Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm
CVE ID: CVE-2021-35248 State: PUBLISHED Published: 2021-12-20T20:08:24.068411Z Last Updated: 2024-09-16T20:07:13.877Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SolarWinds Products: Orion Problem Types: CWE-732 Description: It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35248 - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3 - https://documentation.solarwinds.com/en/Success_Center/or
com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3 - https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm
CVE ID: CVE-2021-35249 State: PUBLISHED Published: 2022-05-17T19:44:55.183082Z Last Updated: 2024-09-16T16:28:36.293Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-284 Description: This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the
omain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35249 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-1_release_notes.htm
CVE ID: CVE-2021-35250 State: PUBLISHED Published: 2022-04-25T19:47:54.688735Z Last Updated: 2024-09-16T23:31:12.506Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-22 Description: A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-3-HotFix-1?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/cve-20
enter/s/article/Serv-U-15-3-HotFix-1?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35250
CVE ID: CVE-2021-35251 State: PUBLISHED Published: 2022-03-09T15:38:01.677926Z Last Updated: 2024-09-16T22:44:56.753Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: Web Help Desk Problem Types: CWE-209 Description: Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web Help Desk installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35251 - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-7-8_release_not
CVE-2021-35251 - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-7-8_release_notes.htm
CVE ID: CVE-2021-35252 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-17T20:18:01.478Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Serv-U FTP Server Problem Types: CWE-798 Description: Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htm - https://cve.mitre.org/cgi-b
olarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htm - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35252 - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35252
CVE ID: CVE-2021-35254 State: PUBLISHED Published: 2022-03-25T18:02:27 Last Updated: 2024-08-04T00:33:51.251Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: SolarWinds Products: WebHelpDesk Problem Types: CWE-20 Description: SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-8-Hotfix-1-Release-Notes?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/CVE
Help-Desk-12-7-8-Hotfix-1-Release-Notes?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35254
CVE ID: CVE-2021-35261 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T16:24:15.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary remote code via the Upfile function of the extend/tools/Ueditor endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yupoxiong/BearAdmin/issues/16
CVE ID: CVE-2021-35265 State: PUBLISHED Published: 2021-08-03T11:55:07 Last Updated: 2024-08-04T00:33:51.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maxsite/cms/issues/414#issue-726249183 - https://github.com/maxsite/cms/commit/6b0ab1de9f3d471485d1347e800a9ce43fedbf1a
CVE ID: CVE-2021-35266 State: PUBLISHED Published: 2021-09-07T00:00:00 Last Updated: 2024-08-04T00:33:51.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution. Additional Analyst Notes: - CVE Program Container: References: - http://ntfs-3g.com - http://www.openwall.com/lists/oss-security/2021/08/30/1 - https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp - https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/pa
s/GHSA-q759-8j5v-q5jp - https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html - https://security.gentoo.org/glsa/202301-01
CVE ID: CVE-2021-35267 State: PUBLISHED Published: 2021-09-07T00:00:00 Last Updated: 2024-08-04T00:33:51.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation of privileges when setuid-root. Additional Analyst Notes: - CVE Program Container: References: - http://ntfs-3g.com - http://www.openwall.com/lists/oss-security/2021/08/30/1 - https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp - https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.f
https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html - https://security.gentoo.org/glsa/202301-01
CVE ID: CVE-2021-35268 State: PUBLISHED Published: 2021-09-07T00:00:00 Last Updated: 2024-08-04T00:33:51.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - http://ntfs-3g.com - http://www.openwall.com/lists/oss-security/2021/08/30/1 - https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp - https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-a
q759-8j5v-q5jp - https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html - https://security.gentoo.org/glsa/202301-01
CVE ID: CVE-2021-35269 State: PUBLISHED Published: 2021-09-07T00:00:00 Last Updated: 2024-08-04T00:33:51.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - http://ntfs-3g.com - http://www.openwall.com/lists/oss-security/2021/08/30/1 - https://www.debian.org/security/2021/dsa-4971 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html - https://security.gentoo.org/glsa/202301-01
CVE ID: CVE-2021-35283 State: PUBLISHED Published: 2022-07-07T19:07:36 Last Updated: 2024-08-04T00:33:51.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in product_admin.php in atoms183 CMS 1.0, allows attackers to execute arbitrary commands via the Name, Fname, and ID parameters to search.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atoms183/CMS/issues/1
CVE ID: CVE-2021-35284 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-28T20:22:42.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in function get_user in login_manager.php in rizalafani cms-php v1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rizalafani/cms-php/issues/1
CVE ID: CVE-2021-35290 State: PUBLISHED Published: 2023-02-24T00:00:00.000Z Last Updated: 2025-03-12T13:54:28.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anibalgomezprojects/balerocms-src/issues/2
CVE ID: CVE-2021-35296 State: PUBLISHED Published: 2021-10-04T16:39:47 Last Updated: 2024-08-04T00:33:51.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the cookie value and Response Path. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/afaq1337/CVE-2021-35296
CVE ID: CVE-2021-35297 State: PUBLISHED Published: 2021-10-01T12:54:26 Last Updated: 2024-08-04T00:33:51.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow. An attacker can use the Structured Exception Handler (SEH) records and redirect execution to attacker-controlled code. Additional Analyst Notes: - CVE Program Container: References: - https://govtech-csg.github.io/security-advisories/2021/09/18/CVE-2021-35297.html
CVE ID: CVE-2021-35298 State: PUBLISHED Published: 2021-06-28T19:07:00 Last Updated: 2024-08-04T00:33:51.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-03
CVE ID: CVE-2021-35299 State: PUBLISHED Published: 2021-06-28T19:06:53 Last Updated: 2024-08-04T00:33:51.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-02
CVE ID: CVE-2021-35300 State: PUBLISHED Published: 2021-06-28T19:06:44 Last Updated: 2024-08-04T00:33:51.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-07
CVE ID: CVE-2021-35301 State: PUBLISHED Published: 2021-06-28T19:06:34 Last Updated: 2024-08-04T00:33:51.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-05
CVE ID: CVE-2021-35302 State: PUBLISHED Published: 2021-06-28T19:06:26 Last Updated: 2024-08-04T00:33:51.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-04
CVE ID: CVE-2021-35303 State: PUBLISHED Published: 2021-06-28T19:06:17 Last Updated: 2024-08-04T00:33:51.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/en/advisories/zaa-2021-06
CVE ID: CVE-2021-35306 State: PUBLISHED Published: 2021-08-05T19:08:28 Last Updated: 2024-08-04T00:33:51.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::WriteFields located in Ap4StszAtom.cpp. It allows an attacker to cause a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/615
CVE ID: CVE-2021-35307 State: PUBLISHED Published: 2021-08-05T19:08:31 Last Updated: 2024-08-04T00:33:51.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Test component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/616
CVE ID: CVE-2021-35309 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T18:17:56.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb - https://github.com/mustafa-turgut/cve-subscriptions/tree/main/samsung-stws
CVE ID: CVE-2021-35312 State: PUBLISHED Published: 2021-08-06T18:53:21 Last Updated: 2024-08-04T00:33:51.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Service.exe" has incorrect permissions, allowing a local unprivileged user to replace it with a malicious file that will be executed with "LocalSystem" privileges. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/163744/Amica-Prodigy-1.7-Privilege-Escalation.html - http://packetstormsecurity.com/files/163744/Amica-Prodigy-1.7-Privilege-Escalation.html
CVE ID: CVE-2021-35313 State: REJECTED Published: 2021-09-24T17:21:20 Last Updated: 2021-09-24T17:21:20 Description: No description available.
CVE ID: CVE-2021-35323 State: PUBLISHED Published: 2021-10-19T17:21:56 Last Updated: 2024-08-04T00:33:51.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/issues/1327 - http://packetstormsecurity.com/files/164990/Bludit-3.13.1-Cross-Site-Scripting.html
CVE ID: CVE-2021-35324 State: PUBLISHED Published: 2021-08-05T20:39:11 Last Updated: 2024-08-04T00:33:51.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_login_bypass.md
CVE ID: CVE-2021-35325 State: PUBLISHED Published: 2021-08-05T20:39:19 Last Updated: 2024-08-04T00:33:51.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_cookie_overflow.md
CVE ID: CVE-2021-35326 State: PUBLISHED Published: 2021-08-05T20:39:16 Last Updated: 2024-08-04T00:33:51.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sending a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_leak_config_file.md
CVE ID: CVE-2021-35327 State: PUBLISHED Published: 2021-08-05T20:39:17 Last Updated: 2024-08-04T00:33:51.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_default_telnet_info.md
CVE ID: CVE-2021-35331 State: PUBLISHED Published: 2021-07-05T14:59:29 Last Updated: 2024-08-04T00:33:51.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding Additional Analyst Notes: - CVE Program Container: References: - https://core.tcl-lang.org/tcl/info/bad6cc213dfe8280 - https://core.tcl-lang.org/tcl/info/28ef6c0c741408a2 - https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222 - https://sqlite.org/forum/info/7dcd751996c93ec9
CVE ID: CVE-2021-35336 State: PUBLISHED Published: 2021-07-01T12:33:42 Last Updated: 2024-08-04T00:33:51.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an unauthenticated user to access a sensitive part of the system with a high privileged account. Additional Analyst Notes: - CVE Program Container: References: - https://pratikkhalane91.medium.com/use-of-default-credentials-to-unauthorised-remote-access-of-internal-panel-of-tieline-c1ffe3b3757c
CVE ID: CVE-2021-35337 State: PUBLISHED Published: 2021-07-01T13:15:26 Last Updated: 2024-08-04T00:33:51.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50050
CVE ID: CVE-2021-35342 State: PUBLISHED Published: 2021-08-27T09:52:16 Last Updated: 2024-08-04T00:33:51.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled). Additional Analyst Notes: - CVE Program Container: References: - https://northern.tech/our-products - https://mender.io/blog/cve-2021-35342-useradm-logout-vulnerabililty
CVE ID: CVE-2021-35343 State: PUBLISHED Published: 2021-08-03T18:07:58 Last Updated: 2024-08-04T00:33:51.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40cyberdivision/cve-2021-35343-c5c298cbb2d4