Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-27646 State: PUBLISHED Published: 2021-03-12T06:45:13.026370Z Last Updated: 2024-09-16T18:54:23.293Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: Synology DiskStation Manager (DSM) Problem Types: CWE-416 Description: Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_26 - https://www.zerodayinitiative.com/advisories/ZDI-21-340/ - https://www.zerodayinitiative
ty/advisory/Synology_SA_20_26 - https://www.zerodayinitiative.com/advisories/ZDI-21-340/ - https://www.zerodayinitiative.com/advisories/ZDI-21-339/
CVE ID: CVE-2021-27647 State: PUBLISHED Published: 2021-03-12T06:35:11.865594Z Last Updated: 2024-09-16T20:13:32.164Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: Synology DiskStation Manager (DSM) Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_26 - https://www.zerodayinitiative.com/advisories/ZDI-21-339/
CVE ID: CVE-2021-27648 State: PUBLISHED Published: 2021-04-28T07:25:14.326823Z Last Updated: 2024-09-16T16:58:04.591Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Synology Products: Synology Antivirus Essential Problem Types: CWE-610 Description: Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote authenticated users to obtain privilege via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_21_15
CVE ID: CVE-2021-27649 State: PUBLISHED Published: 2021-06-23T09:50:17.135781Z Last Updated: 2024-09-16T23:05:41.826Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-416 Description: Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_26
CVE ID: CVE-2021-27650 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2021-27651 State: PUBLISHED Published: 2021-04-29T14:47:20 Last Updated: 2024-08-03T21:26:10.645Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-287 Description: In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. Additional Analyst Notes: - CVE Program Container: References: - https://collaborate.pega.com/discussion/pega-security-advisory-a21-hotfix-matrix
CVE ID: CVE-2021-27653 State: PUBLISHED Published: 2021-04-01T18:38:57.721776Z Last Updated: 2024-09-16T23:11:02.611Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Pega Systems Products: Pega Infinity Problem Types: CWE-284 Description: Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure. Additional Analyst Notes: - CVE Program Container: References: - https://collaborate.pega.com/discussion/pega-security-advisory-%E2%80%93-b21 - https://robertwillishacking.com/census-vulnerability-exposes-10k-oauth-tokens-thousands-of-user-records/
CVE ID: CVE-2021-27654 State: PUBLISHED Published: 2022-01-28T19:09:31 Last Updated: 2024-08-03T21:26:10.620Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-640 Description: Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. Additional Analyst Notes: - CVE Program Container: References: - https://collaborate.pega.com/discussion/pega-security-advisory-c21
CVE ID: CVE-2021-27656 State: PUBLISHED Published: 2021-03-18T17:58:41.745956Z Last Updated: 2024-09-17T03:23:48.351Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Johnson Controls Products: exacqVision Web Service version 20.12.2.0 and prior Problem Types: CWE 200 : Information Exposure Description: A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.cisa.gov/ics/ad
ner: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.cisa.gov/ics/advisories/icsa-21-077-01
CVE ID: CVE-2021-27657 State: PUBLISHED Published: 2021-06-04T14:07:39.073279Z Last Updated: 2024-09-17T00:51:44.651Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Johnson Controls Products: Metasys Problem Types: CWE-269 Description: Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.c
11.0 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories - https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01
CVE ID: CVE-2021-27658 State: PUBLISHED Published: 2021-06-24T13:49:27.039894Z Last Updated: 2024-09-17T02:06:10.903Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Johnson Controls Products: exacqVision Enterprise Manager Problem Types: CWE-79 Description: exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories - https://us-cert.cisa.gov
.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories - https://us-cert.cisa.gov/ics/advisories/icsa-21-180-02
CVE ID: CVE-2021-27659 State: PUBLISHED Published: 2021-06-24T13:59:12.883515Z Last Updated: 2024-09-16T18:34:21.318Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Johnson Controls Products: exacqVision Web Service Problem Types: CWE-79 Description: exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories - https://us-cert.cisa.gov/ics/advisorie
ls.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories - https://us-cert.cisa.gov/ics/advisories/icsa-21-180-01
CVE ID: CVE-2021-27660 State: PUBLISHED Published: 2021-07-01T13:36:44.607216Z Last Updated: 2024-09-16T19:24:41.553Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Johnson Controls Products: C-CURE 9000 Problem Types: CWE-20 Description: An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.cisa.gov/ics/advisories/icsa-21-182-02
CVE ID: CVE-2021-27661 State: PUBLISHED Published: 2021-07-01T13:41:58.835758Z Last Updated: 2024-09-16T22:14:19.833Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Johnson Controls Products: Facility Explorer SNC Series Supervisory Controllers (F4-SNC) Problem Types: CWE-269 Description: Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC. Additional Analyst Notes: - CVE Program Container: References: - ht
ing specifically crafted web messages to the F4-SNC. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.cisa.gov/ics/advisories/icsa-21-182-01
CVE ID: CVE-2021-27662 State: PUBLISHED Published: 2021-09-15T12:04:22.918826Z Last Updated: 2024-09-17T00:31:51.342Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: Johnson Controls Products: KT-1 Problem Types: CWE-294 Description: The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01 Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories
CVE ID: CVE-2021-27663 State: PUBLISHED Published: 2021-08-30T16:37:41.273754Z Last Updated: 2024-09-17T03:38:42.161Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Johnson Controls Products: CEM Systems AC2000 Problem Types: CWE-285 Description: A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisorie
r: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories/ICSA-21-238-01
CVE ID: CVE-2021-27664 State: PUBLISHED Published: 2021-10-11T15:21:08.472473Z Last Updated: 2024-09-17T03:55:00.216Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Johnson Controls Products: exacqVision Web Service Problem Types: CWE-269 Description: Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories/icsa-21-280-01
CVE ID: CVE-2021-27665 State: PUBLISHED Published: 2021-10-11T15:26:09.316481Z Last Updated: 2024-09-17T02:53:35.571Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Johnson Controls Products: exacqVision Web Service Problem Types: CWE-190 Description: An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.gov/ics/advisories/icsa-21-280-03
CVE ID: CVE-2021-27668 State: PUBLISHED Published: 2021-08-31T17:01:43 Last Updated: 2024-08-03T21:26:10.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427 - https://security.gentoo.org/glsa/202207-01
CVE ID: CVE-2021-27670 State: PUBLISHED Published: 2021-02-25T00:01:31 Last Updated: 2024-08-03T21:26:10.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/h3110mb/PoCSSrfApp
CVE ID: CVE-2021-27671 State: PUBLISHED Published: 2021-02-25T00:33:48 Last Updated: 2024-08-03T21:26:10.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0026.html
CVE ID: CVE-2021-27672 State: PUBLISHED Published: 2021-04-15T13:51:32 Last Updated: 2024-08-03T21:26:10.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component. Additional Analyst Notes: - CVE Program Container: References: - https://deadsh0t.medium.com/blind-error-based-authenticated-sql-injection-on-zenario-8-8-52729-cms-d4705534df38
CVE ID: CVE-2021-27673 State: PUBLISHED Published: 2021-04-15T13:51:40 Last Updated: 2024-08-03T21:26:10.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component. Additional Analyst Notes: - CVE Program Container: References: - https://deadsh0t.medium.com/blind-error-based-authenticated-sql-injection-on-zenario-8-8-52729-cms-d4705534df38 - http://packetstormsecurity.com/files/163083/Zenario-CMS-8.8.52729-SQL-Injection.html
CVE ID: CVE-2021-27676 State: PUBLISHED Published: 2021-05-26T10:20:38 Last Updated: 2024-08-03T21:26:10.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page. Additional Analyst Notes: - CVE Program Container: References: - http://centreon.com - https://github.com/centreon/centreon/pull/9587
CVE ID: CVE-2021-27677 State: PUBLISHED Published: 2021-03-11T16:22:57 Last Updated: 2024-08-03T21:26:10.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sruupl/batflat/issues/105
CVE ID: CVE-2021-27678 State: PUBLISHED Published: 2021-03-11T16:23:07 Last Updated: 2024-08-03T21:26:10.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sruupl/batflat/issues/105
CVE ID: CVE-2021-27679 State: PUBLISHED Published: 2021-03-11T16:23:14 Last Updated: 2024-08-03T21:26:10.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sruupl/batflat/issues/105
CVE ID: CVE-2021-27691 State: PUBLISHED Published: 2021-04-15T23:14:46 Last Updated: 2024-08-03T21:26:10.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This occurs because the "formSetDebugCfg" function executes glibc's system function with untrusted input. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd.io/%40aZYpdinUS2SD-yhAeHwOkw/rkhTCGzMd
CVE ID: CVE-2021-27692 State: PUBLISHED Published: 2021-04-15T23:14:32 Last Updated: 2024-08-03T21:26:10.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the "doSystemCmd" function with untrusted input. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd.io/%40aZYpdinUS2SD-yhAeHwOkw/ry-t4QfMu
CVE ID: CVE-2021-27693 State: PUBLISHED Published: 2022-09-02T17:33:43 Last Updated: 2024-08-03T21:26:10.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sanluan/PublicCMS/issues/51 - https://github.com/sanluan/PublicCMS/commit/0f4c4872914b6a71305e121a7d9a19c07cde0338
CVE ID: CVE-2021-27695 State: PUBLISHED Published: 2021-03-15T16:08:36 Last Updated: 2024-08-03T21:26:10.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters. Additional Analyst Notes: - CVE Program Container: References: - http://openmaint.com - https://www.exploit-db.com/exploits/49649
CVE ID: CVE-2021-27697 State: PUBLISHED Published: 2021-04-06T12:07:53 Last Updated: 2024-08-03T21:26:10.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: RIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl/gnrc_rpl_validation.c through the gnrc_rpl_validation_options() function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/issues/16062
CVE ID: CVE-2021-27698 State: PUBLISHED Published: 2021-04-06T12:08:15 Last Updated: 2024-08-03T21:26:10.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c through the _parse_options() function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/issues/16085
CVE ID: CVE-2021-27700 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-18T18:14:35.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dashboard and perform actions like modify user, delete user, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2021-27700
CVE ID: CVE-2021-27701 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-18T18:12:42.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery (CSRF) via the Socifi wifi portal. The application does not contain a CSRF token and request validation. An attacker can Add/Modify any random user data by sending a crafted CSRF request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2021-27701
CVE ID: CVE-2021-27702 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-15T21:28:05.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2021-27702
CVE ID: CVE-2021-27703 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-15T21:23:41.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sercomm Model Etisalat Model S3- AC2100 is affected by Cross Site Scripting (XSS) via the firmware update page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2021-27703
CVE ID: CVE-2021-27704 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-26T17:26:14.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2021-27704
CVE ID: CVE-2021-27705 State: PUBLISHED Published: 2021-04-14T14:52:09 Last Updated: 2024-08-03T21:26:10.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"qosIndex "request. This occurs because the "formQOSRuleDel" function directly passes the parameter "qosIndex" to strcpy without limit. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd.io/Zb7lfFaNR0ScpaTssECFbg
CVE ID: CVE-2021-27706 State: PUBLISHED Published: 2021-04-14T14:55:39 Last Updated: 2024-08-03T21:26:10.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"IPMacBindIndex "request. This occurs because the "formIPMacBindDel" function directly passes the parameter "IPMacBindIndex" to strcpy without limit. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd.io/BhzJ4H20TjqKUiBrDOIKaw
CVE ID: CVE-2021-27707 State: PUBLISHED Published: 2021-04-14T15:00:05 Last Updated: 2024-08-03T21:26:10.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"portMappingIndex "request. This occurs because the "formDelPortMapping" function directly passes the parameter "portMappingIndex" to strcpy without limit. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd.io/U7OVgYIuRcOKV7SW5-euHw