Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-46350 State: PUBLISHED Published: 2022-01-20T21:14:41 Last Updated: 2024-08-04T05:02:11.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'ecma_is_value_object (value)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c in JerryScript 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4936
CVE ID: CVE-2021-46351 State: PUBLISHED Published: 2022-01-20T21:14:42 Last Updated: 2024-08-04T05:02:11.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in JerryScript 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4940
CVE ID: CVE-2021-46353 State: PUBLISHED Published: 2022-03-04T21:13:56 Last Updated: 2024-08-04T05:02:11.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP request and gain knowledge of different absolute paths that are being used by the web application. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10283
CVE ID: CVE-2021-46354 State: PUBLISHED Published: 2022-02-09T13:10:00 Last Updated: 2024-08-04T05:02:11.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface. Additional Analyst Notes: - CVE Program Container: References: - http://thinfinity.com - https://github.com/cybelesoft/virtualui/issues/3 - http://packetstormsecurity.com/files/166069/Thinfinity-VirtualUI-2.5.26.
ps://github.com/cybelesoft/virtualui/issues/3 - http://packetstormsecurity.com/files/166069/Thinfinity-VirtualUI-2.5.26.2-Information-Disclosure.html
CVE ID: CVE-2021-46355 State: PUBLISHED Published: 2022-02-11T12:39:57 Last Updated: 2024-08-04T05:02:11.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS). To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - http://ocs.com - https://medium.com/%40windsormoreira/ocs-inventory-2-9-1-cross-site-scripting-xss-cve-2021-46355-a88d72606b7e
CVE ID: CVE-2021-46359 State: PUBLISHED Published: 2022-02-07T12:47:10 Last Updated: 2024-08-04T05:02:11.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability. Some transactions may not be committed successfully, and malicious users may use this to achieve double-spending attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FISCO-BCOS/FISCO-BCOS/issues/2124
CVE ID: CVE-2021-46360 State: PUBLISHED Published: 2022-02-09T00:00:00 Last Updated: 2024-08-04T05:02:11.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sartlabs/0days/blob/main/Composr-CMS/Exploit.py - http://packetstormsecurity.com/files/171489/Composr-CMS-10.0.39-Remote-Code-Execution.html
CVE ID: CVE-2021-46361 State: PUBLISHED Published: 2022-02-11T20:08:41 Last Updated: 2024-08-04T05:02:11.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload. Additional Analyst Notes: - CVE Program Container: References: - https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.12.html#_security_advisory - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46361-FreeMarker%20Bypass-Magnolia%20CMS
CVE ID: CVE-2021-46362 State: PUBLISHED Published: 2022-02-11T20:08:42 Last Updated: 2024-08-04T05:02:11.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46362-Unauthenticated%20SSTI-Magnolia%20CMS
CVE ID: CVE-2021-46363 State: PUBLISHED Published: 2022-02-11T20:08:42 Last Updated: 2024-08-04T05:02:11.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Microsoft Excel. Additional Analyst Notes: - CVE Program Container: References: - https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46363-Fo
-Magnolia-CMS-6.2.4.html#_security_advisory - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46363-Formula%20Injection-Magnolia%20CMS
CVE ID: CVE-2021-46364 State: PUBLISHED Published: 2022-02-11T20:08:44 Last Updated: 2024-08-04T05:02:11.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file. Additional Analyst Notes: - CVE Program Container: References: - https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46364-YAML%20Deserialization-Magnolia%20CMS
CVE ID: CVE-2021-46365 State: PUBLISHED Published: 2022-02-11T20:08:45 Last Updated: 2024-08-04T05:02:11.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. Additional Analyst Notes: - CVE Program Container: References: - https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46365-Unsafe%20XML%20Parsing-Magnolia%20CMS
CVE ID: CVE-2021-46366 State: PUBLISHED Published: 2022-02-11T20:08:50 Last Updated: 2024-08-04T05:02:11.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials. Additional Analyst Notes: - CVE Program Container: References: - https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46366-CSRF%2BOpen%20Redirect-Magnolia%20CMS
CVE ID: CVE-2021-46367 State: PUBLISHED Published: 2022-04-08T12:00:39 Last Updated: 2024-08-04T05:02:11.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/faisalfs10x/bd12e9abefb0d44f020bf297a14a4597 - https://ritecms.com/ - https://www.exploit-db.com/exploits/50616 - https://packetstormsecurity.com/files/165430/RiteCMS-3.1.0-Shell-U
ms.com/ - https://www.exploit-db.com/exploits/50616 - https://packetstormsecurity.com/files/165430/RiteCMS-3.1.0-Shell-Upload-Remote-Code-Execution.html
CVE ID: CVE-2021-46368 State: PUBLISHED Published: 2022-02-17T11:23:47 Last Updated: 2024-08-04T05:02:11.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRIGONE Remote System Monitor 3.61 is vulnerable to an unquoted path service allowing local users to launch processes with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50633 - https://packetstormsecurity.com/files/165404/TRIGONE-Remote-System-Monitor-3.61-Unquoted-Service-Path.html
CVE ID: CVE-2021-46371 State: PUBLISHED Published: 2022-02-14T15:22:00 Last Updated: 2024-08-04T05:02:11.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the foreground leads to leakage of sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zuiidea/antd-admin/issues/1127
CVE ID: CVE-2021-46372 State: PUBLISHED Published: 2022-02-18T12:40:26 Last Updated: 2024-08-04T05:02:11.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters. Additional Analyst Notes: - CVE Program Container: References: - https://www.huntr.dev/bounties/eb681144-04f2-4eaa-98b6-c8cffbcb1601/
CVE ID: CVE-2021-46377 State: PUBLISHED Published: 2022-01-27T17:36:06 Last Updated: 2024-08-04T05:02:11.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUser Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cskaza/cszcms/issues/33
CVE ID: CVE-2021-46378 State: PUBLISHED Published: 2022-03-04T14:33:52 Last Updated: 2024-08-04T05:02:11.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://drive.google.com/file/d/1S69wOovVa8NRVUXcB0PkVvZHFxREcD4Y/view?usp=sharing - http://packetstormsecurity.com/files/167042/DLINK-DIR850-Insecure-Direct-Object-Reference.html
CVE ID: CVE-2021-46379 State: PUBLISHED Published: 2022-03-04T15:02:26 Last Updated: 2024-08-04T05:02:11.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://drive.google.com/file/d/1rrlwnIxSHEoO4SMAHRPKZSRzK5MwZQRf/view?usp=sharing - http://packetstormsecurity.com/files/167041/DLINK-DIR850-Open-Redirection.html
CVE ID: CVE-2021-46380 State: REJECTED Published: 2022-03-04T15:15:12 Last Updated: 2022-05-06T17:30:13 Description: No description available.
CVE ID: CVE-2021-46381 State: PUBLISHED Published: 2022-03-04T15:24:50 Last Updated: 2024-08-04T05:02:11.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow]. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://drive.google.com/drive/folders/19OP09msw8l7CJ622nkvnvnt7EKun1eCG?usp=sharing - http://packetstormsecurity.com/files/167070/DLINK-DAP-1620-A1-1.01-Directory-Traversal.html
CVE ID: CVE-2021-46382 State: PUBLISHED Published: 2022-03-04T15:32:15 Last Updated: 2024-08-04T05:02:11.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipboard hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://www.netgear.com/about/security/ - https://drive.google.com/drive/folders/1NOIoT8yE_HDoLVYhchml5E2Za3Oo6V9Y?usp=sharing
CVE ID: CVE-2021-46383 State: PUBLISHED Published: 2022-01-26T16:14:56 Last Updated: 2024-08-04T05:02:11.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4QZ1I
CVE ID: CVE-2021-46384 State: PUBLISHED Published: 2022-03-04T21:42:13 Last Updated: 2024-08-04T05:02:11.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4QZ1O
CVE ID: CVE-2021-46385 State: PUBLISHED Published: 2022-01-26T18:35:37 Last Updated: 2024-08-04T05:02:11.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4QZ1K
CVE ID: CVE-2021-46386 State: PUBLISHED Published: 2022-01-26T00:00:00 Last Updated: 2024-08-04T05:02:11.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4R0GW
CVE ID: CVE-2021-46387 State: PUBLISHED Published: 2022-03-01T14:04:41 Last Updated: 2024-08-04T05:02:11.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/us/en/support/security_advisories.shtml - https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtml - http
l.com/us/en/support/security_advisories.shtml - https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtml - https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharing - http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.html
CVE ID: CVE-2021-46388 State: REJECTED Published: 2022-02-16T11:00:39 Last Updated: 2022-03-09T19:38:43 Description: No description available.
CVE ID: CVE-2021-46389 State: PUBLISHED Published: 2022-02-07T13:33:53 Last Updated: 2024-08-04T05:02:11.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by an integer overflow in iipsrv.fcgi through malformed HTTP query parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ruven/iipsrv/commit/882925b295a80ec992063deffc2a3b0d803c3195 - https://github.com/ruven/iipsrv/commit/4ed59265fbbd636dc2fbbf325f8ea37ed300a6d9
CVE ID: CVE-2021-46390 State: PUBLISHED Published: 2022-03-21T19:59:17 Last Updated: 2024-08-04T05:02:11.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the authentication module of Lexar_F35 v1.0.34 allows attackers to access sensitive data and cause a Denial of Service (DoS). An attacker without access to securely protected data on a secure USB flash drive can bypass user authentication without having any information related to the password of the registered user. The secure USB flash drive transmits the password entered by the user to the authentication module in the drive after the user registers a password, and then the input password is compar
ser to the authentication module in the drive after the user registers a password, and then the input password is compared with the registered password stored in the authentication module. Subsequently, the module returns the comparison result for the authentication decision. Therefore, an attacker can bypass password authentication by analyzing the functions that return the password verification or comparison results and manipulate the authentication result values. Accordingly, even if attackers enter an incorrect password, they can be authenticated as a legitimate user and can therefore exploit functions of the secure USB flash drive by manipulating the authentication result values. Additi
d can therefore exploit functions of the secure USB flash drive by manipulating the authentication result values. Additional Analyst Notes: - CVE Program Container: References: - https://www.lexar.com/en/product/lexar-jumpdrive-fingerprint-f35-usb-3-0-flash-drive/ - https://www.amazon.in/Lexar-LJDF35-128BNL-JumpDrive-Fingerprint-Silver/dp/B07GSMSL28/ref=sr_1_2?crid=37UZOWDJDLMIP&keywords=Lexar_F35&qid=1641532007&s=computers&sprefix=lexar_f3%2Ccomputers%2C311&sr=1-2 - https://www.ebay.com/itm/265316509212?hash=item3dc618a61c:g:YO0AAOSwoPJeNNQN - https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-fcqg-mq6w-h3fh
CVE ID: CVE-2021-46393 State: PUBLISHED Published: 2022-03-04T13:00:17 Last Updated: 2024-08-04T05:02:11.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v10 variable is directly retrieved from the http request parameter startIp. Then v10 will be splice to stack by function sscanf without any security check,which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data. Additional Analyst Notes: - CVE Program Container: References: - ht
code execution with carefully crafted overflow data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/3
CVE ID: CVE-2021-46394 State: PUBLISHED Published: 2022-03-04T13:05:00 Last Updated: 2024-08-04T05:02:11.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved from the http request parameter startIp. Then v13 will be splice to stack by function sscanf without any security check, which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data. Additional Analyst Notes: - CVE Program Container: References: - h
code execution with carefully crafted overflow data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/4
CVE ID: CVE-2021-46398 State: PUBLISHED Published: 2022-02-04T15:05:05 Last Updated: 2024-08-04T05:02:11.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/filebrowser/filebrowser/commit/74b7cd8e81840537a8206317344f118093153e8d - https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebro
wser/commit/74b7cd8e81840537a8206317344f118093153e8d - https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html - https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/ - https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7 - http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.html - https://febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7
CVE ID: CVE-2021-46408 State: PUBLISHED Published: 2022-03-09T18:30:35 Last Updated: 2024-08-04T05:02:11.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 v22.03.01.21 was discovered to contain a stack buffer overflow in the function sub_422CE4. This vulnerability allows attackers to cause a Denial of Service (DoS) via the strcpy parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX12/2
CVE ID: CVE-2021-46416 State: PUBLISHED Published: 2022-04-07T10:45:55 Last Updated: 2024-08-04T05:02:11.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharing - https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.html - http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html
CVE ID: CVE-2021-46417 State: PUBLISHED Published: 2022-04-07T10:55:09 Last Updated: 2024-08-04T05:02:11.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/drive/folders/1Yu4aVDdrgvs-F9jP3R8Cw7qo_TC7VB-R - http://packetstormsecurity.com/files/166610/FFS-Colibri-Controller-Module-1.8.19.8580-Directory-Traversal.html - http://packetstormsecurity.com/files/166671/Franklin-Fueling-Systems-Colibri-Controller-M