Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
l/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E - https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E - https://lists.apache.org/thread.html/red01829efa2a8c893c4baff4f23c9312bd938543a9b8658e172b853b%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/07/12/1 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-30130 State: PUBLISHED Published: 2021-04-06T00:00:00 Last Updated: 2024-08-03T22:24:59.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpseclib/phpseclib/pull/1635 - https://github.com/phpseclib/phpseclib/releases/tag/3.0.7 - https://github.com/phpseclib/phpseclib/releases/tag/2.0.31 - https://lists.debian.org/debian-lts-announce/2022/11/msg00024.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00025.html
CVE ID: CVE-2021-30132 State: PUBLISHED Published: 2021-11-08T13:07:17 Last Updated: 2024-08-03T22:24:59.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges. Additional Analyst Notes: - CVE Program Container: References: - https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html - https://my.cloudera.com/knowledge/TSB-2021-491-Authorization-Bypass-in-Cloudera-Manager?id=314482
CVE ID: CVE-2021-30133 State: PUBLISHED Published: 2021-06-09T14:33:39 Last Updated: 2024-08-03T22:24:59.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10. Additional Analyst Notes: - CVE Program Container: References: - https://support.cloverdx.com/releases/ - https://support1.cloverdx.com/hc/en-us/articles/360021006520
CVE ID: CVE-2021-30134 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T18:31:38.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0b547728-27d2-402e-ae17-90d539344ec7
CVE ID: CVE-2021-30137 State: PUBLISHED Published: 2021-09-15T12:35:09 Last Updated: 2024-08-03T22:24:59.579Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AC:H/AV:N/A:H/C:L/I:L/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2021-30137.pdf
CVE ID: CVE-2021-30138 State: REJECTED Published: 2021-04-15T15:13:36 Last Updated: 2021-04-15T15:13:36 Description: No description available.
CVE ID: CVE-2021-30139 State: PUBLISHED Published: 2021-04-21T15:14:55 Last Updated: 2024-08-03T22:24:59.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10741 - https://gitlab.alpinelinux.org/alpine/aports/-/issues/12606
CVE ID: CVE-2021-30140 State: PUBLISHED Published: 2021-04-06T15:46:55 Last Updated: 2024-08-03T22:24:59.540Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content), the payload is executed upon a click. This is fixed in 3.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.tempest.com.br - https://liquidfiles.com/support.html - https://gist.github.com/rodnt/
tainer: References: - https://www.tempest.com.br - https://liquidfiles.com/support.html - https://gist.github.com/rodnt/9f7d368fac38cafa7334598ec94fb167 - http://seclists.org/fulldisclosure/2022/May/41 - http://packetstormsecurity.com/files/167228/LiquidFiles-3.4.15-Cross-Site-Scripting.html
CVE ID: CVE-2021-30141 State: PUBLISHED Published: 2021-04-05T22:44:54 Last Updated: 2024-08-03T22:24:59.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an attempted access to an array offset on a value of type null, and excessive memory consumption. NOTE: the vendor states "the feature still requires a valid authentication cookie even if the route is accessible to non-logged users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/friendica/friendica/issues/10110 - https://github.co
richment: - CVE Program Container: References: - https://github.com/friendica/friendica/issues/10110 - https://github.com/friendica/friendica/pull/10113/commits/acbcc56754121ba080eac5b6fdf69e64ed7fe453
CVE ID: CVE-2021-30144 State: PUBLISHED Published: 2021-04-06T04:40:38 Last Updated: 2024-08-03T22:24:59.521Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the connected users, and the users in the tech category. For example, plugins/dashboard/front/main2.php can be used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/dashboard-plugin - https://plugins.glpi-project.org/#/plugin/d
tps://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/dashboard-plugin - https://plugins.glpi-project.org/#/plugin/dashboard
CVE ID: CVE-2021-30145 State: PUBLISHED Published: 2021-05-18T13:34:53 Last Updated: 2024-08-03T22:24:59.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file. Additional Analyst Notes: - CVE Program Container: References: - https://mpv.io - https://github.com/mpv-player/mpv/releases/tag/v0.33.1 - https://devel0pment.de/?p=2217 - https://github.com/mpv-player/mpv/commit/d0c530919d8cd4d7a774e38ab064e0fabdae34e6 - https://security.gentoo.org/glsa/202107-46
CVE ID: CVE-2021-30146 State: PUBLISHED Published: 2021-04-06T15:51:43 Last Updated: 2024-08-03T22:24:59.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Security-AVS/CVE-2021-30146
CVE ID: CVE-2021-30147 State: PUBLISHED Published: 2021-04-07T02:02:53 Last Updated: 2024-08-03T22:24:59.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://dmasoftlab.com/ - https://github.com/1d8/publications/tree/main/cve-2021-30147 - http://packetstormsecurity.com/files/162136/DMA-Radius-Manager-4.4.0-Cross-Site-Request-Forgery.html
CVE ID: CVE-2021-30149 State: PUBLISHED Published: 2021-04-06T05:40:57 Last Updated: 2024-08-03T22:24:59.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: Composr 10.0.36 allows upload and execution of PHP files. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/composr-foundation/composr/commit/a71c44e03 - http://packetstormsecurity.com/files/162128/Composr-10.0.36-Shell-Upload.html
CVE ID: CVE-2021-30150 State: PUBLISHED Published: 2021-04-06T05:40:38 Last Updated: 2024-08-03T22:24:59.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: Composr 10.0.36 allows XSS in an XML script. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/composr-foundation/composr/commit/833a06466 - http://packetstormsecurity.com/files/162111/Composr-CMS-10.0.36-Cross-Site-Scripting.html
CVE ID: CVE-2021-30151 State: PUBLISHED Published: 2021-04-06T00:00:00 Last Updated: 2024-08-03T22:24:59.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mperham/sidekiq/issues/4852 - https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html - https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html
CVE ID: CVE-2021-30152 State: PUBLISHED Published: 2021-04-09T06:08:35 Last Updated: 2024-08-03T22:24:59.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T270713 - https://www.debian.org/security/2021/dsa-4889 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - ht
edoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html - https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html - https://security.gentoo.org/glsa/202107-40
CVE ID: CVE-2021-30153 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T16:16:20.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T270453 - https://lists.wikimedia.org/pipermail/wikit
ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T270453 - https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html - https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/message/XYBF5RSTJRMVCP7QBYK7643W75A3KCIY/
CVE ID: CVE-2021-30154 State: PUBLISHED Published: 2021-04-06T06:43:51 Last Updated: 2024-08-03T22:24:59.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T278014 - https://www.debian.org/security/2021/dsa-4889 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - https://lists.fedoraproject.org/archive
e-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/ - https://security.gentoo.org/glsa/202107-40
CVE ID: CVE-2021-30155 State: PUBLISHED Published: 2021-04-09T06:09:46 Last Updated: 2024-08-03T22:24:59.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T270988 - https://www.debian.org/security/2021/dsa-4889 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - https://lists.fedorap
chives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html - https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html - https://security.gentoo.org/glsa/202107-40
CVE ID: CVE-2021-30156 State: PUBLISHED Published: 2021-04-09T06:10:16 Last Updated: 2024-08-03T22:24:59.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T276306 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
CVE ID: CVE-2021-30157 State: PUBLISHED Published: 2021-04-06T06:43:05 Last Updated: 2024-08-03T22:24:59.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T278058 - https://www.debian.org/security/2021/dsa-4889 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJ
1/dsa-4889 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/ - https://security.gentoo.org/glsa/202107-40
CVE ID: CVE-2021-30158 State: PUBLISHED Published: 2021-04-06T06:42:45 Last Updated: 2024-08-03T22:24:59.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T277009 - https://www.debian.org/security/2021/dsa-48
Program Container: References: - https://phabricator.wikimedia.org/T277009 - https://www.debian.org/security/2021/dsa-4889 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html - https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html - https://security.gentoo.org/glsa/202107-40
CVE ID: CVE-2021-30159 State: PUBLISHED Published: 2021-04-09T06:12:55 Last Updated: 2024-08-03T22:24:59.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal()
non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T272386 - https://www.debian.org/security/2021/dsa-4889 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html - https://lists.de
OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html - https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html - https://security.gentoo.org/glsa/202107-40
CVE ID: CVE-2021-30161 State: PUBLISHED Published: 2021-04-06T07:18:40 Last Updated: 2024-08-03T22:24:59.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 11 software. Attackers can bypass the lockscreen protection mechanism after an incoming call has been terminated. The LG ID is LVE-SMP-210002 (April 2021). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2021-30162 State: PUBLISHED Published: 2021-04-06T07:18:19 Last Updated: 2024-08-03T22:24:59.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. Attackers can leverage ISMS services to bypass access control on specific content providers. The LG ID is LVE-SMP-210003 (April 2021). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2021-30163 State: PUBLISHED Published: 2021-04-06T07:59:55 Last Updated: 2024-08-03T22:24:59.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values. Additional Analyst Notes: - CVE Program Container: References: - https://www.redmine.org/projects/redmine/wiki/Security_Advisories - https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
CVE ID: CVE-2021-30164 State: PUBLISHED Published: 2021-04-06T07:58:51 Last Updated: 2024-08-03T22:24:59.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API. Additional Analyst Notes: - CVE Program Container: References: - https://www.redmine.org/projects/redmine/wiki/Security_Advisories - https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
CVE ID: CVE-2021-30165 State: PUBLISHED Published: 2021-04-27T03:07:36.944710Z Last Updated: 2024-09-17T00:21:26.883Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: EDIMAX Technology Co., Ltd. Products: IC-3140W Problem Types: CWE-798 Description: The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privileged permission and further control the devices. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4670-359c8-1.html
CVE ID: CVE-2021-30166 State: PUBLISHED Published: 2021-04-28T09:30:43.337788Z Last Updated: 2024-09-17T03:43:51.586Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MERIT LILIN ENT.CO.,LTD. Products: P2/Z2/P3/Z3 IP camera firmware Problem Types: CWE-78 Description: The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html - https://www.meritlilin.com/assets/uploads
ntainer: References: - https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html - https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf - https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e - https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388
CVE ID: CVE-2021-30167 State: PUBLISHED Published: 2021-04-28T09:30:44.048207Z Last Updated: 2024-09-17T02:32:23.031Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MERIT LILIN ENT.CO.,LTD. Products: P2/Z2/P3/Z3 IP camera firmware Problem Types: CWE-522 Description: The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html - https://www.meritlilin.com/assets/uploads/support/file/M001
s: - https://www.twcert.org.tw/tw/cp-132-4676-391a5-1.html - https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf - https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e - https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388
CVE ID: CVE-2021-30168 State: PUBLISHED Published: 2021-04-28T09:30:44.741131Z Last Updated: 2024-09-16T20:48:03.812Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MERIT LILIN ENT.CO.,LTD. Products: P2/Z2/P3/Z3 IP camera firmware Problem Types: CWE-200 Description: The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices. Additional Analyst Notes: - CVE Program Container: References: - https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf - https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e - https://www.chtsecur
ads/support/file/M00166-TW.pdf - https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e - https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388 - https://www.twcert.org.tw/tw/cp-132-4678-aad70-1.html