Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-35687 State: PUBLISHED Published: 2022-01-19T11:21:48 Last Updated: 2024-09-24T20:33:07.898Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Oracle Corporation Products: Financial Services Analytical Applications Infrastructure Problem Types: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data. Description: Vulnerability in the Oracle Financial Serv
Services Analytical Applications Infrastructure accessible data. Description: Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Unified Metadata Manager). Supported versions that are affected are 8.0.7-8.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality i
le Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-35689 State: PUBLISHED Published: 2022-02-24T00:25:09 Last Updated: 2024-09-24T14:01:54.307Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Oracle Corporation Products: Oracle Talent Acquisition Cloud - Taleo Enterprise Edition Problem Types: This high severity potential vulnerability allows attackers to perform remote code execution on Taleo Enterprise Edition system. Successful attacks of this vulnerability can result in unauthorized remote code execution within Taleo Enterprise Edition and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. All affected
e a partial denial of service (partial DOS) of Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. All affected customers were notified of CVE-2021-2138 by Oracle Description: A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. This high severity potential vulnerability allows attackers to perform remote code execution on Taleo Enterprise Edition system. Successful attacks of this vulnerability can result in unauthorized remote code execution within Taleo Enterprise Edition and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. All affected customers were notif
f service (partial DOS) of Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. All affected customers were notified of CVE-2021-35689 by Oracle. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html
CVE ID: CVE-2021-35936 State: PUBLISHED Published: 2021-08-16T07:25:11 Last Updated: 2024-08-04T00:40:47.453Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-200 Description: If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e712
es: - CVE Program Container: References: - https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E
CVE ID: CVE-2021-35937 State: PUBLISHED Published: 2022-08-25T00:00:00 Last Updated: 2024-08-04T00:40:47.361Z Vendors: n/a Products: RPM Problem Types: CWE-59 Description: A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://rpm.org/wiki/Releases/4.18.0 - https://bugzilla.redhat.com/show_bug.cgi?id=1964125 - https://access.redhat.com/securi
://rpm.org/wiki/Releases/4.18.0 - https://bugzilla.redhat.com/show_bug.cgi?id=1964125 - https://access.redhat.com/security/cve/CVE-2021-35937 - https://www.usenix.org/legacy/event/sec05/tech/full_papers/borisov/borisov.pdf - https://security.gentoo.org/glsa/202210-22
CVE ID: CVE-2021-35938 State: PUBLISHED Published: 2022-08-25T00:00:00 Last Updated: 2024-08-04T00:40:47.458Z Vendors: n/a Products: RPM Problem Types: CWE-59 Description: A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1964
ility. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1964114 - https://bugzilla.suse.com/show_bug.cgi?id=1157880 - https://access.redhat.com/security/cve/CVE-2021-35938 - https://rpm.org/wiki/Releases/4.18.0 - https://github.com/rpm-software-management/rpm/pull/1919 - https://github.com/rpm-software-management/rpm/commit/25a435e90844ea98fe5eb7bef22c1aecf3a9c033 - https://security.gentoo.org/glsa/202210-22
CVE ID: CVE-2021-35939 State: PUBLISHED Published: 2022-08-26T00:00:00 Last Updated: 2024-08-04T00:40:47.449Z Vendors: n/a Products: RPM Problem Types: CWE-59 Description: It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://rpm.org/wiki/Releases/4.18.0 - https://github.com/rpm-softw
nalyst Notes: - CVE Program Container: References: - https://rpm.org/wiki/Releases/4.18.0 - https://github.com/rpm-software-management/rpm/pull/1919 - https://bugzilla.redhat.com/show_bug.cgi?id=1964129 - https://github.com/rpm-software-management/rpm/commit/96ec957e281220f8e137a2d5eb23b83a6377d556 - https://access.redhat.com/security/cve/CVE-2021-35939 - https://security.gentoo.org/glsa/202210-22
CVE ID: CVE-2021-35940 State: PUBLISHED Published: 2021-08-23T10:00:10 Last Updated: 2024-08-04T00:40:47.582Z Vendors: Apache Software Foundation Products: Apache Portable Runtime (APR) Problem Types: APR apr_time_exp* out of bounds array dereference Description: An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue. Additional Analyst Notes: - CVE Program Container: References: - http://svn.apache.org/viewvc?view=revision&revision=1891198 - http://mail-ar
tes: - CVE Program Container: References: - http://svn.apache.org/viewvc?view=revision&revision=1891198 - http://mail-archives.apache.org/mod_mbox/www-announce/201710.mbox/%3CCACsi251B8UaLvM-rrH9fv57-zWi0zhyF3275_jPg1a9VEVVoxw%40mail.gmail.com%3E - https://dist.apache.org/repos/dist/release/apr/patches/apr-1.7.0-CVE-2021-35940.patch - https://lists.apache.org/thread.html/ra2868b53339a6af65577146ad87016368c138388b09bff9d2860f50e%40%3Cdev.apr.apache.org%3E - https://lists.apache.org/thread.html/ra2868b53339a6af65577146ad87016368c138388b09bff9d2860f50e%40%3Cdev.apr.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/08/23/1 - https://lists.apache.org/thread.html/rb1f3c85f50fbd924a00
3E - http://www.openwall.com/lists/oss-security/2021/08/23/1 - https://lists.apache.org/thread.html/rb1f3c85f50fbd924a0051675118d1609e57957a02ece7facb723155b%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r7bb4a6ed88fc48152174e664aae30ea9a8b058eb5b44cf08cb9beb4b%40%3Cdev.apr.apache.org%3E - https://lists.apache.org/thread.html/r7bb4a6ed88fc48152174e664aae30ea9a8b058eb5b44cf08cb9beb4b%40%3Cdev.httpd.apache.org%3E - https://lists.apache.org/thread.html/r72a069753b9363c29732e59ad8f0d22a633fb6a699980407511ac961%40%3Cdev.apr.apache.org%3E - https://lists.apache.org/thread.html/r317c398ee5736e627f7887b06607e5c58b45a696d352ba8c14615f55%40%3Cdev.apr.apache.org%3E - https://lists.
he.org/thread.html/r317c398ee5736e627f7887b06607e5c58b45a696d352ba8c14615f55%40%3Cdev.apr.apache.org%3E - https://lists.apache.org/thread.html/ra38094406cc38a05218ebd1158187feda021b0c3a1df400bbf296af8%40%3Cdev.apr.apache.org%3E - https://lists.apache.org/thread.html/r72479f4dcffaa8a4732d5a0e87fecc4bace4932e28fc26f7d400e2b3%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r54c755c74b9e3846cfd84039b1967d37d2870750a02d7c603983f6ed%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rafe54755850e93de287c36540972457b2dd86332106aa7817c7c27fb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r1c788464a25fbc046a72aff451bc8186386315d92a2dd034990
0%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r1c788464a25fbc046a72aff451bc8186386315d92a2dd0349903fa4f%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-35941 State: PUBLISHED Published: 2021-06-29T20:22:43 Last Updated: 2024-08-04T00:40:47.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472. Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/productsecurity/wdc-21008-recommended-security-measures-wd-mybooklive-wd-mybookliveduo - https://arstechnica.com/gadgets/2021/06/hackers-exploited-0-day-not-2018-
rity-measures-wd-mybooklive-wd-mybookliveduo - https://arstechnica.com/gadgets/2021/06/hackers-exploited-0-day-not-2018-bug-to-mass-wipe-my-book-live-devices/
CVE ID: CVE-2021-35942 State: PUBLISHED Published: 2021-07-22T00:00:00 Last Updated: 2024-08-04T00:40:47.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/glibc/wiki/Security%20Exceptions - https://sourceware.org/bugzilla/show_bug.cgi?id
References: - https://sourceware.org/glibc/wiki/Security%20Exceptions - https://sourceware.org/bugzilla/show_bug.cgi?id=28011 - https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=5adda61f62b77384718b4c0d8336ade8f2b4b35c - https://security.netapp.com/advisory/ntap-20210827-0005/ - https://security.gentoo.org/glsa/202208-24 - https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
CVE ID: CVE-2021-35943 State: PUBLISHED Published: 2021-09-29T19:17:10 Last Updated: 2024-08-04T00:40:47.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513. Additional Analyst Notes: - CVE Program Container: References: - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts
CVE ID: CVE-2021-35944 State: PUBLISHED Published: 2021-09-29T19:26:33 Last Updated: 2024-08-04T00:40:47.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. Additional Analyst Notes: - CVE Program Container: References: - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts
CVE ID: CVE-2021-35945 State: PUBLISHED Published: 2021-09-29T19:11:59 Last Updated: 2024-08-04T00:47:42.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. Additional Analyst Notes: - CVE Program Container: References: - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts
CVE ID: CVE-2021-35946 State: PUBLISHED Published: 2021-09-07T19:04:19 Last Updated: 2024-08-04T00:47:42.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions. Additional Analyst Notes: - CVE Program Container: References: - https://doc.owncloud.com/server/admin_manual/release_notes.html - https://owncloud.com/security-advisories/cve-2021-35946/
CVE ID: CVE-2021-35947 State: PUBLISHED Published: 2021-09-07T18:49:54 Last Updated: 2024-08-04T00:47:42.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL. Additional Analyst Notes: - CVE Program Container: References: - https://doc.owncloud.com/server/admin_manual/release_notes.html - https://owncloud.com/security-advisories/cve-2021-35947/
CVE ID: CVE-2021-35948 State: PUBLISHED Published: 2021-09-07T19:08:12 Last Updated: 2024-08-04T00:47:42.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie. Additional Analyst Notes: - CVE Program Container: References: - https://doc.owncloud.com/server/admin_manual/release_notes.html - https://owncloud.com/security-advisories/cve-2021-35948/
CVE ID: CVE-2021-35949 State: PUBLISHED Published: 2021-09-07T18:59:40 Last Updated: 2024-08-04T00:47:42.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share. Additional Analyst Notes: - CVE Program Container: References: - https://doc.owncloud.com/server/admin_manual/release_notes.html - https://owncloud.com/security-advisories/cve-2021-35949/
CVE ID: CVE-2021-35951 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T18:30:26.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via BLE and brick the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fastrack.in/shop/watch-smart-wearables-reflex-2 - https://payatu.com/advisory/fastrack-reflex-unauthenticated-firmware-update
CVE ID: CVE-2021-35952 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T18:30:06.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Characteristics on handle 0x0017. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fastrack.in/shop/watch-smart-wearables-reflex-2 - https://payatu.com/advisory/lack-of-bluetooth-le-pairing-fastrack-reflex
CVE ID: CVE-2021-35953 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T18:29:40.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted choices of the last three bytes of a characteristic value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fastrack.in/shop/watch-smart-wearables-reflex-2 - https://payatu.com/advisory/device-crash-fastrack-reflex-two-activity-tracker
CVE ID: CVE-2021-35954 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T18:29:00.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick the device via the Serial Wire Debug (SWD) feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fastrack.in/shop/watch-smart-wearables-reflex-2 - https://payatu.com/advisory/dumping-and-re-flashing-firmware-fastrack-reflex
CVE ID: CVE-2021-35955 State: PUBLISHED Published: 2021-08-12T14:33:44 Last Updated: 2024-08-04T00:47:42.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7. Additional Analyst Notes: - CVE Program Container: References: - https://contao.org/en/news/contao-4-9-16-and-4-11-5-are-available.html - https://github.com/contao/contao/security/advisories/GHSA-hr3h-x6gq-rqcp
CVE ID: CVE-2021-35956 State: PUBLISHED Published: 2021-06-30T11:46:22 Last Updated: 2024-08-04T00:47:42.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.akcp.com/support-center/customer-login/sensor-probe-firmware-changelog/ - http://www.akcp.in.th/downloads/Firmwares/SP480-20210624.zip - https://tbutler.org/2021/06/28/cve-2021-35956 - http:
/ - http://www.akcp.in.th/downloads/Firmwares/SP480-20210624.zip - https://tbutler.org/2021/06/28/cve-2021-35956 - http://packetstormsecurity.com/files/163343/AKCP-sensorProbe-SPX476-Cross-Site-Scripting.html
CVE ID: CVE-2021-35957 State: PUBLISHED Published: 2021-07-13T13:05:26 Last Updated: 2024-08-04T00:47:43.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs (in %WINDIR%\system32) with malicious ones. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu - https://advisories.stormshield.eu/2021-045/
CVE ID: CVE-2021-35958 State: PUBLISHED Published: 2021-06-30T00:12:53 Last Updated: 2024-08-04T00:47:42.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.get_file is not intended for untrusted archives Additional Analyst Notes: - CVE Program Container: References: - https://vuln.ryotak.me/advisories/52 - https://github.com/tensorflow/tensorflow/blob/b8cad4c631096a34461ff8a07840d5f4d123ce32/tensorflow/python/keras/utils/data_utils.py#L137 - https://docs.python.org/3/library/tarfile
a34461ff8a07840d5f4d123ce32/tensorflow/python/keras/utils/data_utils.py#L137 - https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall - https://keras.io/api/ - https://github.com/tensorflow/tensorflow/blob/b8cad4c631096a34461ff8a07840d5f4d123ce32/tensorflow/python/keras/README.md
CVE ID: CVE-2021-35959 State: PUBLISHED Published: 2021-06-30T00:41:54 Last Updated: 2024-08-04T00:47:42.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20210518/stored-xss-in-folder-contents - http://www.openwall.com/lists/oss-security/2021/06/30/2
CVE ID: CVE-2021-35961 State: PUBLISHED Published: 2021-07-16T15:20:34.752694Z Last Updated: 2024-09-17T01:16:12.106Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TAIWAN SECOM CO., LTD., Products: Door Access Control and Personnel Attendance Management system Problem Types: CWE-798 Description: Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4905-c99ac-1.html - https://www.cht
st Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4905-c99ac-1.html - https://www.chtsecurity.com/news/2e4e69d5-2e32-4f73-ac7e-a66432e020e4
CVE ID: CVE-2021-35962 State: PUBLISHED Published: 2021-07-16T15:20:35.841000Z Last Updated: 2024-09-16T17:44:17.942Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TAIWAN SECOM CO., LTD., Products: Door Access Control and Personnel Attendance Management system Problem Types: CWE-22 Description: Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can apply Path Traversal means to download credential files from the system without permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4906-89381-1.html - ht
itional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4906-89381-1.html - https://www.chtsecurity.com/news/d7ec2db9-12dd-439f-b014-b956ce231054