Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
, RUGGEDCOM RS8000H, RUGGEDCOM RS8000HNC, RUGGEDCOM RS8000NC, RUGGEDCOM RS8000T, RUGGEDCOM RS8000TNC, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GNC, RUGGEDCOM RS900GNC(32M) V4.X, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPNC, RUGGEDCOM RS900L, RUGGEDCOM RS900LNC, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900MNC-GETS-C01, RUGGEDCOM RS900MNC-GETS-XX, RUGGEDCOM RS900MNC-STND-XX, RUGGEDCOM RS900MNC-STND-XX-C01, RUGGEDCOM RS900NC, RUGGEDCOM RS900NC(32M) V4.X, RUGGEDCOM RS900NC(32
M RS900MNC-STND-XX, RUGGEDCOM RS900MNC-STND-XX-C01, RUGGEDCOM RS900NC, RUGGEDCOM RS900NC(32M) V4.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910LNC, RUGGEDCOM RS910NC, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920LNC, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930LNC, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GNC, RUGGEDCOM RS969, RUGGEDCOM RS969NC, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100NC, RUGGEDCOM RSG2100NC(32M) V4.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PNC, RUGGEDCOM
V5.X, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PNC, RUGGEDCOM RSG2100PNC (32M) V4.X, RUGGEDCOM RSG2100PNC (32M) V5.X, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200NC, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2288NC V4.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300NC V4.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PNC V4.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488NC V4.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUG
SG2488NC V4.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSG920PNC V4.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910, RUGGEDCOM RSL910NC, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P Problem Types: CWE-754 Description: A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC838
GGEDCOM M2200, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V4.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RP110, RUGGEDCOM RP110NC, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600FNC, RUGGEDCOM RS1600NC, RUGGEDCOM RS1600T, RUGGEDCOM RS1600TNC, RUGGEDCOM RS400, RUGGEDCOM RS400NC, RUGGEDCOM RS401, RUGGEDCOM RS401NC, RUGGEDCOM RS416, RUGGEDCOM RS416NC, RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416P, RUGGEDCOM RS416PNC, RUGGEDCOM RS416PNCv2 V4.X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v
X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000ANC, RUGGEDCOM RS8000H, RUGGEDCOM RS8000HNC, RUGGEDCOM RS8000NC, RUGGEDCOM RS8000T, RUGGEDCOM RS8000TNC, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GNC, RUGGEDCOM RS900GNC(32M) V4.X, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPNC, RUGGEDCOM RS900L, RUGGEDCOM RS900LNC, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, R
OM RS900LNC, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900MNC-GETS-C01, RUGGEDCOM RS900MNC-GETS-XX, RUGGEDCOM RS900MNC-STND-XX, RUGGEDCOM RS900MNC-STND-XX-C01, RUGGEDCOM RS900NC, RUGGEDCOM RS900NC(32M) V4.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910LNC, RUGGEDCOM RS910NC, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920LNC, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930LNC, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GNC, RUGGEDCOM RS969, RUGGEDCOM RS969NC, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RS
OM RS969, RUGGEDCOM RS969NC, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100NC, RUGGEDCOM RSG2100NC(32M) V4.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PNC, RUGGEDCOM RSG2100PNC (32M) V4.X, RUGGEDCOM RSG2100PNC (32M) V5.X, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200NC, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2288NC V4.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300NC V4.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PNC V4.X, RUGGEDCOM RSG2300PNC V
DCOM RSG2300NC V5.X, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PNC V4.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488NC V4.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSG920PNC V4.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910, RUGGEDCOM RSL910NC, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. The third-party component, in its TFTP functionality fails to check for null terminations in file names. If an attacker were to exploit this, it could result in data corruption, and po
eck for null terminations in file names. If an attacker were to exploit this, it could result in data corruption, and possibly a hard-fault of the application. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-256353.pdf - https://cert-portal.siemens.com/productcert/html/ssa-256353.html
CVE ID: CVE-2021-42021 State: PUBLISHED Published: 2021-11-09T11:32:15 Last Updated: 2024-08-04T03:22:25.972Z Vendors: Siemens Products: Siveillance Video DLNA Server Problem Types: CWE-26 Description: A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3), Siveillance Video DLNA Server (2020 R1), Siveillance Video DLNA Server (2020 R2), Siveillance Video DLNA Server (2020 R3), Siveillance Video DLNA Server (2021 R1). The affected application contains a path traversal vulnerability that could allow to read arbitrary files on the server that are outside the application’s web document dire
ulnerability that could allow to read arbitrary files on the server that are outside the application’s web document directory. An unauthenticated remote attacker could exploit this issue to access sensitive information for subsequent attacks. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-755517.pdf
CVE ID: CVE-2021-42022 State: PUBLISHED Published: 2021-12-14T12:06:37 Last Updated: 2024-08-04T03:22:25.755Z Vendors: Siemens Products: SIMATIC eaSie PCS 7 Skill Package Problem Types: CWE-22 Description: A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package (All versions < V21.00 SP3). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files. The affected file download function is disabled by default. Additional Analyst Notes: - CVE Program Container: References: - http
ted file download function is disabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-199605.pdf
CVE ID: CVE-2021-42023 State: PUBLISHED Published: 2021-12-14T00:00:00 Last Updated: 2024-08-04T03:22:25.772Z Vendors: Siemens Products: ModelSim Simulation, Questa Simulation Problem Types: CWE-522 Description: A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions). The RSA white-box implementation in affected applications insufficiently protects the built-in private keys that are required to decrypt electronic intellectual property (IP) data in accordance with the IEEE 1735 recommended practice. This could allow a sophisticated attacker to discover the keys, bypassing the protection intended by the IEEE 1735 recommended practice. Additio
sticated attacker to discover the keys, bypassing the protection intended by the IEEE 1735 recommended practice. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-400332.pdf
CVE ID: CVE-2021-42024 State: PUBLISHED Published: 2021-12-14T12:06:38 Last Updated: 2024-08-04T03:22:25.937Z Vendors: Siemens Products: Simcenter STAR-CCM+ Viewer Problem Types: CWE-787 Description: A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < 2021.3.1). The starview+.exe application lacks proper validation of user-supplied data when parsing scene files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-161
Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-161331.pdf
CVE ID: CVE-2021-42025 State: PUBLISHED Published: 2021-11-09T11:32:16 Last Updated: 2024-08-04T03:22:25.924Z Vendors: Siemens Products: Mendix Applications using Mendix 8, Mendix Applications using Mendix 9 Problem Types: CWE-863 Description: A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control write access for certain client actions. This could allow authenticated attackers to manipulate the content of System.FileDocument objects in some cases, regardless whether they have write access to it. Addit
ipulate the content of System.FileDocument objects in some cases, regardless whether they have write access to it. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-779699.pdf
CVE ID: CVE-2021-42026 State: PUBLISHED Published: 2021-11-09T11:32:17 Last Updated: 2024-08-04T03:22:25.755Z Vendors: Siemens Products: Mendix Applications using Mendix 8, Mendix Applications using Mendix 9 Problem Types: CWE-863 Description: A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control read access for certain client actions. This could allow authenticated attackers to retrieve the changedDate attribute of arbitrary objects, even when they don't have read access to them. Additional Analyst N
ieve the changedDate attribute of arbitrary objects, even when they don't have read access to them. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-779699.pdf
CVE ID: CVE-2021-42027 State: PUBLISHED Published: 2021-12-14T12:06:39 Last Updated: 2024-08-04T03:22:25.641Z Vendors: Siemens Products: SINUMERIK Edge Problem Types: CWE-295 Description: A vulnerability has been identified in SINUMERIK Edge (All versions < V3.2). The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and the intended server. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-523250.pdf
CVE ID: CVE-2021-42028 State: PUBLISHED Published: 2024-01-04T11:20:17.462Z Last Updated: 2025-06-17T20:29:09.233Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Siemens Products: syngo fastView Problem Types: CWE-787 Description: A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14860) Additional Analyst Notes: - CVE Program Container: - CIS
ute code in the context of the current process. (ZDI-CAN-14860) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-688797
CVE ID: CVE-2021-42029 State: PUBLISHED Published: 2022-04-12T09:07:30 Last Updated: 2024-08-04T03:22:25.804Z Vendors: Siemens Products: SIMATIC STEP 7 (TIA Portal) V15, SIMATIC STEP 7 (TIA Portal) V16, SIMATIC STEP 7 (TIA Portal) V17 Problem Types: CWE-284 Description: A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC STEP 7 (TIA Portal) V17 (All versions < V17 Update 2). An attacker could achieve privilege escalation on the web server of certain devices due to improper access control vulnerability in the engineering system software. The attacker needs to have direct access to the imp
per access control vulnerability in the engineering system software. The attacker needs to have direct access to the impacted web server. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-350757.pdf
CVE ID: CVE-2021-42040 State: PUBLISHED Published: 2021-10-06T20:28:59 Last Updated: 2024-08-04T03:22:25.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki through 1.36.2. A parser function related to loop control allowed for an infinite loop (and php-fpm hang) within the Loops extension because egLoopsCountLimit is mishandled. This could lead to memory exhaustion. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T287347 - https://gerrit.wikimedia.org/r/q/I0caf6f129f94612b5bcf406a171aa5ffedea1f80
CVE ID: CVE-2021-42041 State: PUBLISHED Published: 2021-10-06T20:28:43 Last Updated: 2024-08-04T03:22:25.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CentralAuth in MediaWiki through 1.36.2. The rightsnone MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the setchange log. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T291696 - https://gerrit.wikimedia.org/r/q/I7aeaa6e4de5ccaa5eeb6bf4fb00c96b01d5fea35
CVE ID: CVE-2021-42042 State: PUBLISHED Published: 2021-10-06T20:28:33 Last Updated: 2024-08-04T03:22:25.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-invalid-title MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T290692 - https://gerrit.wikimedia.org/r/q/Ibeb13d032ca044af53f6b2334e27b6b97b6f4e9f
CVE ID: CVE-2021-42043 State: PUBLISHED Published: 2021-10-06T20:28:20 Last Updated: 2024-08-04T03:22:25.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2. The suggestion text (a parameter to mediasearch-did-you-mean) was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the intitle: search operator within the query. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T291600 - https://gerrit.wikimedia.org/r/q/If64eb5842237c92290d07ebc3fe14710d9de3fc2
CVE ID: CVE-2021-42044 State: PUBLISHED Published: 2021-10-06T20:28:07 Last Updated: 2024-08-04T03:22:25.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline, growthexperiments-mentor-dashboard-mentee-overview-info-text, growthexperiments-mentor-dashboard-mentee-overview-info-legend-headline, and growthexperiments-mentor-dashboard-mentee-overview-active-ago MediaWiki messages were not being properly sanitiz
ne, and growthexperiments-mentor-dashboard-mentee-overview-active-ago MediaWiki messages were not being properly sanitized and allowed for the injection and execution of HTML and JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T289408 - https://gerrit.wikimedia.org/r/q/I858d55fb2eca9b50ac6ef5a6f2a7b2784f0fa0d6
CVE ID: CVE-2021-42045 State: PUBLISHED Published: 2021-10-06T20:49:18 Last Updated: 2024-08-04T03:22:25.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T289385 - https://gerrit.wikimedia.org/r/q/I4f04083cd00884d3b85245460774c81c7639a578
CVE ID: CVE-2021-42046 State: PUBLISHED Published: 2021-10-06T20:48:31 Last Updated: 2024-08-04T03:22:25.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and allowed for users to inject HTML and JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T286385 - https://gerrit.wikimedia.org/r/q/Ib7f9b009730fe0df283cec1169f84c7a83a58b1d - https://gerrit.wikimedia.org/r/q/Id2204fb5afe591d63764466de35ac0aaa5999983
CVE ID: CVE-2021-42047 State: PUBLISHED Published: 2021-10-06T20:48:01 Last Updated: 2024-08-04T03:22:25.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload (such as alert) via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T289063 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/720088
CVE ID: CVE-2021-42048 State: PUBLISHED Published: 2021-10-06T20:47:15 Last Updated: 2024-08-04T03:22:25.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T289064 - https://gerrit.wikimedia.org/r/q/Iaa90a8976834d70caad592e9d1b18510318db537
CVE ID: CVE-2021-42049 State: PUBLISHED Published: 2021-10-06T20:47:00 Last Updated: 2024-08-04T03:22:25.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information (such as PII). This allows oversighters to whitewash revisions. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T286884 - https://gerrit.wikimedia.org/r/q/I4d95220ef414337147235f7ebedc9b945c3348e3
CVE ID: CVE-2021-42050 State: PUBLISHED Published: 2021-12-14T14:09:34 Last Updated: 2024-08-04T03:22:25.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/abantecart/abantecart-src/releases - https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-abantecart-e-commerce-platform/
CVE ID: CVE-2021-42051 State: PUBLISHED Published: 2021-12-14T14:15:20 Last Updated: 2024-08-04T03:22:25.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a malicious SVG document that contains an XSS payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/abantecart/abantecart-src/releases - https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-abantecart-e-commerce-platform/
CVE ID: CVE-2021-42052 State: PUBLISHED Published: 2022-08-16T21:29:22 Last Updated: 2024-08-04T03:22:25.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and the R query parameter. Additional Analyst Notes: - CVE Program Container: References: - https://nxnjz.net/2022/08/cve-2021-42052-full-disclosure/
CVE ID: CVE-2021-42053 State: PUBLISHED Published: 2021-10-07T05:21:05 Last Updated: 2024-08-04T03:22:25.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Unicorn framework through 0.35.3 for Django allows XSS via component.name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/adamghill/django-unicorn/pull/288/files - http://packetstormsecurity.com/files/164442/django-unicorn-0.35.3-Cross-Site-Scripting.html - https://github.com/adamghill/django-unicorn/compare/0.35.3...0.36.0
CVE ID: CVE-2021-42054 State: PUBLISHED Published: 2021-10-07T05:28:57 Last Updated: 2024-08-04T03:22:26.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xebd/accel-ppp/issues/156
CVE ID: CVE-2021-42055 State: PUBLISHED Published: 2021-10-18T16:21:22 Last Updated: 2024-08-04T03:22:25.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically proximate attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/