Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-37212 State: PUBLISHED Published: 2021-08-09T09:15:26.935896Z Last Updated: 2024-09-17T02:06:03.930Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Larvata Digital Technology Co. Ltd. Products: FLYGO Problem Types: CWE-706 Description: The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4989-5d955-1.html
CVE ID: CVE-2021-37213 State: PUBLISHED Published: 2021-08-09T09:15:28.482000Z Last Updated: 2024-09-17T00:26:41.838Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Larvata Digital Technology Co. Ltd. Products: FLYGO Problem Types: CWE-706 Description: The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee’s check-in record. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4990-0c75d-1.html
CVE ID: CVE-2021-37214 State: PUBLISHED Published: 2021-08-09T09:15:30.054953Z Last Updated: 2024-09-17T00:16:52.168Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Larvata Digital Technology Co. Ltd. Products: FLYGO Problem Types: CWE-706 Description: The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator privilege and execute arbitrary command. Additional Analyst Notes: - CVE Program Container: References: - https://www.
r privilege and execute arbitrary command. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4991-658b1-1.html
CVE ID: CVE-2021-37215 State: PUBLISHED Published: 2021-08-09T09:15:31.594414Z Last Updated: 2024-09-17T02:41:52.763Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Larvata Digital Technology Co. Ltd. Products: FLYGO Problem Types: CWE-706 Description: The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s user data by specifying that employee’s ID in the API parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4992-dac66-1
meter. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4992-dac66-1.html
CVE ID: CVE-2021-37216 State: PUBLISHED Published: 2021-08-02T11:18:56.385206Z Last Updated: 2024-09-16T21:57:49.436Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: QSAN Products: Storage Manager XN8008T, Storage Manager XN8024R Problem Types: CWE-79 Description: QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html
CVE ID: CVE-2021-37218 State: PUBLISHED Published: 2021-09-07T11:40:36 Last Updated: 2024-08-04T01:16:03.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/nomad - https://discuss.hashicorp.com/t/hcsec-2021-21-nomad-raft-rpc-privilege-escalation/29023
CVE ID: CVE-2021-37219 State: PUBLISHED Published: 2021-09-07T11:33:26 Last Updated: 2024-08-04T01:16:03.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/consul - https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024 - https://security.gentoo.org/glsa/202207-01
CVE ID: CVE-2021-37220 State: PUBLISHED Published: 2021-07-21T21:02:04 Last Updated: 2024-08-04T01:16:03.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consider the maximum key size of a hash table. This can, for example, be seen with crafted "mutool draw" input. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=703791 - http://git.ghostscript.com/?p=mupdf.git%3Bh=f5712c9949d026e4b891b25837edd2edc166151f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKRMREIYUBGG2GV
6151f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKRMREIYUBGG2GV73CU7BJNW2Q34IP23/
CVE ID: CVE-2021-37221 State: PUBLISHED Published: 2021-10-27T14:23:12 Last Updated: 2024-08-04T01:16:02.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer create option, which could let a remote malicious user upload an arbitrary php file. . Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50046
CVE ID: CVE-2021-37222 State: PUBLISHED Published: 2021-08-12T10:30:12 Last Updated: 2024-08-04T01:16:04.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: Parsers in the open source project RCDCAP before 1.0.5 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via specially crafted packets. Additional Analyst Notes: - CVE Program Container: References: - http://hg.code.sf.net/p/rcdcap/code/rev/0af05606c55b#l2.10 - https://www.openhub.net/p/rcdcap
CVE ID: CVE-2021-37223 State: PUBLISHED Published: 2021-10-05T11:59:50 Last Updated: 2024-08-04T01:16:03.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - http://nagios.com
CVE ID: CVE-2021-37231 State: PUBLISHED Published: 2021-08-04T00:00:00 Last Updated: 2024-08-04T01:16:03.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499f through APar_readX() in src/util.cpp while parsing a crafted mp4 file because of the missing boundary check. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wez/atomicparsley/issues/30 - https://github.com/wez/atomicparsley/pull/31#issue-687280335 - https://security.gentoo.org/glsa/202305-01
CVE ID: CVE-2021-37232 State: PUBLISHED Published: 2021-08-04T00:00:00 Last Updated: 2024-08-04T01:16:03.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_buffer while reading more bytes in APar_read64. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wez/atomicparsley/issues/32 - https://github.com/wez/atomicparsley/commit/d72ccf06c98259d7261e0f3ac4fd8717778782c1 - https://security.gentoo.org/glsa/202305-01
CVE ID: CVE-2021-37234 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:12:59.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pwnlandia/mhn/issues/809
CVE ID: CVE-2021-37253 State: PUBLISHED Published: 2021-12-05T20:28:48 Last Updated: 2024-08-04T01:16:03.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.m-files.com/company/trust-center/vulnerability-disclosure/ - http://seclists.org/fulldisclosure/2021/Dec/1 - http://packetstormsecurity
pany/trust-center/vulnerability-disclosure/ - http://seclists.org/fulldisclosure/2021/Dec/1 - http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html - https://www.tenable.com/cve/CVE-2021-37253 - https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253 - https://www.m-files.com/about/trust-center/security-advisories/cve-2021-37253-denial-of-service/
CVE ID: CVE-2021-37254 State: PUBLISHED Published: 2021-10-28T13:07:33 Last Updated: 2024-08-04T01:16:03.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server. Additional Analyst Notes: - CVE Program Container: References: - https://www.m-files.com/company/trust-center/vulnerability-disclosure/ - https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-37254/
CVE ID: CVE-2021-37262 State: PUBLISHED Published: 2021-12-16T18:07:18 Last Updated: 2024-08-04T01:16:04.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jflyfox/jfinal_cms/issues/23
CVE ID: CVE-2021-37267 State: PUBLISHED Published: 2021-09-28T18:14:19 Last Updated: 2024-08-04T01:16:04.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to obtain user cookie information. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/3257066
CVE ID: CVE-2021-37270 State: PUBLISHED Published: 2021-09-27T20:40:54 Last Updated: 2024-08-04T01:16:03.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2815129 - https://github.com/purple-WL/S-cms-Unauthorized
CVE ID: CVE-2021-37271 State: PUBLISHED Published: 2021-09-28T18:09:07 Last Updated: 2024-08-04T01:16:03.743Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in UEditor v1.4.3.3, which can be exploited by an attacker to obtain user cookie information. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/3243916 - https://www.freebuf.com/vuls/269956.html
CVE ID: CVE-2021-37273 State: PUBLISHED Published: 2021-09-28T18:00:01 Last Updated: 2024-08-04T01:16:04.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service issue exists in China Telecom Corporation EPON Tianyi Gateway ZXHN F450(EPON ONU) 3.0. Tianyi Gateway is a hardware terminal of "Optical Modem Smart Router." Attackers can use this vulnerability to restart the device multiple times. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2958526
CVE ID: CVE-2021-37274 State: PUBLISHED Published: 2021-09-27T20:56:41 Last Updated: 2024-08-04T01:16:03.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kingdee KIS Professional Edition has a privilege escalation vulnerability. Attackers can use the vulnerability to gain computer administrator rights via unspecified loopholes. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2740765 - https://github.com/purple-WL/CNVD-2020-75301/issues/1
CVE ID: CVE-2021-37289 State: PUBLISHED Published: 2022-08-22T14:34:20 Last Updated: 2024-08-04T01:16:03.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp. Additional Analyst Notes: - CVE Program Container: References: - http://www.planex.co.jp/products/mzk-dp150n/ - https://jvn.jp/en/vu/JVNVU98291763/ - https://samy.link/blog/a-hidden-web-shell-in-the-plug-in-wireless-planex-mzk-dp150n
CVE ID: CVE-2021-37291 State: PUBLISHED Published: 2022-04-11T18:03:58 Last Updated: 2024-08-04T01:16:03.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ - http://www.kevinlab.com
CVE ID: CVE-2021-37292 State: PUBLISHED Published: 2022-04-11T18:13:14 Last Updated: 2024-08-04T01:16:03.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ - http://www.kevinlab.com
CVE ID: CVE-2021-37293 State: PUBLISHED Published: 2022-04-11T18:08:30 Last Updated: 2024-08-04T01:16:03.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ - http://www.kevinlab.com
CVE ID: CVE-2021-37298 State: REJECTED Published: 2021-12-06T20:22:58 Last Updated: 2022-08-12T15:22:47 Description: No description available.
CVE ID: CVE-2021-37304 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:12:05.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jeecgboot/jeecg-boot/issues/2793
CVE ID: CVE-2021-37305 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T18:29:28.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jeecgboot/jeecg-boot/issues/2794
CVE ID: CVE-2021-37306 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T18:30:04.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: api uri:/sys/user/checkOnlyUser?username=admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jeecgboot/jeecg-boot/issues/2794
CVE ID: CVE-2021-37311 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T18:30:32.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in fcitx5 5.0.8 allows attackers to cause a denial of service via crafted message to the application's listening port. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fcitx-im.org - https://github.com/fcitx/fcitx5/pull/308
CVE ID: CVE-2021-37315 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T20:44:18.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the source for COPY and MOVE operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://robertchen.cc/blog/2021/03/31/asus-rce
CVE ID: CVE-2021-37316 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T18:51:42.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive information via /etc/shadow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://robertchen.cc/blog/2021/03/31/asus-rce
CVE ID: CVE-2021-37317 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T18:49:26.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the target for COPY and MOVE operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://robertchen.cc/blog/2021/03/31/asus-rce
CVE ID: CVE-2021-37322 State: PUBLISHED Published: 2021-11-18T21:11:21 Last Updated: 2024-08-04T01:16:03.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c. Additional Analyst Notes: - CVE Program Container: References: - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99188
CVE ID: CVE-2021-37326 State: PUBLISHED Published: 2021-08-15T15:06:18 Last Updated: 2024-08-04T01:16:03.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetSarang Xshell 7 before Build 0077 includes unintended code strings in paste operations. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsarang.com/en/xshell-update-history/
CVE ID: CVE-2021-37330 State: PUBLISHED Published: 2021-10-04T13:35:50 Last Updated: 2024-08-04T01:16:03.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting (XSS). The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigger. Additional Analyst Notes: - CVE Program Container: References: - https://www.navidkagalwalla.com/booking-core-vulnerabilities
CVE ID: CVE-2021-37331 State: PUBLISHED Published: 2021-10-04T13:37:30 Last Updated: 2024-08-04T01:16:03.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control. On the Verifications page, after uploading an ID Card or Trade License and viewing it, ID Cards and Trade Licenses of other vendors/users can be viewed by changing the URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.navidkagalwalla.com/booking-core-vulnerabilities
CVE ID: CVE-2021-37333 State: PUBLISHED Published: 2021-10-04T13:39:03 Last Updated: 2024-08-04T01:16:03.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.navidkagalwalla.com/booking-core-vulnerabilities
CVE ID: CVE-2021-37334 State: PUBLISHED Published: 2021-08-25T21:16:01 Last Updated: 2024-08-04T01:16:03.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a temporary directory. By default, files are stored within the application directory structure at %BASEDIR%/APP_DATA/TEMP/FileUploads/. Whilst access to this directory is restricted by the root web.config file, it is possible to override th
P/FileUploads/. Whilst access to this directory is restricted by the root web.config file, it is possible to override this restriction by uploading another specially crafted web.config file to the temporary directory. It is possible to exploit this flaw to upload a malicious script file to execute arbitrary code and system commands on the server. Additional Analyst Notes: - CVE Program Container: References: - https://umbraco.com/blog/security-advisory-security-patches-for-umbraco-forms-ready-on-july-20th-2021-at-7-am-utc/ - https://umbraco.com/blog/security-advisory-20th-of-july-2021-patch-is-now-available/
CVE ID: CVE-2021-37343 State: PUBLISHED Published: 2021-08-13T11:32:28 Last Updated: 2024-08-04T01:16:04.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - http://packetstormsecurity.com/files/165978/Nagios-XI-Autodiscovery-Shell-Upload.html
CVE ID: CVE-2021-37344 State: PUBLISHED Published: 2021-08-13T11:32:19 Last Updated: 2024-08-04T01:16:03.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection). Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/