Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-40831 State: PUBLISHED Published: 2021-11-22T23:41:19 Last Updated: 2024-08-04T02:51:06.864Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Amazon Web Services Products: AWS IoT Device SDK v2 for Java , AWS IoT Device SDK v2 for Python, AWS IoT Device SDK v2 for C++, AWS IoT Device SDK v2 for Node.js, AWS-C-IO Problem Types: The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer can be verified either
also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against t
this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. Description: The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be ab
or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java vers
e has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/awslabs/aws-c-io/ - https://github.com/aws/aws-iot-device-sdk-cpp-v2 - https://github.com/aws/aws-iot-device-sdk-python-v2 - https://github.com/aws/aws-iot-devi
ws/aws-iot-device-sdk-cpp-v2 - https://github.com/aws/aws-iot-device-sdk-python-v2 - https://github.com/aws/aws-iot-device-sdk-java-v2 - https://github.com/aws/aws-iot-device-sdk-js-v2
CVE ID: CVE-2021-40832 State: PUBLISHED Published: 2021-10-08T09:45:34 Last Updated: 2024-08-04T02:51:07.506Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: F-Secure Products: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit) F-Secure Linux Security 64 F-Secure Atlant F-Secure Cloud Protection for Salesforce and Cloud Protection for Microsoft Office 365 Problem Types: Denial of Service Vulnerability Description: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVRDL unpacking module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit ca
RDL unpacking module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame - https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-40832
CVE ID: CVE-2021-40833 State: PUBLISHED Published: 2021-11-26T16:39:54 Last Updated: 2024-08-04T02:51:07.454Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: F-Secure Products: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit) F-Secure Linux Security 64 F-Secure Internet Gatekeeper & F-Secure Atlant Problem Types: Denial of Service Vulnerability Description: A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine. A
an be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame - https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-40833
CVE ID: CVE-2021-40834 State: PUBLISHED Published: 2021-12-10T13:38:46 Last Updated: 2024-08-04T02:51:07.506Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: F-Secure Products: F-Secure Mobile Security Problem Types: User interface Spoofing in F-Secure SAFE browser for Android Description: A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/
s to perform spoofing attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame - https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-40834
CVE ID: CVE-2021-40835 State: PUBLISHED Published: 2021-12-16T10:58:55 Last Updated: 2024-08-04T02:51:07.421Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: F-Secure Products: F-Secure Mobile Security Problem Types: URL Address Bar Spoofing in F-Secure SAFE Browser for iOS Description: An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially crafted a malicious URL, if user does not carefully pay attention to url, user may be tricked to think content may be coming from a valid domain, while it comes from another. This is performed by using a very long username part of the url so that user cannot see t
, while it comes from another. This is performed by using a very long username part of the url so that user cannot see the domain name. A remote attacker can leverage this to perform url address bar spoofing attack. The fix is, browser no longer shows the user name part in address bar. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame - https://www.f-secure.com/en/business/support-and-downloads/security-advisories
CVE ID: CVE-2021-40836 State: PUBLISHED Published: 2021-12-22T11:14:42 Last Updated: 2024-08-04T02:51:07.487Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: F-Secure Products: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit) F-Secure Linux Security 64 F-Secure Atlant & F-Secure Internet Gatekeeper Problem Types: Denial of Service Vulnerability Description: A vulnerability affecting F-Secure antivirus engine was discovered whereby scanning MS outlook .pst files can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivir
nerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/support-and-downloads/security-advisories
CVE ID: CVE-2021-40837 State: PUBLISHED Published: 2022-02-09T12:10:46 Last Updated: 2024-08-04T02:51:07.508Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: F-Secure Products: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, F-Secure Internet Gatekeeper & F-Secure Security Cloud Problem Types: Denial of Service Vulnerability Description: A vulnerability affecting F-Secure antivirus engine before Capricorn update 2022-02-01_01 was discovered whereby decompression of ACE file causes the scanner service to stop. The vulnerability can be exploited remotely by an attacker. A
mpression of ACE file causes the scanner service to stop. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/support-and-downloads/security-advisories - https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-40837
CVE ID: CVE-2021-40839 State: PUBLISHED Published: 2021-09-10T01:03:33 Last Updated: 2024-08-04T02:51:07.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aresch/rencode/pull/29 - https://seclists.org/fulldisclosure/2021/Sep/16 - https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75 - https://pypi.org/project/rencode/#history - https://security.netapp.com/advisory/ntap-20211008-0001/ - https://lists.f
- https://pypi.org/project/rencode/#history - https://security.netapp.com/advisory/ntap-20211008-0001/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMVQRPDVSVZNGGX57CFKCYT3DEYO4QB6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MCLETLGVM5DBX6QNHQFW6TWGO5T3DENY/
CVE ID: CVE-2021-40840 State: PUBLISHED Published: 2022-02-18T20:27:37 Last Updated: 2024-08-04T02:51:07.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored XSS issue exists in the admin/users user administration form in LiveConfig 2.12.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.liveconfig.com/en/changelog/ - https://www.mgm-sp.com/en/liveconfig-2-12-2-vulnerabilities/
CVE ID: CVE-2021-40841 State: PUBLISHED Published: 2022-02-18T20:27:35 Last Updated: 2024-08-04T02:51:07.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Path Traversal vulnerability for a log file in LiveConfig 2.12.2 allows authenticated attackers to read files on the underlying server. Additional Analyst Notes: - CVE Program Container: References: - https://www.liveconfig.com/en/changelog/ - https://www.mgm-sp.com/en/liveconfig-2-12-2-vulnerabilities/
CVE ID: CVE-2021-40842 State: PUBLISHED Published: 2021-10-13T17:17:01 Last Updated: 2024-08-04T02:51:07.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the server could be used to blindly execute arbitrary SQL statements on the backend database. Version 7.12.0 and all versions prior to 7.11.2 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpo
sions prior to 7.11.2 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0008
CVE ID: CVE-2021-40843 State: PUBLISHED Published: 2021-10-13T17:10:53 Last Updated: 2024-08-04T02:51:07.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local database could cause arbitrary code to execute with SYSTEM privileges on the underlying server when a Web Console user triggers retrieval of that data. When chained with a SQL injection vulnerability, the vulnerability could be exploited remotely if Web Console users click a series of maliciously crafted URLs. All versions prior to 7.11.2 are affected. Additional Analyst N
onsole users click a series of maliciously crafted URLs. All versions prior to 7.11.2 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0009
CVE ID: CVE-2021-40845 State: PUBLISHED Published: 2021-09-15T12:39:43 Last Updated: 2024-08-04T02:51:07.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/164149/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html - https://github.com/ricardojoserf/CVE-2021-40845 - https://ricardojos
haCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html - https://github.com/ricardojoserf/CVE-2021-40845 - https://ricardojoserf.github.io/CVE-2021-40845/ - http://packetstormsecurity.com/files/164160/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html
CVE ID: CVE-2021-40846 State: PUBLISHED Published: 2022-03-04T21:33:05 Last Updated: 2024-08-04T02:51:07.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings. Additional Analyst Notes: - CVE Program Container: References: - https://www.tradingpaints.com/page/Privacy - https://axelp.io/YWDAC
CVE ID: CVE-2021-40847 State: PUBLISHED Published: 2021-09-21T17:04:54 Last Updated: 2024-08-04T02:51:07.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled by default. This daemon connects to Circle and NETGEAR to obtain version information and updates to the circled daemon and its filtering database. However, database updates from NETGEAR are unsigned and downloaded via cleartext HTTP.
emon and its filtering database. However, database updates from NETGEAR are unsigned and downloaded via cleartext HTTP. As such, an attacker with the ability to perform a MitM attack on the device can respond to circled update requests with a crafted, compressed database file, the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code. This affects R6400v2 1.0.4.106, R6700 1.0.2.16, R6700v3 1.0.4.106, R6900 1.0.2.16, R6900P 1.3.2.134, R7000 1.0.11.123, R7000P 1.3.2.134, R7850 1.0.5.68, R7900 1.0.4.38, R8000 1.0.4.68, and RS400 1.5.0.68. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000064039/Sec
nd RS400 1.5.0.68. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204 - https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html
CVE ID: CVE-2021-40848 State: PUBLISHED Published: 2021-11-03T10:11:45 Last Updated: 2024-08-04T02:51:07.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1930471 - https://mahara.org/interaction/forum/topic.php?id=8950
CVE ID: CVE-2021-40849 State: PUBLISHED Published: 2021-11-03T10:14:53 Last Updated: 2024-08-04T02:51:07.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1930469 - https://mahara.org/interaction/forum/topic.php?id=8949
CVE ID: CVE-2021-40850 State: PUBLISHED Published: 2021-12-17T16:10:31.282373Z Last Updated: 2024-09-16T16:18:05.768Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCMAN Products: GIM Problem Types: CWE-89 Description: TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-sql-injection-vulnerability
CVE ID: CVE-2021-40851 State: PUBLISHED Published: 2021-12-17T16:10:32.086107Z Last Updated: 2024-09-16T19:00:34.099Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TCMAN Products: GIM Problem Types: CWE-287 Description: TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-sql-improper-authentication
CVE ID: CVE-2021-40852 State: PUBLISHED Published: 2021-12-17T16:10:32.835933Z Last Updated: 2024-09-16T18:56:14.480Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: TCMAN Products: GIM Problem Types: CWE-601 Description: TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-open-redirect-vulnerability
CVE ID: CVE-2021-40853 State: PUBLISHED Published: 2021-12-17T16:10:33.560492Z Last Updated: 2024-09-17T00:21:18.085Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: TCMAN Products: GIM Problem Types: CWE-862 Description: TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL that require privileges without having them. The exploitation of this vulnerability might allow a remote attacker to obtain sensible information. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/tcman-gim-missing-authori
tes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/tcman-gim-missing-authorization-vulnerability
CVE ID: CVE-2021-40854 State: PUBLISHED Published: 2021-10-14T04:16:09 Last Updated: 2024-08-04T02:51:07.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to launch a privileged Notepad process that can launch other applications. Additional Analyst Notes: - CVE Program Container: References: - https://anydesk.com/cve/2021-40854/
CVE ID: CVE-2021-40855 State: PUBLISHED Published: 2022-01-21T15:33:20 Last Updated: 2024-08-04T02:51:07.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key certificate could have been used in production. Additional Analyst Notes: - CVE Program Container: References: - https://www.consilium.europa.eu/en/policies/coronavirus/eu-digital-covid-certificate/ - https://github.com/eu-digital-green-certificates/dgc-overview/security/advisories/GHSA-xcvc-p4fw-qmcj
CVE ID: CVE-2021-40856 State: PUBLISHED Published: 2021-12-13T03:20:39 Last Updated: 2024-08-04T02:51:07.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring. Additional Analyst Notes: - CVE Program Container: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - http://packetstormsecurity.com/files/165162/Auerswald-COMfortel-1400-2600-3600-IP-2.8F-Authentication-Bypass.html - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-004/-auerswald-comfortel-1400-2600-3600-ip-authentication-bypass
CVE ID: CVE-2021-40857 State: PUBLISHED Published: 2021-12-13T03:24:17 Last Updated: 2024-08-04T02:51:07.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring. Additional Analyst Notes: - CVE Program Container: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - http://packetstormsecurity.com/files/165163/Auerswald-COMpact-8.0B-Privilege-Escalation.html - https://www.redteam-pentesting.de/advisories/rt-sa-2021-005
CVE ID: CVE-2021-40858 State: PUBLISHED Published: 2021-12-13T03:27:51 Last Updated: 2024-08-04T02:51:07.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileName=../../etc/passwd substring. Additional Analyst Notes: - CVE Program Container: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - http://packetstormsecurity.com/files/165166/Auerswald-COMpact-8.0B-Arbitrary-File-Disclosure.html - https://www.redteam-pentesting.de/advisories/rt-sa-2021-006