Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-20129 State: PUBLISHED Published: 2021-10-13T15:49:35 Last Updated: 2024-08-03T17:30:07.422Z Vendors: n/a Products: Draytek VigorConnect Problem Types: Exposure of Sensitive Information to an Unauthorized Actor Description: An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-42
CVE ID: CVE-2021-20130 State: PUBLISHED Published: 2021-10-13T17:30:14 Last Updated: 2024-08-03T17:30:07.568Z Vendors: n/a Products: ManageEngine ADManager Plus Build 7111 Problem Types: Arbitrary Code Execution Description: ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PasswordExpiry interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-43
CVE ID: CVE-2021-20131 State: PUBLISHED Published: 2021-10-13T17:30:20 Last Updated: 2024-08-03T17:30:07.616Z Vendors: n/a Products: ManageEngine ADManager Plus Build 7111 Problem Types: Arbitrary Code Execution Description: ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Personalization interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-43
CVE ID: CVE-2021-20132 State: PUBLISHED Published: 2021-12-30T21:30:59 Last Updated: 2024-08-03T17:30:07.307Z Vendors: n/a Products: Quagga Services on D-Link DIR-2640 Routers Problem Types: Use of Hard-coded Credentials Description: Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router (i.e., as the "admin" user, UID 0). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-44
CVE ID: CVE-2021-20133 State: PUBLISHED Published: 2021-12-30T21:30:59 Last Updated: 2024-08-03T17:30:07.386Z Vendors: n/a Products: Quagga Services on D-Link DIR-2640 Routers Problem Types: Absolute Path Traversal with Read Access Description: Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set the "message of the day" banner to any file on the system, allowing them to read all or some of the contents of those files. Such sensitive information as hashed credentials, hardcoded plaintext passwords for other services, configuration files, and private keys can be dis
s hashed credentials, hardcoded plaintext passwords for other services, configuration files, and private keys can be disclosed in this fashion. Improper handling of filenames that identify virtual resources, such as "/dev/urandom" allows an attacker to effect a denial of service attack against the command line interfaces of the Quagga services (zebra and ripd). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-44
CVE ID: CVE-2021-20134 State: PUBLISHED Published: 2021-12-30T21:31:00 Last Updated: 2024-08-03T17:30:07.497Z Vendors: n/a Products: Quagga Services on D-Link DIR-2640 Routers Problem Types: Absolute Path Traversal with Write Access Description: Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service (zebra or ripd). Subsequent log messages will be appended to the file, prefixed by a timestamp and some logging metadata. Remote code execution can be achieved by using this vulnera
the file, prefixed by a timestamp and some logging metadata. Remote code execution can be achieved by using this vulnerability to append to a shell script on the router's filesystem, and then awaiting or triggering the execution of that script. A remote, unauthenticated root shell can easily be obtained on the device in this fashion. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-44
CVE ID: CVE-2021-20135 State: PUBLISHED Published: 2021-11-02T23:24:28 Last Updated: 2024-08-03T17:30:07.575Z Vendors: n/a Products: Nessus Problem Types: local privilege escalation Description: Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. Tenable has included a fix for this issue in Nessus 10.0.0. The installation files can be obtained from the Tenable Downloads Portal (https://www.tenable.com/downloads/nessus). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2021-18
CVE ID: CVE-2021-20136 State: PUBLISHED Published: 2021-11-01T20:55:59 Last Updated: 2024-08-03T17:30:07.391Z Vendors: n/a Products: ManageEngine Log360 Problem Types: Improper Access Control Description: ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup. Additional Analyst Notes: - CVE Program Container: Ref
code execution by replacing files executed by Log360 on startup. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-48
CVE ID: CVE-2021-20137 State: PUBLISHED Published: 2021-12-09T15:24:32 Last Updated: 2024-08-03T17:30:07.440Z Vendors: n/a Products: Gryphon Tower router Problem Types: Reflected Cross Site Scripting Description: A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution in the context of the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20138 State: PUBLISHED Published: 2021-12-09T15:24:37 Last Updated: 2024-08-03T17:30:07.492Z Vendors: n/a Products: Gryphon Tower router Problem Types: Command Injection Description: An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luci/rc. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the web interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20139 State: PUBLISHED Published: 2021-12-09T15:24:42 Last Updated: 2024-08-03T17:30:07.526Z Vendors: n/a Products: Gryphon Tower router Problem Types: Command Injection Description: An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20140 State: PUBLISHED Published: 2021-12-09T15:22:59 Last Updated: 2024-08-03T17:30:07.419Z Vendors: n/a Products: Gryphon Tower router Problem Types: Command Injection Description: An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20141 State: PUBLISHED Published: 2021-12-09T15:23:04 Last Updated: 2024-08-03T17:30:07.538Z Vendors: n/a Products: Gryphon Tower router Problem Types: Command Injection Description: An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20142 State: PUBLISHED Published: 2021-12-09T15:23:09 Last Updated: 2024-08-03T17:30:07.477Z Vendors: n/a Products: Gryphon Tower router Problem Types: Command Injection Description: An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20143 State: PUBLISHED Published: 2021-12-09T15:19:13 Last Updated: 2024-08-03T17:30:07.493Z Vendors: n/a Products: Gryphon Tower router Problem Types: Command Injection Description: An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20144 State: PUBLISHED Published: 2021-12-09T15:19:18 Last Updated: 2024-08-03T17:30:07.446Z Vendors: n/a Products: Gryphon Tower router Problem Types: Command Injection Description: An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20145 State: PUBLISHED Published: 2021-12-09T15:19:24 Last Updated: 2024-08-03T17:30:07.596Z Vendors: n/a Products: Gryphon Tower router Problem Types: Improper Access Control Description: Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the LAN interfaces of other users' devices connected to the same service. An attacker could leverage this to make configuration changes to, or otherwise attack victims' devices as though they were on an adjacent network. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-5
k. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20146 State: PUBLISHED Published: 2021-12-09T15:21:34 Last Updated: 2024-08-03T17:30:07.621Z Vendors: n/a Products: Gryphon Tower router Problem Types: Storage of Sensitive Data in a Mechanism without Access Control Description: An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon's development and infrastructure. At the time of discovery, the ssh key could be used to login to the development server hosted in Amazon Web Services. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-51
CVE ID: CVE-2021-20147 State: PUBLISHED Published: 2022-01-03T21:07:10 Last Updated: 2024-08-03T17:30:07.495Z Vendors: n/a Products: ManageEngine ADSelfService Plus Problem Types: Observable Response Discrepancy Description: ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-52
CVE ID: CVE-2021-20148 State: PUBLISHED Published: 2022-01-03T21:07:11 Last Updated: 2024-08-03T17:30:07.423Z Vendors: n/a Products: ManageEngine ADSelfService Plus Problem Types: Storage of File with Sensitive Data Under Web Root Description: ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain. Additional Analyst Notes: - CVE Pr
e and then sending a request specifying the password policy file of the other domain. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-52
CVE ID: CVE-2021-20149 State: PUBLISHED Published: 2021-12-30T21:31:11 Last Updated: 2024-08-03T17:30:07.478Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Improper Access Control Description: Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the device only apply to IPv4. All services running on the devices are accessible via the WAN interface via IPv6 by default. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20150 State: PUBLISHED Published: 2021-12-30T21:31:12 Last Updated: 2024-08-03T17:30:07.420Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Information disclosure Description: Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20151 State: PUBLISHED Published: 2021-12-30T21:31:12 Last Updated: 2024-08-03T17:30:07.607Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Authentication bypass Description: Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This allows an attacker (whether from a different computer, different web browser on the same machine, etc.) to take over an existing session. This does require the attacker to be able to spoof or take over original IP address of the original user's session.
ion. This does require the attacker to be able to spoof or take over original IP address of the original user's session. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20152 State: PUBLISHED Published: 2021-12-30T21:31:05 Last Updated: 2024-08-03T17:30:07.569Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Improper Access Control Description: Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, anyone is able to visit and modify settings and files via the Bittorent web client by visiting: http://192.168.10.1:9091/transmission/web/ Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20153 State: PUBLISHED Published: 2021-12-30T21:31:06 Last Updated: 2024-08-03T17:30:07.638Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: UNIX Symbolic Link Following Description: Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulnerable to a symlink attack that could lead to remote code execution on the device. If an end user inserts a flash drive with a malicious symlink on it that the bittorrent client can write downloads to, then a user is able to download arbitrary files to any desired location on the devices filesystem, which could lead to remot
a user is able to download arbitrary files to any desired location on the devices filesystem, which could lead to remote code execution. Example directories vulnerable to this include "config", "downloads", and "torrents", though it should be noted that "downloads" is the only vector that allows for arbitrary files to be downloaded to arbitrary locations. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20154 State: PUBLISHED Published: 2021-12-30T21:31:06 Last Updated: 2024-08-03T17:30:07.616Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Improper Access Control Description: Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in cleartext transmission of sensitive information such as passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20155 State: PUBLISHED Published: 2021-12-30T21:31:07 Last Updated: 2024-08-03T17:30:07.570Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Hardcoded Credentials Description: Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. It is possible to backup and restore device configurations via the management web interface. These devices are encrypted using a hardcoded password of "12345678". Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20156 State: PUBLISHED Published: 2021-12-30T21:31:02 Last Updated: 2024-08-03T17:30:07.486Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Improper Access Control Description: Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install firmware that may be malicious in nature as there does not appear to be any signature validation done to determine if it is from a known and trusted source. This includes firmware updates that are done via the automated "check for updates" in the admin interface. If an attacker is able to masquerade as the up
at are done via the automated "check for updates" in the admin interface. If an attacker is able to masquerade as the update server, the device will not verify that the firmware updates downloaded are legitimate. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20157 State: PUBLISHED Published: 2021-12-30T21:31:03 Last Updated: 2024-08-03T17:30:07.471Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Denial of Service Description: It is possible for an unauthenticated, malicious user to force the device to reboot due to a hidden administrative command. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20158 State: PUBLISHED Published: 2021-12-30T21:31:03 Last Updated: 2024-08-03T17:30:07.626Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Authentication Bypass Description: Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the change of the admin password due to a hidden administrative command. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20159 State: PUBLISHED Published: 2021-12-30T21:31:04 Last Updated: 2024-08-03T17:30:07.576Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Command Injection Description: Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as root by supplying a malformed parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20160 State: PUBLISHED Published: 2021-12-30T21:31:08 Last Updated: 2024-08-03T17:30:07.599Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Command Injection Description: Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. The username parameter used when configuring smb functionality for the device is vulnerable to command injection as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20161 State: PUBLISHED Published: 2021-12-30T21:31:09 Last Updated: 2024-08-03T17:30:07.472Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Improper Access Control Description: Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection. No username or password is required and the user is given a root shell with full control of the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20162 State: PUBLISHED Published: 2021-12-30T21:31:09 Last Updated: 2024-08-03T17:30:07.494Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Improper Credential Storage Description: Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plaintext in the config files on the device. For example, /etc/config/cameo contains the admin password in plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20163 State: PUBLISHED Published: 2021-12-30T21:31:10 Last Updated: 2024-08-03T17:30:07.436Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Information Disclosure Description: Trendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page. Usernames and passwords for all ftp users are revealed in plaintext on the ftpserver.asp page. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54