Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-33829 State: PUBLISHED Published: 2021-06-09T11:51:00 Last Updated: 2024-08-03T23:58:23.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2021-003 - https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser - https://lists.fedoraproject.org/archives/list/package-announce%40lists.
ents/#improvements-for-comments-in-html-parser - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html
CVE ID: CVE-2021-33831 State: PUBLISHED Published: 2021-09-07T05:09:31 Last Updated: 2024-08-03T23:58:23.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can interfere with tracing of infection chains by creating 500 random users within 2500 seconds. Additional Analyst Notes: - CVE Program Container: References: - https://www.th-wildau.de/studieren-weiterbilden/neuigkeiten-und-veranstaltungen/corona/ - https://github.com/lanmarc77/CVE-2021-33831
CVE ID: CVE-2021-33833 State: PUBLISHED Published: 2021-06-09T17:44:52 Last Updated: 2024-08-03T23:58:23.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: ConnMan (aka Connection Manager) 1.30 through 1.39 has a stack-based buffer overflow in uncompress in dnsproxy.c via NAME, RDATA, or RDLENGTH (for A or AAAA). Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/connman/ - http://www.openwall.com/lists/oss-security/2021/06/09/1 - https://security.gentoo.org/glsa/202107-29 - http://www.openwall.com/lists/oss-security/2022/01/25/1 - https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html
CVE ID: CVE-2021-33834 State: PUBLISHED Published: 2023-09-08T00:00:00 Last Updated: 2024-09-26T18:43:44.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2021004
CVE ID: CVE-2021-33838 State: PUBLISHED Published: 2021-06-03T23:58:25 Last Updated: 2024-08-03T23:58:23.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mame82/misc/blob/master/luca_traceIds.md - https://luca-app.de/securityoverview/properties/objectives.html - https://www.youtube.com/playlist?list=PLKuX6iczGb3kuDsm2RFgbmRkTugkR9-UE - https://www.ccc.de/de/updates/2021/luca-app-ccc-fo
://www.youtube.com/playlist?list=PLKuX6iczGb3kuDsm2RFgbmRkTugkR9-UE - https://www.ccc.de/de/updates/2021/luca-app-ccc-fordert-bundesnotbremse
CVE ID: CVE-2021-33839 State: PUBLISHED Published: 2021-06-03T23:58:01 Last Updated: 2024-08-03T23:58:23.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mame82/misc/blob/master/luca_traceIds.md - https://luca-app.de/securityoverview/properties/objectives.html - https://youtu.be/jWyDfEB0m08 - https://twitter.com/patrick_hennig/status/1387738281757061125
CVE ID: CVE-2021-33840 State: PUBLISHED Published: 2021-06-03T23:57:32 Last Updated: 2024-08-03T23:58:23.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Number data lacks a digital signature. Additional Analyst Notes: - CVE Program Container: References: - https://luca-app.de/securityoverview/processes/guest_registration.html#verifying-the-contact-data - https://gitlab.com/lucaapp/web/-/issues/1#note_560963608
CVE ID: CVE-2021-33841 State: PUBLISHED Published: 2021-06-09T11:50:24.638155Z Last Updated: 2024-09-16T17:59:08.672Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Circutor Products: SGE-PLC1000 Problem Types: CWE-78 Description: SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/circutor-sge-plc1000-os-command-injection
CVE ID: CVE-2021-33842 State: PUBLISHED Published: 2021-06-09T11:39:52.302361Z Last Updated: 2024-09-16T20:01:18.942Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Circutor Products: SGE-PLC1000 Problem Types: CWE-565 Description: Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/circutor-sge-plc1000
otes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/circutor-sge-plc1000-improper-authentication
CVE ID: CVE-2021-33843 State: PUBLISHED Published: 2022-01-21T18:17:41.000Z Last Updated: 2025-04-16T16:47:13.501Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Fresenius Kabi Products: Agilia Connect WiFi Problem Types: CWE-552 Description: Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to change the exposed configuration values such as network settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
CVE ID: CVE-2021-33844 State: PUBLISHED Published: 2022-08-25T19:34:38 Last Updated: 2024-08-03T23:58:23.170Z Vendors: n/a Products: SoX (Sound eXchange) Problem Types: CWE-369 Description: A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause an application to crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1975664 - https://access.redhat.com/security/cve/CVE-2021-33844 - https://sourceforge.net/p/sox/bugs/349/ - https://security.archlinux.org/CVE-2021-33844
CVE ID: CVE-2021-33845 State: PUBLISHED Published: 2022-05-06T16:35:58 Last Updated: 2024-08-04T00:05:51.041Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-203 Description: The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html - https://research.splunk.com/application/splunk_user_enumeration_attempt
duct-security/announcements/svd-2022-0502.html - https://research.splunk.com/application/splunk_user_enumeration_attempt/
CVE ID: CVE-2021-33846 State: PUBLISHED Published: 2022-01-21T18:17:37.000Z Last Updated: 2025-04-16T18:01:40.236Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Fresenius Kabi Products: Vigilant Software Suite (Mastermed Dashboard) Problem Types: CWE-327 Description: Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advis
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
CVE ID: CVE-2021-33847 State: PUBLISHED Published: 2022-08-18T19:43:51.000Z Last Updated: 2025-05-05T16:46:54.270Z Vendors: n/a Products: Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products Problem Types: escalation of privilege Description: Improper buffer restrictions in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00628.html
CVE ID: CVE-2021-33848 State: PUBLISHED Published: 2022-01-21T18:17:43.000Z Last Updated: 2025-04-16T16:46:52.196Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Fresenius Kabi Products: Vigilant Software Suite (Mastermed Dashboard) Problem Types: CWE-79 Description: Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject JavaScript in a GET parameter of HTTP requests and perform unauthorized actions such as stealing internal information and performing actions in context of an authenticated user. Additional Analyst Notes: - CVE Program Container: - CISA AD
and performing actions in context of an authenticated user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
CVE ID: CVE-2021-33849 State: PUBLISHED Published: 2021-10-05T21:43:47 Last Updated: 2024-08-04T00:05:51.043Z Vendors: Zoho Products: Zoho CRM Lead Magnet Problem Types: Improper Neutralization of Input During Web Page Generation Description: A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload executes whenever the user changes the form values or deletes a created form in Zoho CRM Lead Magnet Version 1.7.2.4. Additional Analyst Notes: - CVE Program
form values or deletes a created form in Zoho CRM Lead Magnet Version 1.7.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://cybersecurityworks.com/zerodays/cve-2020-29322-telnet-hardcoded-credentials.html - https://cybersecurityworks.com/zerodays/cve-2021-33849-stored-cross-site-scripting-xss-in-wordpress-plugin-zoho-crm-lead-magnet-version-1-7-2-4.html
CVE ID: CVE-2021-33850 State: PUBLISHED Published: 2021-11-19T15:52:43 Last Updated: 2024-08-04T00:05:51.078Z Vendors: n/a Products: Microsoft Clarity Problem Types: Improper Neutralization of Input During Web Page Generation Description: There is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3. The XSS payload executes whenever the user changes the clarity configuration in Microsoft Clarity version 0.3. The payload is stored on the configuring project Id page. Additional Analyst Notes: - CVE Program Container: References: - https://cybersecurityworks.com/zerodays/cve-2021-33850-stored-cross-site-scripting-xss-in-wordpress-microsoft-clarity-plugin.html
CVE ID: CVE-2021-33851 State: PUBLISHED Published: 2022-03-09T16:54:38 Last Updated: 2024-08-04T00:05:51.654Z Vendors: n/a Products: WordPress Customize Login Image Plugin Problem Types: CWE-79 Description: A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin. Additional Analyst Notes: - CVE Program Container: References: - https://cybersecurityworks.com/zerodays/cve-2021-33851-stored-cross-site-scripting-in-wordpress-customize-login-image.html
CVE ID: CVE-2021-33852 State: PUBLISHED Published: 2022-03-09T16:54:43 Last Updated: 2024-08-04T00:05:51.022Z Vendors: n/a Products: WordPress Post Duplicator Plugin Problem Types: CWE-79 Description: A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Duplicate Title" text box executes whenever the user opens the Settings Page of the Post Duplicator Plugin or the application root page after duplicating any of the existing posts. Additional Analyst Notes: - CVE Program Container: References: - https://cybersecurityworks.com/zerodays/cve-2021-33852-stored-cr
l Analyst Notes: - CVE Program Container: References: - https://cybersecurityworks.com/zerodays/cve-2021-33852-stored-cross-site-scripting-in-wordpress-post-duplicator-plugin-2-23.html
CVE ID: CVE-2021-33853 State: PUBLISHED Published: 2022-03-16T14:03:37 Last Updated: 2024-08-04T00:05:51.624Z Vendors: n/a Products: X2CRM Problem Types: CWE-79 Description: A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS payload is executed when the user attempts to access any page of the CRM. Additional Analyst Notes: - CVE Program Container: References: - https://cybersecurityworks.com/zerodays/cve-2021-33853-stored-cross-site-scripting-in-x2crm.html
CVE ID: CVE-2021-33879 State: PUBLISHED Published: 2021-06-06T19:25:23 Last Updated: 2024-08-04T00:05:51.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only integrity check would be a comparison of the downloaded file's MD5 checksum to the one contained within the XML document, the downloaded executable would then be executed on the victim's machine. Additional Analyst Notes: - CVE Progr
ocument, the downloaded executable would then be executed on the victim's machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.gameloop.com - https://github.com/mmiszczyk/cve-2021-33879
CVE ID: CVE-2021-33880 State: PUBLISHED Published: 2021-06-06T14:05:45 Last Updated: 2024-08-04T00:05:51.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0 - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2021-33881 State: PUBLISHED Published: 2021-06-06T15:33:44 Last Updated: 2024-08-04T00:05:51.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc. Additional Analyst Notes: - CVE Program Container: References: - https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.html - https://www.nxp.com/docs/en/application-note/AN13089.pdf - h
lab.com/rfid-monotonic-counter-anti-tearing-defeated.html - https://www.nxp.com/docs/en/application-note/AN13089.pdf - https://www.nxp.com/docs/en/application-note/AN11340.pdf - https://www.sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears/
CVE ID: CVE-2021-33882 State: PUBLISHED Published: 2021-08-25T11:19:46 Last Updated: 2024-08-04T00:05:51.650Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AC:H/AV:N/A:N/C:N/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.bbraunusa.com/en.htm - https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in
en.htm - https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/
CVE ID: CVE-2021-33883 State: PUBLISHED Published: 2021-08-25T11:19:53 Last Updated: 2024-08-04T00:05:51.707Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AC:H/AV:N/A:N/C:N/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.bbraunusa.com/en.htm - https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-
s: - https://www.bbraunusa.com/en.htm - https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/
CVE ID: CVE-2021-33884 State: PUBLISHED Published: 2021-08-25T11:20:00 Last Updated: 2024-08-04T00:05:51.778Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten. Additional Analyst Notes: - CVE Program Container: References: - https://www.bbraunusa.com/en.htm - https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-
www.bbraunusa.com/en.htm - https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/
CVE ID: CVE-2021-33885 State: PUBLISHED Published: 2021-08-25T11:38:20 Last Updated: 2024-08-04T00:05:52.125Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets. Additional Analyst Notes: - CVE Program Container: References: - https://www.bbraunusa.com/en.htm -
critical data sets. Additional Analyst Notes: - CVE Program Container: References: - https://www.bbraunusa.com/en.htm - https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/
CVE ID: CVE-2021-33886 State: PUBLISHED Published: 2021-08-25T11:38:25 Last Updated: 2024-08-04T00:05:51.093Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AC:L/AV:A/A:N/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.bbraunusa.com/en.htm - https://www.mcafee.com/blogs/enterprise/mcafee-enter
Program Container: References: - https://www.bbraunusa.com/en.htm - https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/
CVE ID: CVE-2021-33887 State: PUBLISHED Published: 2021-06-15T18:45:45 Last Updated: 2024-08-04T00:05:52.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient verification of data authenticity in Peloton TTR01 up to and including PTV55G allows an attacker with physical access to boot into a modified kernel/ramdisk without unlocking the bootloader. Additional Analyst Notes: - CVE Program Container: References: - https://fccid.io/2AA3N-TTR01 - https://www.mcafee.com/blogs/consumer/mobile-and-iot-security/is-your-peloton-spinning-up-malware/ - https://youtu.be/RLjXfvb0ADw
CVE ID: CVE-2021-33889 State: PUBLISHED Published: 2021-07-02T18:34:38 Last Updated: 2024-08-04T00:05:52.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data type for metric_len. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openthread/wpantund/releases - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0019/FEYE-2021-0019.md - https://github.com/openthread/wpantund/issues/502
CVE ID: CVE-2021-33894 State: PUBLISHED Published: 2021-06-09T18:30:19 Last Updated: 2024-08-04T00:05:52.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be