:38:26 Last Updated: 2024-08-04T03:47:13.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43190 State: PUBLISHED Published: 2021-11-09T14:37:35 Last Updated: 2024-08-04T03:47:13.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43191 State: PUBLISHED Published: 2021-11-09T14:35:23 Last Updated: 2024-08-04T03:47:13.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43192 State: PUBLISHED Published: 2021-11-09T14:36:35 Last Updated: 2024-08-04T03:47:13.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43193 State: PUBLISHED Published: 2021-11-09T14:49:47 Last Updated: 2024-08-04T03:47:13.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43194 State: PUBLISHED Published: 2021-11-09T14:50:27 Last Updated: 2024-08-04T03:47:13.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.2, user enumeration was possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43195 State: PUBLISHED Published: 2021-11-09T14:47:54 Last Updated: 2024-08-04T03:47:13.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43196 State: PUBLISHED Published: 2021-11-09T14:49:00 Last Updated: 2024-08-04T03:47:13.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43197 State: PUBLISHED Published: 2021-11-09T14:47:11 Last Updated: 2024-08-04T03:47:13.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43198 State: PUBLISHED Published: 2021-11-09T14:44:54 Last Updated: 2024-08-04T03:47:13.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.2, stored XSS is possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43199 State: PUBLISHED Published: 2021-11-09T14:46:19 Last Updated: 2024-08-04T03:47:13.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43200 State: PUBLISHED Published: 2021-11-09T14:43:31 Last Updated: 2024-08-04T03:47:13.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43201 State: PUBLISHED Published: 2021-11-09T14:41:19 Last Updated: 2024-08-04T03:47:13.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43202 State: PUBLISHED Published: 2021-11-30T15:21:24 Last Updated: 2024-08-04T03:47:13.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43203 State: PUBLISHED Published: 2021-11-09T14:52:23 Last Updated: 2024-08-04T03:47:13.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE ID: CVE-2021-43204 State: PUBLISHED Published: 2021-12-09T09:04:29 Last Updated: 2024-10-25T13:37:53.823Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C) Vendors: Fortinet Products: Fortinet FortiClientWindows Problem Types: Denial of service Description: A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and below allows attacker to cause a complete denial of service of its components via changes of directory access permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-167
CVE ID: CVE-2021-43205 State: PUBLISHED Published: 2022-04-06T09:15:36 Last Updated: 2024-10-22T20:58:38.466Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:W/RC:C) Vendors: Fortinet Products: Fortinet FortiClientLinux Problem Types: Improper access control Description: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-2
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-226
CVE ID: CVE-2021-43206 State: PUBLISHED Published: 2022-05-04T15:25:26 Last Updated: 2024-10-22T20:57:35.305Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiOS, FortiProxy Problem Types: Information disclosure Description: A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's client username and IP via same origin HTTP requests triggering proxy-generated HTTP status codes pages. Additional Analyst Notes: - CVE Program Container: -
HTTP requests triggering proxy-generated HTTP status codes pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-231
CVE ID: CVE-2021-43207 State: PUBLISHED Published: 2021-12-15T14:15:03 Last Updated: 2024-08-04T03:47:13.663Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack