Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with local administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - https://acercsi.com - https://community.acer.com/en/kb/articles/14757-acer-care-center-requires-an-update-to-resolve-a-security-vulnerability - https://aptw.tf/2022/01/20/acer-care-center-privesc.html
CVE ID: CVE-2021-45977 State: PUBLISHED Published: 2022-02-25T14:36:13 Last Updated: 2024-08-04T04:54:31.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC (used as Remote Development backend IDEs) bind to the 0.0.0.0 IP address. The fixed versions are: IntelliJ IDEA 2021.3.1, PyCharm Professional 2021.3.1, GoLand 2021.3.2, PhpStorm 2021.3.1 (213.6461.83), RubyMine 2021.3.1, CLion 2021.3.2, and Web
harm Professional 2021.3.1, GoLand 2021.3.2, PhpStorm 2021.3.1 (213.6461.83), RubyMine 2021.3.1, CLion 2021.3.2, and WebStorm 2021.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2021-45978 State: PUBLISHED Published: 2022-01-04T14:30:21 Last Updated: 2024-08-04T04:54:31.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://github.com/dlehgus1023 - https://github.com/dlehgus1023/CVE/tree/master/CVE-2021-45978
CVE ID: CVE-2021-45979 State: PUBLISHED Published: 2022-01-04T14:31:34 Last Updated: 2024-08-04T04:54:31.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL in the JavaScript API. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://github.com/dlehgus1023/CVE/tree/master/CVE-2021-45979 - https://github.com/dlehgus1023
CVE ID: CVE-2021-45980 State: PUBLISHED Published: 2022-01-04T14:32:50 Last Updated: 2024-08-04T04:54:31.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://github.com/dlehgus1023 - https://github.com/dlehgus1023/CVE/tree/master/CVE-2021-45980
CVE ID: CVE-2021-45981 State: PUBLISHED Published: 2022-06-02T17:40:17 Last Updated: 2024-08-04T04:54:31.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories - https://netscout.com
CVE ID: CVE-2021-45982 State: PUBLISHED Published: 2022-06-02T17:40:23 Last Updated: 2024-08-04T04:54:31.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories - https://netscout.com
CVE ID: CVE-2021-45983 State: PUBLISHED Published: 2022-06-02T17:40:31 Last Updated: 2024-08-04T04:54:31.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories - https://netscout.com
CVE ID: CVE-2021-45985 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-12T16:02:20.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.lua.org/bugs.html#5.4.3-11 - https://github.com/lua/lua/commit/cf613cdc6fa367257fc61c256f63d917350858b5 - http://lua-users.org/lists/lua-l/2021-12/msg00019.html
CVE ID: CVE-2021-45986 State: PUBLISHED Published: 2022-02-04T01:33:50 Last Updated: 2024-08-04T04:54:31.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetUSBShareInfo. This vulnerability allows attackers to execute arbitrary commands via the usbOrdinaryUserName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_2/2.md
CVE ID: CVE-2021-45987 State: PUBLISHED Published: 2022-02-04T01:33:48 Last Updated: 2024-08-04T04:54:31.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetNetCheckTools. This vulnerability allows attackers to execute arbitrary commands via the hostName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_3/3.md
CVE ID: CVE-2021-45988 State: PUBLISHED Published: 2022-02-04T01:33:47 Last Updated: 2024-08-04T04:54:31.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDnsForward. This vulnerability allows attackers to cause a Denial of Service (DoS) via the DnsForwardRule parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_5/5.md
CVE ID: CVE-2021-45989 State: PUBLISHED Published: 2022-02-04T01:33:46 Last Updated: 2024-08-04T04:54:31.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function guestWifiRuleRefresh. This vulnerability allows attackers to cause a Denial of Service (DoS) via the qosGuestUpstream and qosGuestDownstream parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_4/4.md
CVE ID: CVE-2021-45990 State: PUBLISHED Published: 2022-02-04T01:33:46 Last Updated: 2024-08-04T04:54:31.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function uploadPicture. This vulnerability allows attackers to execute arbitrary commands via the pic_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_1/1.md
CVE ID: CVE-2021-45991 State: PUBLISHED Published: 2022-02-04T01:33:45 Last Updated: 2024-08-04T04:54:31.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddVpnUsers. This vulnerability allows attackers to cause a Denial of Service (DoS) via the vpnUsers parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_6/6.md
CVE ID: CVE-2021-45992 State: PUBLISHED Published: 2022-02-04T01:33:44 Last Updated: 2024-08-04T04:54:31.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetQvlanList. This vulnerability allows attackers to cause a Denial of Service (DoS) via the qvlanName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_7/7.md
CVE ID: CVE-2021-45993 State: PUBLISHED Published: 2022-02-04T01:33:41 Last Updated: 2024-08-04T04:54:31.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindModify. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IPMacBindRuleIP and IPMacBindRuleMac parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_10/10.md
CVE ID: CVE-2021-45994 State: PUBLISHED Published: 2022-02-04T01:33:41 Last Updated: 2024-08-04T04:54:31.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formDelDhcpRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the delDhcpIndex parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_12/12.md
CVE ID: CVE-2021-45995 State: PUBLISHED Published: 2022-02-04T01:33:40 Last Updated: 2024-08-04T04:54:31.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetStaticRoute. This vulnerability allows attackers to cause a Denial of Service (DoS) via the staticRouteNet, staticRouteMask, and staticRouteGateway parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_9/9.md
CVE ID: CVE-2021-45996 State: PUBLISHED Published: 2022-02-04T01:33:40 Last Updated: 2024-08-04T04:54:31.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetPortMapping. This vulnerability allows attackers to cause a Denial of Service (DoS) via the portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/tree/main/Tenda/vuln_8
CVE ID: CVE-2021-45997 State: PUBLISHED Published: 2022-02-04T01:33:39 Last Updated: 2024-08-04T04:54:31.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetPortMapping. This vulnerability allows attackers to cause a Denial of Service (DoS) via the portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_11/11.md
CVE ID: CVE-2021-45998 State: PUBLISHED Published: 2022-02-04T01:33:38 Last Updated: 2024-08-04T04:54:31.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi/my_vuln/blob/main/D-link/vuln_4/4.md - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10287
CVE ID: CVE-2021-46005 State: PUBLISHED Published: 2022-01-18T17:35:27 Last Updated: 2024-08-04T04:54:31.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49546 - https://www.sourcecodester.com/cc/14145/online-car-rental-system-using-phpmysql.html
CVE ID: CVE-2021-46006 State: PUBLISHED Published: 2022-03-30T22:43:13 Last Updated: 2024-08-04T04:54:31.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication. Additional Analyst Notes: - CVE Program Container: References: - http://totolink.com - http://a3100r.com - https://hackmd.io/vS-OfUEzSqqKh8e1PKce5A
CVE ID: CVE-2021-46007 State: PUBLISHED Published: 2022-03-30T22:12:22 Last Updated: 2024-08-04T04:54:31.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks. Additional Analyst Notes: - CVE Program Container: References: - http://totolink.com - http://a3100r.com - https://hackmd.io/t_nRWxS2Q2O7GV2E5BhQMg
CVE ID: CVE-2021-46008 State: PUBLISHED Published: 2022-03-30T22:20:45 Last Updated: 2024-08-04T04:54:31.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, can easily telnet into the target with root shell if the telnet is function turned on. Additional Analyst Notes: - CVE Program Container: References: - http://totolink.com - http://a3100r.com - https://hackmd.io/ZkeEB-VvRiWBS53rFKG8DQ
CVE ID: CVE-2021-46009 State: PUBLISHED Published: 2022-03-30T22:18:31 Last Updated: 2024-08-04T04:54:31.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies. Additional Analyst Notes: - CVE Program Container: References: - http://totolink.com - http://a3100r.com - https://hackmd.io/-riYp6Q-ReCx-dKKWFBTLg
CVE ID: CVE-2021-46010 State: PUBLISHED Published: 2022-03-30T22:09:21 Last Updated: 2024-08-04T04:54:31.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations. Additional Analyst Notes: - CVE Program Container: References: - http://totolink.com - http://a3100r.com - https://hackmd.io/Ynwm8NnQSiK0xm7QKuNteg
CVE ID: CVE-2021-46012 State: REJECTED Published: 2022-01-18T17:49:11 Last Updated: 2022-01-18T17:58:45 Description: No description available.
CVE ID: CVE-2021-46013 State: PUBLISHED Published: 2022-01-18T17:57:35 Last Updated: 2024-08-04T04:54:31.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "<?php system($_GET["cmd"]); ?>" gets uploaded it is saved into /uploads/exam_question/ directory, and is accessible by all users. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50587
CVE ID: CVE-2021-46019 State: PUBLISHED Published: 2022-01-14T00:00:00 Last Updated: 2024-08-04T04:54:31.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-recutils/2021-12/msg00009.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRSXSN2XF6PX74WDYVV26TQMYIFAEQ3T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDVOFC3HTBG7DF2PZTEX
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDVOFC3HTBG7DF2PZTEXRMG4CV2F55UF/ - https://github.com/gnu-mirror-unofficial/recutils/commit/34b75ed7ad492c8e38b669ebafe0176f1f9992d2
CVE ID: CVE-2021-46020 State: PUBLISHED Published: 2022-01-14T20:01:27 Last Updated: 2024-08-04T04:54:31.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/issues/5613
CVE ID: CVE-2021-46021 State: PUBLISHED Published: 2022-01-14T20:02:06 Last Updated: 2024-08-04T04:54:31.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-recutils/2021-12/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRSXSN2XF6PX74WDYVV26TQMYIFAEQ3T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDVOFC3HTBG7D
FAEQ3T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDVOFC3HTBG7DF2PZTEXRMG4CV2F55UF/
CVE ID: CVE-2021-46022 State: PUBLISHED Published: 2022-01-14T00:00:00 Last Updated: 2024-08-04T04:54:31.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-recutils/2021-12/msg00007.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRSXSN2XF6PX74WDYVV26TQMYIFAEQ3T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDVOFC3HTBG7
IFAEQ3T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDVOFC3HTBG7DF2PZTEXRMG4CV2F55UF/ - https://github.com/gnu-mirror-unofficial/recutils/commit/34b75ed7ad492c8e38b669ebafe0176f1f9992d2 - https://nvd.nist.gov/vuln/detail/CVE-2021-46022
CVE ID: CVE-2021-46023 State: PUBLISHED Published: 2023-02-14T00:00:00.000Z Last Updated: 2025-03-20T20:44:22.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mruby/mruby/issues/5613
CVE ID: CVE-2021-46024 State: PUBLISHED Published: 2022-01-23T16:18:17 Last Updated: 2024-08-04T04:54:31.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds online-shopping-webvsite-in-php 1.0 suffers from a SQL Injection vulnerability via the "id" parameter in cart_add.php, No login is required. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-shopping-webvsite-in-php/issues/3
CVE ID: CVE-2021-46025 State: PUBLISHED Published: 2022-01-19T22:54:40 Last Updated: 2024-08-04T04:54:31.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the background. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zhangyd-c/OneBlog/issues/27
CVE ID: CVE-2021-46026 State: PUBLISHED Published: 2022-01-19T23:04:40 Last Updated: 2024-08-04T04:54:31.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wangl1989/mysiteforme/issues/39
CVE ID: CVE-2021-46027 State: PUBLISHED Published: 2022-01-19T23:01:29 Last Updated: 2024-08-04T04:54:31.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, a blog tag will be added Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wangl1989/mysiteforme/issues/40
CVE ID: CVE-2021-46028 State: PUBLISHED Published: 2022-01-19T23:07:46 Last Updated: 2024-08-04T04:54:31.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/langhsu/mblog/issues/50
CVE ID: CVE-2021-46030 State: PUBLISHED Published: 2022-01-19T14:51:19 Last Updated: 2024-08-04T04:54:31.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChinaLHR/JavaQuarkBBS/issues/23
CVE ID: CVE-2021-46033 State: PUBLISHED Published: 2022-01-25T15:01:17 Last Updated: 2024-08-04T04:54:31.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ForestBlog, as of 2021-12-28, File upload can bypass verification. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saysky/ForestBlog/issues/69
CVE ID: CVE-2021-46034 State: PUBLISHED Published: 2022-01-25T15:04:21 Last Updated: 2024-08-04T04:54:31.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saysky/ForestBlog/issues/70
CVE ID: CVE-2021-46036 State: PUBLISHED Published: 2022-02-18T18:32:25 Last Updated: 2024-08-04T04:54:31.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities/
CVE ID: CVE-2021-46037 State: PUBLISHED Published: 2022-02-18T18:32:26 Last Updated: 2024-08-04T04:54:31.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do. Additional Analyst Notes: - CVE Program Container: References: - https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities/
CVE ID: CVE-2021-46038 State: PUBLISHED Published: 2022-01-05T00:00:00 Last Updated: 2024-08-04T04:54:31.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (context-dependent). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/2000 - https://www.debian.org/security/2023/dsa-5411