Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-39221 State: PUBLISHED Published: 2021-10-25T19:05:10 Last Updated: 2024-08-04T01:58:18.235Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-434, CWE-79 Description: Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content
rict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Contacts application is upgraded to 4.0.3. As a workaround, one may use a browser that has support for Content-Security-Policy. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j6cx-mxqf-f9vc - https://github.com/nextcloud/contacts/pull/2407
CVE ID: CVE-2021-39222 State: PUBLISHED Published: 2021-11-15T18:30:13 Last Updated: 2024-08-04T01:58:18.181Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-434, CWE-79 Description: Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is rec
y shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Talk application is upgraded to patched versions 10.0.7, 10.1.4, 11.1.2, 11.2.0 or 12.0.0. As a workaround, use a browser that has support for Content-Security-Policy. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xhxq-f4vg-jw5g - https://github.com/nextcloud/spreed/pull/542 - https://hackerone.com/reports/1135481
CVE ID: CVE-2021-39223 State: PUBLISHED Published: 2021-10-25T21:35:11 Last Updated: 2024-08-04T01:58:18.329Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the Richdocuments application is u
ed within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the Richdocuments application is upgraded to 3.8.6 or 4.2.3. As a workaround, disable the Richdocuments application in the app settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rjcc-4cgj-6v93 - https://github.com/nextcloud/richdocuments/pull/1760 - https://hackerone.com/reports/1253460
CVE ID: CVE-2021-39224 State: PUBLISHED Published: 2021-10-25T21:40:17 Last Updated: 2024-08-04T01:58:18.174Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the OfficeOnline application is upgraded to 1.1.1
es/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the OfficeOnline application is upgraded to 1.1.1. As a workaround, one may disable the OfficeOnline application in the app settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56wm-r6jm-3v9h - https://github.com/nextcloud/officeonline/pull/204
CVE ID: CVE-2021-39225 State: PUBLISHED Published: 2021-10-25T21:40:11 Last Updated: 2024-08-04T01:58:18.335Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-639 Description: Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/n
workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72 - https://github.com/nextcloud/deck/pull/3316 - https://hackerone.com/reports/1331728
CVE ID: CVE-2021-39226 State: PUBLISHED Published: 2021-10-05T17:30:11.000Z Last Updated: 2025-10-21T23:25:30.669Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: grafana Products: grafana Problem Types: CWE-287 Description: Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by access
true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the litera
6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 - https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269 - https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/ - https://grafana.com/docs/grafana/latest/release-notes/release-no
cs/grafana/latest/release-notes/release-notes-7-5-11/ - https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/ - http://www.openwall.com/lists/oss-security/2021/10/05/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/ - https://security.netapp.com/advisory/ntap-20211029-0008/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/
CVE ID: CVE-2021-39227 State: PUBLISHED Published: 2021-09-17T14:10:10 Last Updated: 2024-08-04T01:58:18.239Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ecomfe Products: zrender Problem Types: CWE-1321 Description: ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRend
ly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf - https://github.com/ecomfe/zrender/pull/826 - https://github.com/ecomfe/zrender/releases/tag/5.2.1
CVE ID: CVE-2021-39228 State: PUBLISHED Published: 2021-09-17T14:00:15 Last Updated: 2024-08-04T01:58:18.328Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: tremor-rs Products: tremor-runtime Problem Types: CWE-416, CWE-825 Description: Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retri
ate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the `state`, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct. The issue has been patched in version 0.11.6 by removing the optimization and always cloning the target expression of a Merge or Patch. If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to `state`. Additional Analyst Notes: - CVE Program Container: References: - https://github
not immediately reassigning to `state`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tremor-rs/tremor-runtime/security/advisories/GHSA-mc22-5q92-8v85 - https://github.com/tremor-rs/tremor-runtime/pull/1217 - https://github.com/tremor-rs/tremor-runtime/commit/1a2efcdbe68e5e7fd0a05836ac32d2cde78a0b2e - https://github.com/tremor-rs/tremor-runtime/releases/tag/v0.11.6
CVE ID: CVE-2021-39229 State: PUBLISHED Published: 2021-09-20T21:20:11 Last Updated: 2024-08-04T01:58:18.193Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: caronc Products: apprise Problem Types: CWE-400 Description: Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) are subject to a denial of service attack on an inefficient regular expression. The vulnerable regular expression is [here](https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1
pression. The vulnerable regular expression is [here](https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359). The problem has been patched in release version 0.9.5.1. Users who are unable to upgrade are advised to remove `apprise/plugins/NotifyIFTTT.py` to eliminate the service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caronc/apprise/security/advisories/GHSA-qhmp-h54x-38qr - https://github.com/caronc/apprise/pull/436 - https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359
CVE ID: CVE-2021-39230 State: PUBLISHED Published: 2021-09-21T16:55:12 Last Updated: 2024-08-04T01:58:18.264Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: FrankEnderman Products: Butter Problem Types: CWE-20 Description: Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to the Trinity kernel. There are no workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FrankEnderman/Butter/security/advisories/GHSA-4538-4g86-xf6j - https://github.com/FrankEnderman/Butter/commit/a4fd717e848306f04f2823ea5f617e4da9f5bbdb
CVE ID: CVE-2021-39231 State: PUBLISHED Published: 2021-11-19T09:20:17 Last Updated: 2024-08-04T01:58:18.341Z Vendors: Apache Software Foundation Products: Apache Ozone Problem Types: CWE-862 Description: In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C110cd117-75ed-364b-cd38-3effd20f2183%40apache.org%3E - http://www.openwall.com/lists/oss-security/2021/11/19/2
CVE ID: CVE-2021-39232 State: PUBLISHED Published: 2021-11-19T09:20:19 Last Updated: 2024-08-04T01:58:18.342Z Vendors: Apache Software Foundation Products: Apache Ozone Problem Types: CWE-862 Description: In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C3c30a7f2-13a4-345e-6c8a-c23a2b937041%40apache.org%3E - http://www.openwall.com/lists/oss-security/2021/11/19/3
CVE ID: CVE-2021-39233 State: PUBLISHED Published: 2021-11-19T09:20:20 Last Updated: 2024-08-04T01:58:18.231Z Vendors: Apache Software Foundation Products: Apache Ozone Problem Types: CWE-306 Description: In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E - http://www.openwall.com/lists/oss-security/2021/11/19/4
CVE ID: CVE-2021-39234 State: PUBLISHED Published: 2021-11-19T09:20:22 Last Updated: 2024-08-04T01:58:18.340Z Vendors: Apache Software Foundation Products: Apache Ozone Problem Types: CWE-20 Description: In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C97d65498-7f8c-366f-1bea-5a74b6378f0d%40apache.org%3E - http://www.openwall.com/lists/oss-security/2021/11/19/5
CVE ID: CVE-2021-39235 State: PUBLISHED Published: 2021-11-19T09:20:23 Last Updated: 2024-08-04T02:06:41.327Z Vendors: Apache Software Foundation Products: Apache Ozone Problem Types: CWE-732 Description: In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E - http://www.openwall.com/lists/oss-security/2021/11/19/6
CVE ID: CVE-2021-39236 State: PUBLISHED Published: 2021-11-19T09:20:25 Last Updated: 2024-08-04T02:06:40.807Z Vendors: Apache Software Foundation Products: Apache Ozone Problem Types: CWE-862 Description: In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C0fd74baa-88a0-39a2-8f3a-b982acb25d5a%40apache.org%3E - http://www.openwall.com/lists/oss-security/2021/11/19/7 - https://issues.apache.org/jira/browse/HDDS-4763
CVE ID: CVE-2021-39237 State: PUBLISHED Published: 2021-11-03T00:07:54 Last Updated: 2024-08-04T02:06:41.323Z Vendors: n/a Products: HP LaserJet; HP LaserJet Managed; HP PageWide; HP PageWide Managed printers Problem Types: Information disclosure Description: Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers may be vulnerable to potential information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5000124-5000148-16
CVE ID: CVE-2021-39238 State: PUBLISHED Published: 2021-11-03T00:06:26 Last Updated: 2024-08-04T02:06:40.992Z Vendors: n/a Products: HP Enterprise LaserJet; HP LaserJet Managed; HP Enterprise PageWide; HP PageWide Managed printers Problem Types: Potential buffer overflow. Description: Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5000383-5000409-16
CVE ID: CVE-2021-39239 State: PUBLISHED Published: 2021-09-16T14:40:20 Last Updated: 2024-08-04T02:06:40.799Z Vendors: Apache Software Foundation Products: Apache Jena Problem Types: XML External Entity (XXE) vulnerability Description: A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d%40%3Cusers.jena.apache.org%3E - https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a082
669a9f610d3221d493d%40%3Cusers.jena.apache.org%3E - https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r0f03ae7e102c3e8587fdd36531fc167309335738156dfbd7d9c1bf45%40%3Cdev.jena.apache.org%3E - https://lists.apache.org/thread.html/rce5241b228a1f0e5880f6b2bfdb7ae9ee420e94cb692738a0bbfed9d%40%3Cdev.jena.apache.org%3E
CVE ID: CVE-2021-39240 State: PUBLISHED Published: 2021-08-17T18:33:25 Last Updated: 2024-08-04T02:06:40.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve. Additional Analyst Notes: - CVE Program Container: References: - https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html - https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=a495e0d94876c9d39
chive.com/haproxy%40formilux.org/msg41041.html - https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=a495e0d94876c9d39763db319f609351907a31e8 - https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=4b8852c70d8c4b7e225e24eb58258a15eb54c26e - https://www.debian.org/security/2021/dsa-4960 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
CVE ID: CVE-2021-39241 State: PUBLISHED Published: 2021-08-17T18:33:13 Last Updated: 2024-08-04T02:06:41.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example. Additional Analyst Notes: - CVE Program Container: References: - https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html - https://git.haproxy.org/?p=haproxy.
r: References: - https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html - https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=89265224d314a056d77d974284802c1b8a0dc97f - https://www.debian.org/security/2021/dsa-4960 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
CVE ID: CVE-2021-39242 State: PUBLISHED Published: 2021-08-17T18:33:00 Last Updated: 2024-08-04T02:06:40.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html - https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=b5d2b9e154d78e4075db163826c5e0f6d31b2ab1 - https://www.debian.org/security/2021/dsa-4960 - https://lists.fedoraproj
%3Bh=b5d2b9e154d78e4075db163826c5e0f6d31b2ab1 - https://www.debian.org/security/2021/dsa-4960 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
CVE ID: CVE-2021-39243 State: PUBLISHED Published: 2021-08-23T04:24:51 Last Updated: 2024-08-04T02:06:40.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via any CGI endpoint. This affects Nexto NX3003 1.8.11.0, Nexto NX3004 1.8.11.0, Nexto NX3005 1.8.11.0, Nexto NX3010 1.8.3.0, Nexto NX3020 1.8.3.0, Nexto NX3030 1.8.3.0, Nexto NX5100 1.8.11.0, Nexto NX5101 1.8.11.0, Nexto NX5110 1.1.2.8, Nexto NX5210 1.1.2.8, Nexto Xpress XP300 1.8.11.0, Nexto Xpress XP315 1.8.11.0, Nexto Xpress XP325 1.8.11.0, Nexto Xpress XP340 1.8.11.0, and Hadron Xtorm HX3040 1.7.58.0. Additional Analyst Notes:
0, Nexto Xpress XP325 1.8.11.0, Nexto Xpress XP340 1.8.11.0, and Hadron Xtorm HX3040 1.7.58.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.altus.com.br/ - http://seclists.org/fulldisclosure/2021/Aug/21