Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
read.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rae406c1d19c0dfd3103c96923dadac2af1cd0bad6905ab1ede153865%40%3Cannounce.httpd.apache.org%3E - https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/06/10/6 - https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html - https://www.debian.org/security/2021/dsa-4937 - https://security.gentoo.org/glsa/202107-38 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210702-0001/
CVE ID: CVE-2021-26691 State: PUBLISHED Published: 2021-06-10T07:10:23 Last Updated: 2024-08-03T20:33:40.152Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-122 Description: In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow Additional Analyst Notes: - CVE Program Container: References: - http://httpd.apache.org/security/vulnerabilities_24.html - https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannou
pache.org%3E - https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E - https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/06/10/7 - https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html - https://www.debian.org/security/2021/dsa-4937 - https://security.gentoo.org/glsa/202107-38 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedo
/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210702-0001/ - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-26697 State: PUBLISHED Published: 2021-02-17T14:15:15.000Z Last Updated: 2025-02-13T16:27:54.957Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-269 Description: The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/re21
irflow 2.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/02/17/2 - https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cdev.airflow.apache.org%3E - https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E - https://lists.apache.org/thread.html/r36111262a59219a3e2704c71e97cf84937dae5ba7a1da99499e5d8f9%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-26698 State: PUBLISHED Published: 2021-07-22T16:07:36 Last Updated: 2024-08-03T20:33:40.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://seclists.org/fulldisclosure/2021/Jul/33 - http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2021/Jul/33
CVE ID: CVE-2021-26699 State: PUBLISHED Published: 2021-07-22T16:22:58 Last Updated: 2024-08-03T20:33:40.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://seclists.org/fulldisclosure/2021/Jul/33 - http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html - https://seclists.org/fulldisclosure/2021/Jul/33
CVE ID: CVE-2021-26700 State: PUBLISHED Published: 2021-02-25T23:02:00 Last Updated: 2024-08-03T20:33:40.299Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Visual Studio Code - npm-script Extension Problem Types: Remote Code Execution Description: Visual Studio Code npm-script Extension Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26700
CVE ID: CVE-2021-26701 State: PUBLISHED Published: 2021-02-25T23:02:00 Last Updated: 2024-08-03T20:33:40.798Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: .NET Core 2.1, .NET Core 3.1, .NET 5.0, Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3), Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6), Visual Studio 2019 for Mac, Microsoft Visual Studio 2019 version 16.8 (includes 16.0 - 16.7), Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8), PowerShell Core 7.1, PowerShell Core 7.0 Problem Types: Remote Code Execution
2019 version 16.9 (includes 16.0 - 16.8), PowerShell Core 7.1, PowerShell Core 7.0 Problem Types: Remote Code Execution Description: .NET Core Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPUKFHIGP5YNJRRFWKDJ2XRS4WTFJNNK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WA5WQJVHU
FZUYYU2SJZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WA5WQJVHUL5C4XMJTLY3C67R4WP35EF4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YLFATXASXW4OV2ZBSRP4G55HJH73QPBP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5/
CVE ID: CVE-2021-26702 State: PUBLISHED Published: 2021-03-01T21:01:34 Last Updated: 2024-08-03T20:33:40.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI. Additional Analyst Notes: - CVE Program Container: References: - https://files.eprints.org/2548/ - https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf
CVE ID: CVE-2021-26703 State: PUBLISHED Published: 2021-03-01T21:02:04 Last Updated: 2024-08-03T20:33:41.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase URI. Additional Analyst Notes: - CVE Program Container: References: - https://files.eprints.org/2549/ - https://files.eprints.org/2548/ - https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf
CVE ID: CVE-2021-26704 State: PUBLISHED Published: 2021-03-01T21:02:16 Last Updated: 2024-08-03T20:33:40.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI. Additional Analyst Notes: - CVE Program Container: References: - https://files.eprints.org/2549/ - https://files.eprints.org/2548/ - https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf
CVE ID: CVE-2021-26705 State: PUBLISHED Published: 2021-03-05T18:54:55 Last Updated: 2024-08-03T20:33:40.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within the application, such as disclosing password hashes. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49621
CVE ID: CVE-2021-26706 State: PUBLISHED Published: 2022-01-24T00:19:42 Last Updated: 2024-08-03T20:33:39.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes, the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker. Additiona
are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://docs.silabs.com/micrium/latest/micrium-common/ - https://micrium.atlassian.net/wiki/spaces/libdoc138/ - https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04
CVE ID: CVE-2021-26707 State: PUBLISHED Published: 2021-06-02T14:24:30 Last Updated: 2024-08-03T20:33:40.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/merge-deep - https://github.com/jonschlinkert/merge-deep/commit/11e5dd56de8a6aed0b1ed022089dbce6968d82a5 - https://securitylab.github.com/
://github.com/jonschlinkert/merge-deep/commit/11e5dd56de8a6aed0b1ed022089dbce6968d82a5 - https://securitylab.github.com/advisories/GHSL-2020-160-merge-deep/ - https://security.netapp.com/advisory/ntap-20210716-0008/
CVE ID: CVE-2021-26708 State: PUBLISHED Published: 2021-02-05T07:41:12 Last Updated: 2024-08-03T20:33:41.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c518adafa39f37858697ac9309c6cf1805581446 - https://cdn.kernel.org/pub/linux/kernel/v5.x/Cha
orvalds/linux.git/commit/?id=c518adafa39f37858697ac9309c6cf1805581446 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.13 - https://www.openwall.com/lists/oss-security/2021/02/04/5 - http://www.openwall.com/lists/oss-security/2021/02/05/6 - https://security.netapp.com/advisory/ntap-20210312-0008/ - http://www.openwall.com/lists/oss-security/2021/04/09/2 - http://www.openwall.com/lists/oss-security/2022/01/25/14
CVE ID: CVE-2021-26709 State: PUBLISHED Published: 2021-04-07T10:45:15 Last Updated: 2024-08-03T20:33:40.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device via the login.xgi user and pass parameters. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10216 - http://seclists.org/fulldisclosure/2
ps://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10216 - http://seclists.org/fulldisclosure/2021/Apr/15 - http://packetstormsecurity.com/files/162133/D-Link-DSL-320B-D1-Pre-Authentication-Buffer-Overflow.html
CVE ID: CVE-2021-26710 State: PUBLISHED Published: 2021-02-05T07:54:17 Last Updated: 2024-08-03T20:33:41.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript via the signIn.do urll parameter. Additional Analyst Notes: - CVE Program Container: References: - https://vict0ni.me/report2web-xss-frame-injection.html - https://vict0ni.me/redwood-report2web-xss-and-frame-injection/
CVE ID: CVE-2021-26711 State: PUBLISHED Published: 2021-02-05T07:53:58 Last Updated: 2024-08-03T20:33:40.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/Online_Help/NetHelp/default.htm turl parameter. Additional Analyst Notes: - CVE Program Container: References: - https://vict0ni.me/report2web-xss-frame-injection.html - https://vict0ni.me/redwood-report2web-xss-and-frame-injection/
CVE ID: CVE-2021-26712 State: PUBLISHED Published: 2021-02-18T20:10:20 Last Updated: 2024-08-03T20:33:40.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.asterisk.org/pub/security/ - http://seclists.org/fulldisclosure/2021/Feb/59 - https://downloads.asterisk.org/pub/security/AST-2021-003.html - https://issues.asterisk.org/jira/browse/ASTERISK-29260 - http://packet
ads.asterisk.org/pub/security/AST-2021-003.html - https://issues.asterisk.org/jira/browse/ASTERISK-29260 - http://packetstormsecurity.com/files/161473/Asterisk-Project-Security-Advisory-AST-2021-003.html
CVE ID: CVE-2021-26713 State: PUBLISHED Published: 2021-02-19T19:30:30 Last Updated: 2024-08-03T20:33:40.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.asterisk.org/pub/security/ - https://downloads.asterisk.org/pub/security/AST-2021-004.html - http
s: - https://downloads.asterisk.org/pub/security/ - https://downloads.asterisk.org/pub/security/AST-2021-004.html - https://issues.asterisk.org/jira/browse/ASTERISK-29205
CVE ID: CVE-2021-26714 State: PUBLISHED Published: 2021-03-29T19:08:45 Last Updated: 2024-08-03T20:33:40.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insufficient access control. A successful exploit could allow an attacker to view and modify application data via Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0003
CVE ID: CVE-2021-26715 State: PUBLISHED Published: 2021-03-25T08:07:32 Last Updated: 2024-08-03T20:33:40.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain s
example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releases - https://portswigger.net/research/hidden-oauth-attack-vectors
CVE ID: CVE-2021-26716 State: PUBLISHED Published: 2021-02-21T05:53:54 Last Updated: 2024-08-03T20:33:40.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/emoncms/emoncms/issues/1652
CVE ID: CVE-2021-26717 State: PUBLISHED Published: 2021-02-18T19:39:46 Last Updated: 2024-08-03T20:33:40.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.asterisk.org/pub/security/ - http://seclists.org/fulldisclosu
: - CVE Program Container: References: - https://downloads.asterisk.org/pub/security/ - http://seclists.org/fulldisclosure/2021/Feb/58 - https://downloads.asterisk.org/pub/security/AST-2021-002.html - https://issues.asterisk.org/jira/browse/ASTERISK-29203 - http://packetstormsecurity.com/files/161471/Asterisk-Project-Security-Advisory-AST-2021-002.html
CVE ID: CVE-2021-26718 State: PUBLISHED Published: 2021-04-01T18:00:59 Last Updated: 2024-08-03T20:33:41.245Z Vendors: n/a Products: Kaspersky Internet Security for Mac Problem Types: Bypass Description: KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310321
CVE ID: CVE-2021-26719 State: PUBLISHED Published: 2021-02-09T13:43:49 Last Updated: 2024-08-03T20:33:40.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com/advisory/CVE-2021-26719
CVE ID: CVE-2021-26720 State: PUBLISHED Published: 2021-02-17T21:19:26 Last Updated: 2024-08-03T20:33:40.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product. Additional Analyst Notes: - CVE Program Container: References: - https://packages.debian.org/buster/avahi-daemon - https://packages.debian.org
es: - CVE Program Container: References: - https://packages.debian.org/buster/avahi-daemon - https://packages.debian.org/sid/avahi-daemon - https://packages.debian.org/bullseye/avahi-daemon - https://security-tracker.debian.org/tracker/CVE-2021-26720 - https://bugs.launchpad.net/ubuntu/+source/avahi/+bug/1870824 - https://metadata.ftp-master.debian.org/changelogs/main/a/avahi/avahi_0.8-4_changelog - https://www.openwall.com/lists/oss-security/2021/02/15/2 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982796 - https://bugzilla.suse.com/show_bug.cgi?id=1180827 - https://lists.debian.org/debian-lts-announce/2022/06/msg00009.html
CVE ID: CVE-2021-26722 State: PUBLISHED Published: 2021-02-05T17:12:17 Last Updated: 2024-08-03T20:33:40.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/linkedin/oncall/issues/341
CVE ID: CVE-2021-26723 State: PUBLISHED Published: 2021-02-06T05:35:44 Last Updated: 2024-08-03T20:33:40.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS. Additional Analyst Notes: - CVE Program Container: References: - https://jenzabar.com/blog - https://y0ungdst.medium.com/xss-in-jenzabar-cve-2021-26723-a0749231328 - http://packetstormsecurity.com/files/161303/Jenzabar-9.2.2-Cross-Site-Scripting.html - https://gist.github.com/Y0ung-DST/d1b6b65be6248b0ffc2b2f2120deb205
CVE ID: CVE-2021-26724 State: PUBLISHED Published: 2021-02-22T20:31:10.169422Z Last Updated: 2024-09-17T04:05:00.334Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-78 Description: OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://se
0.0.7.3 version 20.0.7.3 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.nozominetworks.com/NN-2021:1-01