Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
he database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and/or execute SQL statements that alter or delete database elements. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/moveit - https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-June-2021
CVE ID: CVE-2021-33895 State: PUBLISHED Published: 2021-06-25T00:00:00 Last Updated: 2024-08-04T00:05:51.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI application, the system procedure (USER_AUTHENTICATE_) used for verifying the Password returns 0 (no error). The reason is that the user is not running the XYGate application. Hence, BBSV assumes the Password is correct. For H4.09, the affected version isT0954V04^AAO. For E4.09, the affected version is 22SEP2020. Note: If your current version is E4.10-16MAY2021 (version procedu
V04^AAO. For E4.09, the affected version is 22SEP2020. Note: If your current version is E4.10-16MAY2021 (version procedure T9999V04_16MAY2022_BPAKETI_10), a hotfix (FIXPAK-19OCT-2022) is available in version E4.10-19OCT2022. Resolution to CVE-2021-33895 in version E4.11-19OCT2022 Additional Analyst Notes: - CVE Program Container: References: - https://etinet.com/products/backbox-virtual-tape-controller/ - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbns04172en_us
CVE ID: CVE-2021-33896 State: PUBLISHED Published: 2021-06-07T18:12:07 Last Updated: 2024-08-04T00:05:51.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators. Additional Analyst Notes: - CVE Program Container: References: - https://dino.im/blog/ - https://dino.im/security/cve-2021-33896/ - http://www.openwall.com/lists/oss-security/2021/06/07/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODN4ZSTBYIW25DO3FNRK6FQRGSYGT57I/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fed
g/message/ODN4ZSTBYIW25DO3FNRK6FQRGSYGT57I/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P55V3TVSVXREOJAJRXNUSBEUZFOU54V3/
CVE ID: CVE-2021-33897 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-29T20:32:46.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes. This file is mishandled during a deletion attempt. In Synthesia before 10.9, an improper path handling allows local attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
with malformed bytes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://isopach.dev/CVE-2021-33897 - https://synthesiagame.com/news
CVE ID: CVE-2021-33898 State: PUBLISHED Published: 2021-06-06T22:28:22 Last Updated: 2024-08-04T00:05:52.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/invoiceninja/invoiceninja/issues
it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/invoiceninja/invoiceninja/issues/5909
CVE ID: CVE-2021-33900 State: PUBLISHED Published: 2021-07-26T07:05:10 Last Updated: 2024-08-04T00:05:51.036Z Vendors: Apache Software Foundation Products: Apache Directory Studio Problem Types: CWE-311 Description: While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rb1db
or versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rb1dbcc43a5b406e45d335343a1704f4233de613140a01929d102fdc9%40%3Cusers.directory.apache.org%3E
CVE ID: CVE-2021-33903 State: PUBLISHED Published: 2021-10-07T14:48:15 Last Updated: 2024-08-04T00:05:52.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. (However, changing the password of the root user via LANconfig does change the password of the root user for SNMPv3 access.) Additional Analyst Notes: - CVE Program Container: References: - https://www.nmedv.de/wp-content/uploads/2021/10/NME-2021-001.txt
CVE ID: CVE-2021-33904 State: PUBLISHED Published: 2021-06-07T11:40:46 Last Updated: 2024-08-04T00:05:51.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable security flags and we are unable to reproduce them with the available information. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/0xx7/3d934939d7122fe23db11bc48eda9d21 - http://packetstormsecurity.com/files/163093/Accela-Civic-Platorm-21.1-Cross-Site-Scripting.html
CVE ID: CVE-2021-33907 State: PUBLISHED Published: 2021-09-27T13:55:30 Last Updated: 2024-08-04T00:05:51.703Z Vendors: n/a Products: Zoom Client for Meetings for Windows Problem Types: Improper Verification of Crypto Signature Description: The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when performing an update of the client. This could lead to remote code execution in an elevated privileged context. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2021-33909 State: PUBLISHED Published: 2021-07-20T18:01:34 Last Updated: 2024-08-04T00:05:52.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2021/07/msg00016.html - https://lists.debian.org/debian-lts-announce/2021/07/msg00014.html - https://lists.debian.org/debian-lts-announce/2021/07/msg00015.html - https://www.de
lts-announce/2021/07/msg00014.html - https://lists.debian.org/debian-lts-announce/2021/07/msg00015.html - https://www.debian.org/security/2021/dsa-4941 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4UHHIGISO3FVRF4CQNJS4IKA25ATSFU/ - http://www.openwall.com/lists/oss-security/2021/07/22/7 - http://www.openwall.com/lists/oss-security/2021/08/25/10 - http://www.openwall.com/lists/oss-security/2021/09/17/2 - http://www.openwall.com/lists/oss-security/2021/09/17/4 - http://www.openwall.com/lists/oss-security/2021/09/21/1 - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.openwall.com/lists/oss-security/2021/07/20/1 - https:
tps://www.oracle.com/security-alerts/cpujan2022.html - https://www.openwall.com/lists/oss-security/2021/07/20/1 - https://github.com/torvalds/linux/commit/8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4 - http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html - http://packetstormsecurity.com/files/163671/Kernel-Live-Patch-Security-Notice-LSN-0079-1.html - https://security.netapp.com/advisory/ntap-20210819-0004/ - http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html - http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.
urity-Notice-LSN-0081-1.html - http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015
CVE ID: CVE-2021-33910 State: PUBLISHED Published: 2021-07-20T18:13:49.000Z Last Updated: 2025-06-09T15:44:25.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9 - https://www.openwall.com/lists/oss-security/2021/07/20/2 - https://security.gentoo.org/glsa/2021
5c3bb0ba477c892861ab9 - https://www.openwall.com/lists/oss-security/2021/07/20/2 - https://security.gentoo.org/glsa/202107-48 - https://www.debian.org/security/2021/dsa-4942 - http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html - https://github.com/systemd/systemd/commit/b34a4f0e6729de292cb3b0c03c1d48f246ad896b - https://github.com/systemd/systemd-stable/commit/cfd14c65374027b34dbbc4f0551456c5dc2d1f61 - https://github.com/systemd/systemd-stable/commit/b00674347337b7531c92fdb65590ab253bb57538 - https://github.com/systemd/systemd-stable/commit/4a1c5f34bd3e1daed4490e9d97918e504d19733b - https://github.com/systemd/systemd-stable/commit/764b74113e36ac52
able/commit/4a1c5f34bd3e1daed4490e9d97918e504d19733b - https://github.com/systemd/systemd-stable/commit/764b74113e36ac5219a4b82a05f311b5a92136ce - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2LSDMHAKI4LGFOCSPXNVVSEWQFAVFWR7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/ - http://www.openwall.com/lists/oss-security/2021/08/04/2 - http://www.openwall.com/lists/oss-security/2021/08/17/3 - http://www.openwall.com/lists/oss-security/2021/09/07/3 - https://security.netapp.com/advisory/ntap-20211104-0008/ - https://cert-portal.siemens.com/productcert/pdf/ssa-22
07/3 - https://security.netapp.com/advisory/ntap-20211104-0008/ - https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
CVE ID: CVE-2021-33911 State: PUBLISHED Published: 2021-07-17T18:19:27 Last Updated: 2024-08-04T00:05:51.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus before 7110 allows remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/ad-manager/release-notes.html#7110
CVE ID: CVE-2021-33912 State: PUBLISHED Published: 2022-01-19T00:00:00 Last Updated: 2024-08-04T00:05:52.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix;
l configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220b - https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure - https://lists.debian.org/debian-lts-announce/2022/01/msg00015.html - https://security.gentoo.org/glsa/202401-22
CVE ID: CVE-2021-33913 State: PUBLISHED Published: 2022-01-19T00:00:00 Last Updated: 2024-08-04T00:05:51.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data depends on the relationship between the length of an entire domain name and the length of its leftmost label. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration,
vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220b - https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure - https://lists.debian.org/debian-lts-announce/2022/01/msg00015.html - https://security.gentoo.org/glsa/202401-22
CVE ID: CVE-2021-33923 State: PUBLISHED Published: 2021-09-29T09:44:19 Last Updated: 2024-08-04T00:05:52.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database). Additional Analyst Notes: - CVE Program Container: References: - https://www.detack.de/en/cve-2021-33923 - https://confluent.io
CVE ID: CVE-2021-33924 State: PUBLISHED Published: 2021-09-29T09:44:26 Last Updated: 2024-08-04T00:05:52.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.detack.de/en/cve-2021-33924 - https://confluent.io
CVE ID: CVE-2021-33925 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-20T14:00:57.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in nitinparashar30 cms-corephp through commit bdabe52ef282846823bda102728a35506d0ec8f9 (May 19, 2021) allows unauthenticated attackers to gain escilated privledges via a crafted login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nitinp1232/cms-corephp/issues/1
CVE ID: CVE-2021-33926 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-19T14:13:01.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plone.org/security/hotfix/20210518 - h
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plone.org/security/hotfix/20210518 - https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf - https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url
CVE ID: CVE-2021-33928 State: PUBLISHED Published: 2021-09-02T14:58:05 Last Updated: 2024-08-04T00:05:52.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/libsolv/issues/417
CVE ID: CVE-2021-33929 State: PUBLISHED Published: 2021-09-02T14:58:11 Last Updated: 2024-08-04T00:05:51.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/libsolv/issues/417
CVE ID: CVE-2021-33930 State: PUBLISHED Published: 2021-09-02T14:58:13 Last Updated: 2024-08-04T00:05:52.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/libsolv/issues/417
CVE ID: CVE-2021-33938 State: PUBLISHED Published: 2021-09-02T14:58:15 Last Updated: 2024-08-04T00:05:51.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/libsolv/issues/420
CVE ID: CVE-2021-33945 State: PUBLISHED Published: 2022-02-15T19:08:26 Last Updated: 2024-08-04T00:05:52.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SNw, SP 221SNw, SP 221SF, SP 220SFNw, SP 221SFNw v1.06 were discovered to contain a stack buffer overflow in the file /etc/wpa_supplicant.conf. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ainevsia/CVE-Request/tree/main/Ricoh/1 - https://www.ricoh.com/info
Program Container: References: - https://github.com/Ainevsia/CVE-Request/tree/main/Ricoh/1 - https://www.ricoh.com/info/2022/0228_1/
CVE ID: CVE-2021-33948 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T19:02:11.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FantasticLBP/Hotels_Server/issues/14
CVE ID: CVE-2021-33949 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T18:33:32.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FeMiner/wms/issues/10
CVE ID: CVE-2021-33950 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T18:32:19.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openkm/document-management-system/pull/288 - https://github.com/openkm/document-management-system/issues/287 - https://github.com/openkm/document-management-system/commit/ce1d82329615aea6aa9f2cc6508c1fe7891e34b5
CVE ID: CVE-2021-33959 State: PUBLISHED Published: 2023-01-18T00:00:00.000Z Last Updated: 2025-04-04T17:31:14.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.freebuf.com/articles/web/260338.html - https://github.com/lixiang957/CVE-2021-33959
CVE ID: CVE-2021-33961 State: PUBLISHED Published: 2022-03-22T20:23:39 Last Updated: 2024-08-04T00:05:52.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/softvar/enhanced-github/issues/96
CVE ID: CVE-2021-33962 State: PUBLISHED Published: 2022-01-14T11:49:58 Last Updated: 2024-08-04T00:05:52.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/pop_usb_device component. Additional Analyst Notes: - CVE Program Container: References: - https://www.ebuy7.com/item/china-mobile-wireless-router-qualcomm-qiki-wifi6-routing-mesh-network-home-5g-dual-frequency-double-gigabit-port-wall-wall-high-speed-%E2%80%8B%E2%80%8Bhigh-power-enhanced-dormitory-students-an-lianbao-wf-1-628692180620 - http://iot.10086.cn/?l=en-us - https://www.cnvd.org.cn/flaw/sho
hanced-dormitory-students-an-lianbao-wf-1-628692180620 - http://iot.10086.cn/?l=en-us - https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520 - https://github.com/pokerfacett/MY_CVE_CREDIT/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection12.md
CVE ID: CVE-2021-33963 State: PUBLISHED Published: 2022-01-15T09:16:29 Last Updated: 2024-08-04T00:05:52.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/mac_addr_clone receives parameters by POST request, and the parameter macType has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.ebuy7.com/item/china-mobile-wireless-router-qualcomm-qiki-wifi6-routing-mesh-network-home-5g-dual-frequency-double-gigabit-port-wall-wall-high-speed-%E2%80%8B%E2%80%8Bhigh-power-enhanced-dor
g-mesh-network-home-5g-dual-frequency-double-gigabit-port-wall-wall-high-speed-%E2%80%8B%E2%80%8Bhigh-power-enhanced-dormitory-students-an-lianbao-wf-1-628692180620 - http://iot.10086.cn/?l=en-us - https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520 - https://github.com/pokerfacett/MY_CVE_CREDIT/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection9.md