Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-42775 State: PUBLISHED Published: 2021-11-12T01:21:46 Last Updated: 2024-08-04T03:38:50.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a vulnerability in the remote firmware download feature that could allow a user to place or replace an arbitrary file on the remote host. In non-secure mode, the user is unauthenticated. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager - https://docs.broadcom.com/doc/elx_H
w.broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager - https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf
CVE ID: CVE-2021-42776 State: PUBLISHED Published: 2021-12-01T16:25:40 Last Updated: 2024-08-04T03:38:50.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import. Additional Analyst Notes: - CVE Program Container: References: - https://support.cloverdx.com/releases/ - https://support1.cloverdx.com/hc/en-us/articles/4411125429010
CVE ID: CVE-2021-42777 State: PUBLISHED Published: 2022-10-29T00:00:00.000Z Last Updated: 2025-05-07T13:21:05.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application server or a user's local machine, as demonstrated by System.Diagnostics.Process.Start. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://burninatorsec.blogspot.com/2022/04/library-rce-object-chaining-cve-2021.html
CVE ID: CVE-2021-42778 State: PUBLISHED Published: 2022-04-18T16:20:39.000Z Last Updated: 2025-11-03T21:45:26.027Z Vendors: n/a Products: opensc Problem Types: CWE-672 Description: A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185 - https://bugzilla.redhat.com/show_bug.cgi?id=2016083 - https://github.com/OpenSC/OpenSC/commit/f015746d - https://security.gentoo.org/glsa/202209-03
CVE ID: CVE-2021-42779 State: PUBLISHED Published: 2022-04-18T00:00:00.000Z Last Updated: 2025-11-03T21:45:27.939Z Vendors: n/a Products: opensc Problem Types: CWE-416 Description: A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28843 - https://bugzilla.redhat.com/show_bug.cgi?id=2016086 - https://github.com/OpenSC/OpenSC/commit/1db88374 - https://security.gentoo.org/glsa/202209-03 - https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html
CVE ID: CVE-2021-42780 State: PUBLISHED Published: 2022-04-18T00:00:00.000Z Last Updated: 2025-11-03T21:45:29.452Z Vendors: n/a Products: opensc Problem Types: CWE-252 Description: A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383 - https://bugzilla.redhat.com/show_bug.cgi?id=2016139 - https://github.com/OpenSC/OpenSC/commit/5df913b7 - https://security.gentoo.org/glsa/202209-03 - https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html
CVE ID: CVE-2021-42781 State: PUBLISHED Published: 2022-04-18T00:00:00.000Z Last Updated: 2025-11-03T21:45:30.959Z Vendors: n/a Products: opensc Problem Types: CWE-119 Description: Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2016439 - https://github.com/OpenSC/OpenSC/commit/17d8980c - https://github.com/OpenSC/OpenSC/commit/40c50a3a - https://github.com/OpenSC/OpenSC/commit/05648b06 - https://github.com/OpenSC/OpenSC/commit/5d4daf6c - https://github.com/OpenSC/OpenSC/commit/cae5c71
nSC/commit/05648b06 - https://github.com/OpenSC/OpenSC/commit/5d4daf6c - https://github.com/OpenSC/OpenSC/commit/cae5c71f - https://security.gentoo.org/glsa/202209-03 - https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html
CVE ID: CVE-2021-42782 State: PUBLISHED Published: 2022-04-18T00:00:00.000Z Last Updated: 2025-11-03T21:45:32.737Z Vendors: n/a Products: opensc Problem Types: CWE-119 Description: Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2016448 - https://github.com/OpenSC/OpenSC/commit/78cdab94 - https://github.com/OpenSC/OpenSC/commit/7114fb71 - https://github.com/OpenSC/OpenSC/commit/1252aca9 - https://github.com/OpenSC/OpenSC/commit/ae1cf0be - https://github.com/OpenSC/OpenSC/commit/456ac566
C/commit/1252aca9 - https://github.com/OpenSC/OpenSC/commit/ae1cf0be - https://github.com/OpenSC/OpenSC/commit/456ac566 - https://security.gentoo.org/glsa/202209-03 - https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html
CVE ID: CVE-2021-42783 State: PUBLISHED Published: 2021-11-23T21:37:56 Last Updated: 2024-08-04T03:38:50.215Z Vendors: D-Link Products: DWR-932C E1 Problem Types: CWE-306 Description: Missing Authentication for Critical Function vulnerability in debug_post_set.cgi of D-Link DWR-932C E1 firmware allows an unauthenticated attacker to execute administrative actions. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10246
CVE ID: CVE-2021-42784 State: PUBLISHED Published: 2021-11-23T21:37:35 Last Updated: 2024-08-04T03:38:50.209Z Vendors: D-Link Products: DWR-932C E1 Problem Types: CWE-78 Description: OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10246
CVE ID: CVE-2021-42785 State: PUBLISHED Published: 2021-11-23T21:37:07 Last Updated: 2024-08-04T03:38:50.226Z Vendors: GlavSoft LLC Products: TightVNC Viewer Problem Types: CWE-120 Description: Buffer Overflow vulnerability in tvnviewer.exe of TightVNC Viewer allows a remote attacker to execute arbitrary instructions via a crafted FramebufferUpdate packet from a VNC server. Additional Analyst Notes: - CVE Program Container: References: - https://www.tightvnc.com/whatsnew.php
CVE ID: CVE-2021-42786 State: PUBLISHED Published: 2022-03-09T16:51:32.667478Z Last Updated: 2024-09-17T04:10:02.066Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Aternity Products: SteelCentral AppInternals Dynamic Sampling Agent Problem Types: CWE-20 Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple instances of the API requests. The affected endpoints do not have any input validation of the user's input that allowed a malicious payload to be injected. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuc
to be injected. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/article/Remote-Code-Execution-at-AgentControllerServlet-CVE-2021-42786
CVE ID: CVE-2021-42787 State: PUBLISHED Published: 2022-03-09T16:51:50.594465Z Last Updated: 2024-09-16T22:35:02.277Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Aternity Products: SteelCentral AppInternals Dynamic Sampling Agent Problem Types: CWE-20 Description: It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/configuration" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected. Additional Analyst Notes: - CVE Program Container: References: -
s input that allows a malicious payload to be injected. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Write-Delete-Partial-Read-at-AgentConfigurationServlet-CVE-2021-42787
CVE ID: CVE-2021-42791 State: PUBLISHED Published: 2022-01-28T13:01:22 Last Updated: 2024-08-04T03:38:50.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user's login certificate. Additional Analyst Notes: - CVE Program Container: References: - https://www.compass
accepting user's login certificate. Additional Analyst Notes: - CVE Program Container: References: - https://www.compass-security.com/en/research/advisories - https://www.veridiumid.com/press/veridium-eliminates-passwords-with-veridiumad-for-enterprises-using-microsoft-active-directory/ - https://www.compass-security.com/fileadmin/Research/Advisories/2022_03_CSNC-2021-017_VeridiumId_Broken_Access_Control.txt
CVE ID: CVE-2021-42792 State: REJECTED Published: N/A Last Updated: 2023-02-09T00:00:00 Description: No description available.
CVE ID: CVE-2021-42793 State: REJECTED Published: N/A Last Updated: 2023-02-09T00:00:00 Description: No description available.
CVE ID: CVE-2021-42794 State: PUBLISHED Published: 2023-12-16T00:00:00 Last Updated: 2024-08-04T03:38:50.234Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/docs/english/17254-connection-string-parameter-pollution-attacks.pdf - https://www.aveva.com/en/products/edge/
t-db.com/docs/english/17254-connection-string-parameter-pollution-attacks.pdf - https://www.aveva.com/en/products/edge/ - https://www.cisa.gov/news-events/ics-advisories/icsa-22-326-01
CVE ID: CVE-2021-42796 State: PUBLISHED Published: 2023-12-16T00:00:00 Last Updated: 2024-10-07T15:28:19.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.aveva.com/en/products/edge/ - https://www.cisa.gov/news-events/ics-advisories/icsa-22-326-01
CVE ID: CVE-2021-42797 State: PUBLISHED Published: 2023-12-16T00:00:00 Last Updated: 2024-08-04T03:38:50.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources. Additional Analyst Notes: - CVE Program Container: References: - https://www.aveva.com/en/products/edge/ - https://www.cisa.gov/news-events/ics-advisories/icsa-22-326-01
CVE ID: CVE-2021-42808 State: PUBLISHED Published: 2021-12-20T20:19:10 Last Updated: 2024-08-04T03:38:50.145Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Thales Products: Sentinel Protection Installer Problem Types: CWE-284 Description: Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cpl.thalesgroup.com/fr/software-monetization/security-updates
CVE ID: CVE-2021-42809 State: PUBLISHED Published: 2021-12-20T20:19:09 Last Updated: 2024-08-04T03:38:50.212Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Thales Products: Sentinel Protection Installer Problem Types: CWE-913 Description: Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://cpl.thalesgroup.com/fr/software-monetization/security-updates
CVE ID: CVE-2021-42810 State: PUBLISHED Published: 2022-01-19T17:12:02.882172Z Last Updated: 2024-09-17T01:41:35.480Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Thales Products: SafeNet Authentication Service Problem Types: CWE-336 Description: A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed. Additional Analyst Notes: - CVE Program Container: References: - https://cpl.thalesgroup.com/support/security-updates - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md
CVE ID: CVE-2021-42811 State: PUBLISHED Published: 2022-06-10T10:20:32.246272Z Last Updated: 2024-09-16T21:08:15.842Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Thales DIS Products: SafeNet KeySecure Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed. Additional Analyst Notes: - CVE Program Container: References: - https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=9278cada973f45509fd638d3f153afff&sysparm_article=KB0025953
CVE ID: CVE-2021-42833 State: PUBLISHED Published: 2022-02-07T19:01:29.628096Z Last Updated: 2024-09-17T03:37:42.337Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xpsa-aquaview-v5.0.pdf - https://www.cisa.gov/uscert/ics/advisories/icsa-21-350-01
CVE ID: CVE-2021-42835 State: PUBLISHED Published: 2021-12-08T14:34:35 Last Updated: 2024-08-04T03:38:50.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local, or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM). Additional Analyst Notes: - CVE
his code execution is in the context of the Plex update service (which runs as SYSTEM). Additional Analyst Notes: - CVE Program Container: References: - https://www.plex.tv/media-server-downloads/ - https://bugsec.com/experts_teams/ - https://ir-on.io/2021/12/02/local-privilege-plexcalation/ - https://forums.plex.tv/t/security-regarding-cve-2021-42835/761510
CVE ID: CVE-2021-42836 State: PUBLISHED Published: 2021-10-22T17:22:47 Last Updated: 2024-08-04T03:38:50.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tidwall/gjson/issues/236 - https://github.com/tidwall/gjson/issues/237 - https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96 - https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3 - https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944
CVE ID: CVE-2021-42837 State: PUBLISHED Published: 2021-11-05T17:20:39 Last Updated: 2024-08-04T03:38:50.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login page. Any valid user from the SAML/OAuth provider can be used as the username with an arbitrary password, and login will succeed. Additional Analyst Notes: - CVE Program Container: References: - https://www.talend.com/resources/ - https://jira.talendforge.org/browse/TAPACHE-180
CVE ID: CVE-2021-42838 State: PUBLISHED Published: 2021-11-15T09:30:18.944661Z Last Updated: 2024-09-17T03:33:13.463Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Grand Vice info Co. Products: webopac7 Problem Types: CWE-79 Description: Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5286-b92c8-1.html
CVE ID: CVE-2021-42839 State: PUBLISHED Published: 2021-11-15T09:30:20.399218Z Last Updated: 2024-09-17T04:09:15.578Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Grand Vice info Co. Products: webopac7 Problem Types: CWE-434 Description: Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5288-9d546-1.html
CVE ID: CVE-2021-42840 State: PUBLISHED Published: 2021-10-22T18:20:23 Last Updated: 2024-08-04T03:38:50.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328. Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19 - https://github.com/rapid7/m
Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19 - https://github.com/rapid7/metasploit-framework/commits/master/modules/exploits/linux/http/suitecrm_log_file_rce.rb - https://suitecrm.com/time-to-upgrade-suitecrm-7-11-19-7-10-30-lts-released/ - https://theyhack.me/SuiteCRM-RCE-2/ - http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html
CVE ID: CVE-2021-42841 State: PUBLISHED Published: 2022-01-06T20:04:34 Last Updated: 2024-08-04T03:38:50.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabiliti
als. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/210416
CVE ID: CVE-2021-42847 State: PUBLISHED Published: 2021-11-11T00:00:00 Last Updated: 2024-08-04T03:38:50.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/en/community/topic/fix-released-for-a-vulnerability-in-manageengine-adaudit-plus - http://packetstormsecurity.com/files/172258/ManageEngine-ADAudit-Plus-Remote-Code-Execution.html
CVE ID: CVE-2021-42848 State: PUBLISHED Published: 2022-05-18T16:10:27 Last Updated: 2024-08-04T03:38:50.160Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Lenovo Products: Personal Cloud Storage A1, Personal Cloud Storage T1, Personal Cloud Storage X1, Personal Cloud Storage T2, Personal Cloud Storage T2Pro Problem Types: CWE-862 Description: An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_200017.html
CVE ID: CVE-2021-42849 State: PUBLISHED Published: 2022-05-18T16:10:28 Last Updated: 2024-08-04T03:38:50.219Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Personal Cloud Storage A1, Personal Cloud Storage T1, Personal Cloud Storage X1, Personal Cloud Storage T2, Personal Cloud Storage T2Pro Problem Types: CWE-798 Description: A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_200017.html
CVE ID: CVE-2021-42850 State: PUBLISHED Published: 2022-05-18T16:10:30 Last Updated: 2024-08-04T03:38:50.139Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Personal Cloud Storage A1, Personal Cloud Storage T1, Personal Cloud Storage X1, Personal Cloud Storage T2, Personal Cloud Storage T2Pro Problem Types: CWE-798 Description: A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.c
hysical or local network access. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_200017.html
CVE ID: CVE-2021-42851 State: PUBLISHED Published: 2022-05-18T16:10:32 Last Updated: 2024-08-04T03:38:50.248Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Lenovo Products: Personal Cloud Storage A1, Personal Cloud Storage T1, Personal Cloud Storage X1, Personal Cloud Storage T2, Personal Cloud Storage T2Pro Problem Types: CWE-862 Description: A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_200017.html