Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt
CVE ID: CVE-2021-36769 State: PUBLISHED Published: 2021-07-16T23:03:50 Last Updated: 2024-08-04T01:01:59.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client. Additional Analyst Notes: - CVE Program Container: References: - https://mtpsym.github.io
CVE ID: CVE-2021-36770 State: PUBLISHED Published: 2021-08-11T22:49:04.000Z Last Updated: 2025-11-03T21:45:03.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value. Additional Analyst Notes: - CVE Program Container: References: - https://metacpan.org/dist/
C has only an integer value. Additional Analyst Notes: - CVE Program Container: References: - https://metacpan.org/dist/Encode/changes - https://security-tracker.debian.org/tracker/CVE-2021-36770 - https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d775c74 - https://github.com/Perl/perl5/commit/c1a937fef07c061600a0078f4cb53fe9c2136bb9 - https://news.cpanel.com/unscheduled-tsr-10-august-2021/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KOZYD7BH2DNIAEZ2ZL4PJ4QUVQI6Y33/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NDGQSGMEZ75FJGBKNYC75OTO7TF7XHB/ - https://se
ject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NDGQSGMEZ75FJGBKNYC75OTO7TF7XHB/ - https://security.netapp.com/advisory/ntap-20210909-0003/
CVE ID: CVE-2021-36771 State: PUBLISHED Published: 2021-07-17T18:13:48 Last Updated: 2024-08-04T01:01:59.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/ad-manager/release-notes.html#7110
CVE ID: CVE-2021-36772 State: PUBLISHED Published: 2021-07-17T18:13:39 Last Updated: 2024-08-04T01:01:59.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus before 7110 allows stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/ad-manager/release-notes.html#7110
CVE ID: CVE-2021-36773 State: PUBLISHED Published: 2021-07-18T03:34:06 Last Updated: 2024-08-04T01:01:59.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality). Additional Analyst Notes: - CVE Program Container: References: - https://news.ycombinator.com/item?id=27833752 - https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc - https://lists.debian.org/de
om/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc - https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html
CVE ID: CVE-2021-36774 State: PUBLISHED Published: 2022-01-06T12:35:20 Last Updated: 2024-08-04T01:01:59.491Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: remote command/code execute Description: Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://
ache Kylin 3 version 3.1.2 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/lchpcvoolc6w8zc6vo1wstk8zbfqv2ow - http://www.openwall.com/lists/oss-security/2022/01/06/5
CVE ID: CVE-2021-36775 State: PUBLISHED Published: 2022-04-01T07:40:11.706748Z Last Updated: 2024-09-16T18:34:57.999Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-284 Description: a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked. This issue affects: SUSE Rancher Rancher versions prior to 2.4.18; Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1189120
CVE ID: CVE-2021-36776 State: PUBLISHED Published: 2022-04-01T07:40:13.289749Z Last Updated: 2024-09-17T01:51:56.723Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-284 Description: A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1189413
CVE ID: CVE-2021-36777 State: PUBLISHED Published: 2022-03-09T16:26:18.323145Z Last Updated: 2024-09-16T22:03:11.916Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: openSUSE Products: Build service Problem Types: CWE-807 Description: A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This issue affects: openSUSE Build service login-proxy-scripts versions prior to dc000cdfe9b9b715fb92195b1a57559362f689ef. Additional Analyst Notes: - CVE Program Container: Refe
ipts versions prior to dc000cdfe9b9b715fb92195b1a57559362f689ef. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1191209
CVE ID: CVE-2021-36778 State: PUBLISHED Published: 2022-05-02T07:05:12.716335Z Last Updated: 2024-09-17T04:09:21.685Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SUSE Products: Rancher Problem Types: CWE-863 Description: A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1191466
CVE ID: CVE-2021-36779 State: PUBLISHED Published: 2021-12-17T08:55:13.033875Z Last Updated: 2024-09-16T23:20:38.350Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: Longhorn Problem Types: CWE-306 Description: A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on the host without authentication. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1191818 - https://github.com/longhorn
: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1191818 - https://github.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhx
CVE ID: CVE-2021-36780 State: PUBLISHED Published: 2021-12-17T08:55:14.523719Z Last Updated: 2024-09-16T23:15:43.598Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SUSE Products: Longhorn Problem Types: CWE-306 Description: A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v. Additional Analyst Notes: - CVE Program Container: References: - https://gith
1.1.3; longhorn versions prior to 1.2.3v. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhx - https://bugzilla.suse.com/show_bug.cgi?id=1191819
CVE ID: CVE-2021-36781 State: PUBLISHED Published: 2022-01-14T10:40:09.442647Z Last Updated: 2024-09-16T18:39:32.233Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: openSUSE Products: Factory Problem Types: CWE-276 Description: A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1193484
CVE ID: CVE-2021-36782 State: PUBLISHED Published: 2022-09-07T08:20:16.064791Z Last Updated: 2024-09-17T04:14:05.504Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-312 Description: A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.co
ncher versions prior to 2.6.7. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1193988 - https://github.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f
CVE ID: CVE-2021-36783 State: PUBLISHED Published: 2022-09-07T08:20:16.958779Z Last Updated: 2024-09-16T18:13:16.201Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-522 Description: A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13. Additional Analyst Notes: - CVE Program Container: References: - http
prior to 2.6.4; Rancher versions prior to 2.5.13. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1193990 - https://github.com/rancher/rancher/security/advisories/GHSA-8w87-58w6-hfv8
CVE ID: CVE-2021-36784 State: PUBLISHED Published: 2022-05-02T07:05:14.279198Z Last Updated: 2024-09-16T18:08:54.118Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-269 Description: A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1193991
CVE ID: CVE-2021-36785 State: PUBLISHED Published: 2021-08-13T16:11:20 Last Updated: 2024-08-04T01:01:59.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories/security - https://typo3.org/security/advisory/typo3-ext-sa-2021-011
CVE ID: CVE-2021-36786 State: PUBLISHED Published: 2021-08-13T16:12:57 Last Updated: 2024-08-04T01:01:59.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories/security - https://typo3.org/security/advisory/typo3-ext-sa-2021-011
CVE ID: CVE-2021-36787 State: PUBLISHED Published: 2021-08-13T16:15:25 Last Updated: 2024-08-04T01:01:59.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories/security - https://typo3.org/security/advisory/typo3-ext-sa-2021-010 - http://seclists.org/fulldisclosure/2022/Jan/53 - http://packetstormsecurity.com/files/165675/TYPO3-femanager-6.3.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-36788 State: PUBLISHED Published: 2021-08-13T16:09:42 Last Updated: 2024-08-04T01:01:59.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories/security - https://typo3.org/security/advisory/typo3-ext-sa-2021-013
CVE ID: CVE-2021-36789 State: PUBLISHED Published: 2021-08-13T16:05:05 Last Updated: 2024-08-04T01:01:59.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories/security - https://typo3.org/security/advisory/typo3-ext-sa-2021-013
CVE ID: CVE-2021-36790 State: PUBLISHED Published: 2021-08-13T16:06:04 Last Updated: 2024-08-04T01:01:59.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories/security - https://typo3.org/security/advisory/typo3-ext-sa-2021-013
CVE ID: CVE-2021-36791 State: PUBLISHED Published: 2021-08-13T16:06:59 Last Updated: 2024-08-04T01:01:59.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories/security - https://typo3.org/security/advisory/typo3-ext-sa-2021-013
CVE ID: CVE-2021-36792 State: PUBLISHED Published: 2021-08-13T16:08:07 Last Updated: 2024-08-04T01:01:59.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories/security - https://typo3.org/security/advisory/typo3-ext-sa-2021-013
CVE ID: CVE-2021-36793 State: PUBLISHED Published: 2021-08-13T16:20:00 Last Updated: 2024-08-04T01:01:59.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories/security - https://typo3.org/security/advisory/typo3-ext-sa-2021-008
CVE ID: CVE-2021-36794 State: PUBLISHED Published: 2021-11-02T13:26:20 Last Updated: 2024-08-04T01:01:59.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Siren Investigate before 11.1.4, when enabling the cluster feature of the Siren Alert application, TLS verifications are disabled globally in the Siren Investigate main process. Additional Analyst Notes: - CVE Program Container: References: - https://community.siren.io/c/announcements - https://docs.siren.io/index - https://docs.siren.io/siren-platform-user-guide/11.1/release-notes.html#_security_fixes_3
CVE ID: CVE-2021-36795 State: PUBLISHED Published: 2021-08-06T16:58:48 Last Updated: 2024-08-04T01:01:59.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. An underprivileged linux user, if certain environment criteria are met, can gain additional privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-36795.md
CVE ID: CVE-2021-36797 State: PUBLISHED Published: 2021-07-19T16:14:50 Last Updated: 2024-08-04T01:01:59.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device. NOTE: the vendor disagrees with the reporter's opinion about an alleged "security best practices" violation Additional Analyst Notes: - CVE Program Container: References: - https://github.com/victronenergy/venus/issues/836
CVE ID: CVE-2021-36798 State: PUBLISHED Published: 2021-08-09T12:38:36 Last Updated: 2024-08-04T01:01:59.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 server thread and block beacons' communication with it. Additional Analyst Notes: - CVE Program Container: References: - https://www.cobaltstrike.com/releasenotes.txt - https://labs.sentinelone.com/hotcobalt-new-cobalt-strike-dos-vulnerability-that-lets-you-halt-operations/
CVE ID: CVE-2021-36799 State: PUBLISHED Published: 2021-07-19T16:31:25 Last Updated: 2024-08-04T01:01:59.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://github.com/robertguetzkow/ets5-password-recovery - https://www.knx.org/knx-en/for-professionals/software/ets-5-professional/ - http://packetstormsecurity.com/files/165200/ETS5-Password-Recovery-Tool.html
CVE ID: CVE-2021-36800 State: PUBLISHED Published: 2021-08-04T22:20:38.562227Z Last Updated: 2024-09-16T16:53:12.794Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Akaunting Products: Akaunting Problem Types: CWE-94 Description: Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invoices/{invoice_id} with an items[0][price] that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the product. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-ope
dditional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
CVE ID: CVE-2021-36801 State: PUBLISHED Published: 2021-08-04T22:20:40.098564Z Last Updated: 2024-09-16T16:28:17.682Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Akaunting Products: Akaunting Problem Types: CWE-639 Description: Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
CVE ID: CVE-2021-36802 State: PUBLISHED Published: 2021-08-04T22:20:41.632860Z Last Updated: 2024-09-17T00:11:15.201Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Akaunting Products: Akaunting Problem Types: CWE-248 Description: Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
CVE ID: CVE-2021-36803 State: PUBLISHED Published: 2021-08-04T22:20:43.165451Z Last Updated: 2024-09-16T17:23:36.869Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Akaunting Products: Akaunting Problem Types: CWE-79 Description: Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
CVE ID: CVE-2021-36804 State: PUBLISHED Published: 2021-08-04T22:20:44.678845Z Last Updated: 2024-09-16T17:04:02.713Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Akaunting Products: Akaunting Problem Types: CWE-640 Description: Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled w
sue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/ - https://www.laravel-enlightn.com/docs/security/host-injection-analyzer.html - https://github.com/laravel/laravel/pull/5477
CVE ID: CVE-2021-36805 State: PUBLISHED Published: 2021-08-04T22:20:46.362732Z Last Updated: 2024-09-17T04:29:16.452Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: Akaunting Products: Akaunting Problem Types: CWE-79 Description: Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the sales invoice processing component of the application. This issue was fixed in version 2.1.13 of the product. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/