Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-27989 State: PUBLISHED Published: 2021-04-14T11:45:27 Last Updated: 2024-08-03T21:33:17.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/syedsohaibkarim/PoC-StoredXSS-Appspace6.2.4
CVE ID: CVE-2021-27990 State: PUBLISHED Published: 2021-04-14T13:56:38 Last Updated: 2024-08-03T21:33:17.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the framework is exposed with layouts, menus and functionalities. Additional Analyst Notes: - CVE Program Container: References: - http://appspace.com - https://github.com/syedsohaibkarim/PoC-BrokenAuth-AppSpace6.2.4
CVE ID: CVE-2021-27999 State: PUBLISHED Published: 2021-08-19T13:50:13 Last Updated: 2024-08-03T21:33:17.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System Project 1.0. This vulnerability gives admin users the ability to dump all data from the database. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850
CVE ID: CVE-2021-28000 State: PUBLISHED Published: 2021-08-19T13:50:15 Last Updated: 2024-08-03T21:33:17.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Project 1.0 which allows remote attackers to execute arbitrary code via crafted payloads entered into the Name and Address fields. Additional Analyst Notes: - CVE Program Container: References: - https://tusharvaidya16.medium.com/local-services-search-engine-management-system-project-lssmes-1-0-af2cae7cbbf
CVE ID: CVE-2021-28001 State: PUBLISHED Published: 2021-08-19T13:50:16 Last Updated: 2024-08-03T21:33:17.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting https://site.com/articles/welcome-to-your-site#comments-head. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49616
CVE ID: CVE-2021-28002 State: PUBLISHED Published: 2021-08-19T13:50:17 Last Updated: 2024-08-03T21:33:17.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49617 - https://www.linkedin.com/in/tushar-vaidya-2111s5/
CVE ID: CVE-2021-28006 State: PUBLISHED Published: 2021-03-09T13:01:38 Last Updated: 2024-08-03T21:33:17.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49605
CVE ID: CVE-2021-28007 State: PUBLISHED Published: 2021-03-10T12:27:59 Last Updated: 2024-08-03T21:33:17.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49607
CVE ID: CVE-2021-28021 State: PUBLISHED Published: 2021-10-15T00:00:00 Last Updated: 2024-08-03T21:33:17.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nothings/stb/issues/1108 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G2M5CRSGPRF7G3YB5CLU4FXW7ANNHAYT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEGXBDEMTFGINETMJENBZ6SCHVEJQJSY/ - https://lists.fedoraproject.org/archive
e-announce%40lists.fedoraproject.org/message/BEGXBDEMTFGINETMJENBZ6SCHVEJQJSY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VP2YEXEAJWI76FPM7D7VXHWD3WESQEYC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TDGZFLBOP27LZKLH45WQLSNPSPP7S7Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AF2CNP4FVC6LDKNOO4WDCGNDYIP3MPK6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXX76TJMZBPN3NU542MGN6B7C7QHRFGB/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html
CVE ID: CVE-2021-28022 State: PUBLISHED Published: 2021-11-08T14:28:50 Last Updated: 2024-08-03T21:33:17.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries. Additional Analyst Notes: - CVE Program Container: References: - https://www.servicetonic.com/ - https://www.srlabs.de/bites/chaining-three-zero-day-exploits-in-itsm-software-servicetonic-for-remote-code-execution
CVE ID: CVE-2021-28023 State: PUBLISHED Published: 2021-11-08T14:28:57 Last Updated: 2024-08-03T21:33:17.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths. Additional Analyst Notes: - CVE Program Container: References: - https://www.servicetonic.com/ - https://www.srlabs.de/bites/chaining-three-zero-day-exploits-in-itsm-software-servicetonic-for-remote-code-execution
CVE ID: CVE-2021-28024 State: PUBLISHED Published: 2021-11-08T14:29:04 Last Updated: 2024-08-03T21:33:17.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a password. Additional Analyst Notes: - CVE Program Container: References: - https://www.servicetonic.com/ - https://www.srlabs.de/bites/chaining-three-zero-day-exploits-in-itsm-software-servicetonic-for-remote-code-execution
CVE ID: CVE-2021-28025 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T17:37:40.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugreports.qt.io/browse/QTBUG-91507
CVE ID: CVE-2021-28026 State: PUBLISHED Published: 2021-03-05T13:17:38 Last Updated: 2024-08-03T21:33:17.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can trigger arbitrary code execution or a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/wg1/jpeg-xl/-/issues/163
CVE ID: CVE-2021-28027 State: PUBLISHED Published: 2021-03-05T08:40:52 Last Updated: 2024-08-03T21:33:17.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0027.html
CVE ID: CVE-2021-28028 State: PUBLISHED Published: 2021-03-05T08:40:40 Last Updated: 2024-08-03T21:33:17.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the toodee crate before 0.3.0 for Rust. Row insertion can cause a double free upon an iterator panic. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0028.html
CVE ID: CVE-2021-28029 State: PUBLISHED Published: 2021-03-05T08:38:07 Last Updated: 2024-08-03T21:33:17.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0028.html
CVE ID: CVE-2021-28030 State: PUBLISHED Published: 2021-03-05T08:40:29 Last Updated: 2024-08-03T21:33:17.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0029.html
CVE ID: CVE-2021-28031 State: PUBLISHED Published: 2021-03-05T08:40:15 Last Updated: 2024-08-03T21:33:17.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the scratchpad crate before 1.3.1 for Rust. The move_elements function can have a double-free upon a panic in a user-provided f function. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0030.html
CVE ID: CVE-2021-28032 State: PUBLISHED Published: 2021-03-05T08:40:02 Last Updated: 2024-08-03T21:33:17.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the nano_arena crate before 0.5.2 for Rust. There is an aliasing violation in split_at because two mutable references can exist for the same element, if Borrow<Idx> behaves in certain ways. This can have a resultant out-of-bounds write or use-after-free. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0031.html
CVE ID: CVE-2021-28033 State: PUBLISHED Published: 2021-03-05T08:38:21 Last Updated: 2024-08-03T21:33:17.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0032.html
CVE ID: CVE-2021-28034 State: PUBLISHED Published: 2021-03-05T08:39:46 Last Updated: 2024-08-03T21:33:17.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a double free can occur upon a val.clone() panic. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0033.html
CVE ID: CVE-2021-28035 State: PUBLISHED Published: 2021-03-05T08:39:33 Last Updated: 2024-08-03T21:33:17.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a drop of uninitialized memory can occur upon a val.clone() panic. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0033.html
CVE ID: CVE-2021-28036 State: PUBLISHED Published: 2021-03-05T08:38:51 Last Updated: 2024-08-03T21:33:17.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0035.html
CVE ID: CVE-2021-28037 State: PUBLISHED Published: 2021-03-05T08:38:34 Last Updated: 2024-08-03T21:33:17.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the internment crate before 0.4.2 for Rust. There is a data race that can cause memory corruption because of the unconditional implementation of Sync for Intern<T>. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0036.html
CVE ID: CVE-2021-28038 State: PUBLISHED Published: 2021-03-05T00:00:00 Last Updated: 2024-08-03T21:33:17.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-367.html - ht
6931. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-367.html - http://www.openwall.com/lists/oss-security/2021/03/05/1 - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html - https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html - https://security.netapp.com/advisory/ntap-20210409-0001/ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2991397d23ec597405b116d96de3813420bdcbc3
CVE ID: CVE-2021-28039 State: PUBLISHED Published: 2021-03-05T00:00:00 Last Updated: 2024-08-03T21:33:17.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-369.html - http://www.openwall.com/lists/oss-security/2021/03/0
ainer: References: - http://xenbits.xen.org/xsa/advisory-369.html - http://www.openwall.com/lists/oss-security/2021/03/05/2 - https://security.netapp.com/advisory/ntap-20210409-0001/ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=882213990d32fd224340a4533f6318dd152be4b2
CVE ID: CVE-2021-28040 State: PUBLISHED Published: 2021-03-05T17:46:34 Last Updated: 2024-08-03T21:33:17.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in os_xml.c occurs when a large number of opening and closing XML tags is used. Because recursion is used in _ReadElem without restriction, an attacker can trigger a segmentation fault once unmapped memory is reached. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ossec/ossec-hids/issues/1953
CVE ID: CVE-2021-28041 State: PUBLISHED Published: 2021-03-05T19:07:34 Last Updated: 2024-08-03T21:33:17.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssh.com/security.html - https://www.openwall.com/lists/oss-security/2021/03/03/1 - https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d9946397ff60d96568db - https://www.openssh.com/txt/release-
thub.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d9946397ff60d96568db - https://www.openssh.com/txt/release-8.5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXST2CML2MWY3PNVUXX7FFJE3ATJMNVZ/ - https://security.gentoo.org/glsa/202105-35 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQWGII3LQR4AOTPPFXGMTYE7UDEWIUKI/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210416-0002/
CVE ID: CVE-2021-28042 State: PUBLISHED Published: 2021-03-05T21:43:59 Last Updated: 2024-08-03T21:33:17.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/usd-2020-0028/ - https://www.deutschepost.de/de/m/mailoptimizer.html
CVE ID: CVE-2021-28047 State: PUBLISHED Published: 2021-04-01T20:01:35 Last Updated: 2024-08-03T21:33:17.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary web script or HTML via multiple input fields. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/devo-2021-0003
CVE ID: CVE-2021-28048 State: PUBLISHED Published: 2021-04-14T19:37:02 Last Updated: 2024-08-03T21:33:17.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin data via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2021-0004
CVE ID: CVE-2021-28052 State: PUBLISHED Published: 2022-09-26T15:10:26.000Z Last Updated: 2025-05-21T15:16:55.559Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitachi Vantara Products: Hitachi Content Platform Problem Types: CWE-264 Description: A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized access to data in the other tenant. Also, a tenant user (non-administrator) may view configuration in another tenant without authorization. This issue affects: Hitachi Vantara Hitachi Content Platform versions prior to 8.3.7; 9.0.0 versions prior to 9.2.3. Add
This issue affects: Hitachi Vantara Hitachi Content Platform versions prior to 8.3.7; 9.0.0 versions prior to 9.2.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/hirt/hitachi-sec/2021/604.html - https://knowledge.hitachivantara.com/Security/HCP_Multitenancy_Vulnerability
CVE ID: CVE-2021-28053 State: PUBLISHED Published: 2021-07-16T15:07:26 Last Updated: 2024-08-03T21:33:17.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration > Users > Contacts / Users" allows remote authenticated users to execute arbitrary SQL commands via the Additional Information parameters. Additional Analyst Notes: - CVE Program Container: References: - https://docs.centreon.com/current/en/ - https://redshell.co - https://github.com/centreon/centreon/releases/tag/20.04.13
CVE ID: CVE-2021-28054 State: PUBLISHED Published: 2021-07-16T14:57:03 Last Updated: 2024-08-03T21:33:17.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration > Hosts" allows remote authenticated users to inject arbitrary web script or HTML via the Alias parameter. Additional Analyst Notes: - CVE Program Container: References: - https://docs.centreon.com/current/en/ - https://redshell.co - https://github.com/centreon/centreon/releases/tag/20.04.13
CVE ID: CVE-2021-28055 State: PUBLISHED Published: 2021-04-15T18:29:19 Last Updated: 2024-08-03T21:33:17.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/pull/9612
CVE ID: CVE-2021-28060 State: PUBLISHED Published: 2021-04-14T16:11:18 Last Updated: 2024-08-03T21:33:17.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php. Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.blogspot.com/2020/12/group-office-crm-ssrf.html - https://fatihhcelik.github.io/posts/Group-Office-CRM-SSRF/
CVE ID: CVE-2021-28070 State: PUBLISHED Published: 2021-08-25T19:47:56 Last Updated: 2024-08-03T21:33:17.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PopojiCMS/PopojiCMS/issues/31
CVE ID: CVE-2021-28075 State: PUBLISHED Published: 2021-04-06T12:08:32 Last Updated: 2024-08-03T21:33:17.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: iKuaiOS 3.4.8 Build 202012291059 has an arbitrary file download vulnerability, which can be exploited by attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/CNVD-2021-03496
CVE ID: CVE-2021-28079 State: PUBLISHED Published: 2021-04-26T11:24:28 Last Updated: 2024-08-03T21:33:17.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered. Additional Analyst Notes: - CVE Program Container: References: - https://www.jamovi.org - https://github.com/theart42/cves/blob/master/CVE-2021-28079/CVE-2021-28079.md
CVE ID: CVE-2021-28088 State: PUBLISHED Published: 2021-03-11T16:23:22 Last Updated: 2024-08-03T21:33:17.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the "Display Name" field. Additional Analyst Notes: - CVE Program Container: References: - https://anotepad.com/note/read/s3kkk6h7 - https://hackerone.com/reports/1119296