Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-28089 State: PUBLISHED Published: 2021-03-19T04:18:41 Last Updated: 2024-08-03T21:33:17.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.torproject.org/tpo/core/tor/-/issues/40304 - https://blog.torproject.org/node/2009 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/ - https://security.gentoo.org/glsa/202107-25
CVE ID: CVE-2021-28090 State: PUBLISHED Published: 2021-03-19T04:19:06 Last Updated: 2024-08-03T21:33:17.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.torproject.org/tpo/core/tor/-/issues/40316 - https://blog.torproject.org/node/2009 - https://bugs.torproject.org/tpo/core/tor/40316 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/ - https://security.gentoo.org/glsa/202107-25
CVE ID: CVE-2021-28091 State: PUBLISHED Published: 2021-06-04T14:39:14 Last Updated: 2024-08-03T21:33:17.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. Additional Analyst Notes: - CVE Program Container: References: - http://listes.entrouvert.com/arc/lasso/ - https://git.entrouvert.org/lasso.git/commit/?id=076a37d7f0eb74001127481da2d355683693cde9 - https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0 - https://www.debian.org/security/2021/dsa-4926 - https://lists.debian.org/debian-lts-announce/2021/06/msg00013.html - https://lists.fedoraproject.org/archives/list/package-announce%40li
bian.org/debian-lts-announce/2021/06/msg00013.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SI4YAQF4VEV2KHQ6OXXZL7CJK7IZQ3EG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSVWOHBBWLI2RB5C6TXINFEJRT4YSD3D/
CVE ID: CVE-2021-28092 State: PUBLISHED Published: 2021-03-12T21:31:35 Last Updated: 2024-08-03T21:33:17.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sindresorhus/is-svg/releases - https://www.npmjs.com/package/is-svg - https://github.com/sindresorhus/is-svg/releases/tag/v4.2.2 - https://security.netapp.com/advisory/ntap-20210513-0008/
CVE ID: CVE-2021-28093 State: PUBLISHED Published: 2021-07-27T05:09:13 Last Updated: 2024-08-03T21:33:17.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://seclists.org/fulldisclosure/2021/Jul/37 - http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html
CVE ID: CVE-2021-28094 State: PUBLISHED Published: 2021-07-27T05:08:53 Last Updated: 2024-08-03T21:33:17.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://seclists.org/fulldisclosure/2021/Jul/37 - http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html
CVE ID: CVE-2021-28095 State: PUBLISHED Published: 2021-07-27T05:12:19 Last Updated: 2024-08-03T21:33:17.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://seclists.org/fulldisclosure/2021/Jul/37 - http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html
CVE ID: CVE-2021-28096 State: PUBLISHED Published: 2022-01-27T14:00:07 Last Updated: 2024-08-03T21:33:17.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield SNS before 4.2.3 (when the proxy is used). An attacker can saturate the proxy connection table. This would result in the proxy denying any new connections. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu/2021-005/
CVE ID: CVE-2021-28098 State: PUBLISHED Published: 2021-04-14T14:56:29 Last Updated: 2024-08-03T21:33:17.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged location such as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this
ch as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this case, the Everyone group). The log file in System32 can be replaced and renamed with a malicious DLL for DLL hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://docs.forescout.com - https://www.adversis.io/research/2021/3/30/forescout-secure-connector-local-privilege-escalation - https://jordanpotti.com/2021/03/30/forescout-priv-esc-folder-permissions/
CVE ID: CVE-2021-28099 State: PUBLISHED Published: 2021-03-23T20:28:52 Last Updated: 2024-08-03T21:33:17.497Z Vendors: n/a Products: Netflix OSS Hollow Problem Types: Local Information Disclosure Description: In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-001.md
CVE ID: CVE-2021-28100 State: PUBLISHED Published: 2021-03-23T20:26:01 Last Updated: 2024-08-03T21:33:17.494Z Vendors: n/a Products: Netflix OSS Priam Problem Types: Local Information Disclosure Description: Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-002.md
CVE ID: CVE-2021-28109 State: PUBLISHED Published: 2021-03-19T02:56:58 Last Updated: 2024-08-03T21:33:17.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://www.tadviser.ru/index.php/%D0%9F%D1%80%D0%BE%D0%B4%D1%83%D0%BA%D1%82:TranzWare_Online - https://gist.github.com/ArtemBrylev/51106b7cf8929b3ecfb9dd7c9e7b0fcf
CVE ID: CVE-2021-28110 State: PUBLISHED Published: 2021-03-19T03:01:19 Last Updated: 2024-08-03T21:33:17.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: /exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/kukuxumushi/0b7d90a917ac3480066c4cbf7519b40a
CVE ID: CVE-2021-28111 State: PUBLISHED Published: 2021-05-20T13:29:47 Last Updated: 2024-08-03T21:33:17.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker. Additional Analyst Notes: - CVE Program Container: References: - https://static.draeger.com/security - https://static.draeger.com/security/download/PSA-21-120-1-X-Dock-Product-Security-Advisory.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-604/
CVE ID: CVE-2021-28112 State: PUBLISHED Published: 2021-05-20T13:32:40 Last Updated: 2024-08-03T21:33:17.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an authenticated attacker. Additional Analyst Notes: - CVE Program Container: References: - https://static.draeger.com/security - https://static.draeger.com/security/download/PSA-21-120-1-X-Dock-Product-Security-Advisory.pdf
CVE ID: CVE-2021-28113 State: PUBLISHED Published: 2021-04-02T14:26:52 Last Updated: 2024-08-03T21:33:17.494Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account. Additional Analyst Notes: - CVE Program Container: References: - https://www.okta.com/security-advisories/cve-2021-28113 - http://packetstormsecurity.com/files/163428/Okta-Access-Gateway-2020.5.5-Authenticated-Remote
dvisories/cve-2021-28113 - http://packetstormsecurity.com/files/163428/Okta-Access-Gateway-2020.5.5-Authenticated-Remote-Root.html
CVE ID: CVE-2021-28114 State: PUBLISHED Published: 2021-07-16T12:16:18 Last Updated: 2024-08-03T21:33:17.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing. Additional Analyst Notes: - CVE Program Container: References: - https://labs.bishopfox.com/advisories - https://froala.com/wysiwyg-editor/ - https://labs.bishopfox.com/advisories/froala-editor-v3.2.6
CVE ID: CVE-2021-28115 State: PUBLISHED Published: 2021-03-09T21:33:41 Last Updated: 2024-08-03T21:33:17.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Sama34/OUGC-Feedback/pull/31/commits/ceef7c06359e5dcbaffe90a40884265c5754068c - http://packetstormsecurity.com/files/161746/MyBB-OUGC-Feedback-1.8.22-Cross-Site-Scripting.html
CVE ID: CVE-2021-28116 State: PUBLISHED Published: 2021-03-09T21:44:58 Last Updated: 2024-08-03T21:33:17.441Z Severity: LOW (CVSS 3.7 CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/ - https://www.zerodayinitiative.com/advisories/ZDI-21-157/ - https://github.com/squid-cache/squid/security/advisories/GHSA-rgf3-9
/www.zerodayinitiative.com/advisories/ZDI-21-157/ - https://github.com/squid-cache/squid/security/advisories/GHSA-rgf3-9v3p-qp82 - https://security.gentoo.org/glsa/202105-14 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQ3U54ZCNXR44QRPW3AV2VCS6K3TKCF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4EPIWUZDJAXADDHVOPKRBTQHPBR6H66/ - http://www.openwall.com/lists/oss-security/2021/10/04/1 - https://www.debian.org/security/2022/dsa-5171
CVE ID: CVE-2021-28117 State: PUBLISHED Published: 2021-03-20T00:00:00 Last Updated: 2024-10-15T18:08:32.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://userbase.kde.org/Discover - https://github.com/KDE/discover/releases - https://kde.org/info/security/advisory-20210310-1.txt - https://invent.kde.org/plasma/discover/commi
discover/releases - https://kde.org/info/security/advisory-20210310-1.txt - https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60 - https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356
CVE ID: CVE-2021-28119 State: PUBLISHED Published: 2021-03-09T22:14:39 Last Updated: 2024-08-03T21:33:17.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xanderfrangos/twinkle-tray/issues/142
CVE ID: CVE-2021-28121 State: PUBLISHED Published: 2021-08-12T22:00:07 Last Updated: 2024-08-03T21:33:17.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/pc-robotstxt/#developers
CVE ID: CVE-2021-28122 State: PUBLISHED Published: 2021-03-10T14:34:45 Last Updated: 2024-08-03T21:33:17.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/open5gs/open5gs/releases - https://github.com/open5gs/open5gs/issues/837 - htt
ntainer: References: - https://github.com/open5gs/open5gs/releases - https://github.com/open5gs/open5gs/issues/837 - https://github.com/open5gs/open5gs/pull/838 - https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1
CVE ID: CVE-2021-28123 State: PUBLISHED Published: 2021-04-02T14:46:17 Last Updated: 2024-08-03T21:33:17.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. The ssh key can provide an attacker access to the linux system in the affected version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-28123.md
CVE ID: CVE-2021-28124 State: PUBLISHED Published: 2021-04-02T14:50:54 Last Updated: 2024-08-03T21:33:17.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. Missing server authentication in impacted versions can allow an attacker to Man-in-the-middle (MITM) support channel UI session to Cohesity DataPlatform cluster. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-28124.md
CVE ID: CVE-2021-28125 State: PUBLISHED Published: 2021-04-27T09:27:22 Last Updated: 2024-08-03T21:33:17.571Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-601 Description: Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache
https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E - https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/04/27/2
CVE ID: CVE-2021-28126 State: PUBLISHED Published: 2021-03-19T03:07:53 Last Updated: 2024-08-03T21:33:17.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/kukuxumushi/7436994ef395573023b79652e104a2a0
CVE ID: CVE-2021-28127 State: PUBLISHED Published: 2021-07-01T14:01:34 Last Updated: 2024-08-03T21:33:17.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu - https://advisories.stormshield.eu/2021-006
CVE ID: CVE-2021-28128 State: PUBLISHED Published: 2021-05-06T13:49:30 Last Updated: 2024-08-03T21:33:17.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strapi/strapi/releases - https://strapi.io/changelog - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-008.txt
CVE ID: CVE-2021-28129 State: PUBLISHED Published: 2021-10-07T15:50:11 Last Updated: 2024-08-03T21:33:17.499Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-284 Description: While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist. Users who installed the Apache OpenOffice 4.1.8 DEB packaging should upgrade to the latest version of Apache OpenOffice. Additional Analyst Notes: - CVE Program Container: References: - https://lis
to the latest version of Apache OpenOffice. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rc9090ab48b4699494b63b35cd6d7414c52d665ecae12add3cdc56c9b%40%3Cusers.openoffice.apache.org%3E - https://lists.apache.org/thread.html/r9e72234dd662280fa1a3cca6164d3470a1dbc0d8e53e48ba27f787ce%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rc9090ab48b4699494b63b35cd6d7414c52d665ecae12add3cdc56c9b%40%3Cusers.openoffice.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/10/07/5
CVE ID: CVE-2021-28130 State: PUBLISHED Published: 2021-09-24T15:27:56 Last Updated: 2024-08-03T21:33:17.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate binary (e.g., frwl_svc.exe) bypasses firewall filters. Additional Analyst Notes: - CVE Program Container: References: - https://news.drweb.ru/show/?i=14180&lng=ru - https://habr.com/ru/company/pm/blog/579328/
CVE ID: CVE-2021-28131 State: PUBLISHED Published: 2021-07-22T10:05:13 Last Updated: 2024-08-03T21:33:17.543Z Vendors: Apache Software Foundation Products: Apache Impala Problem Types: CWE-288 Description: Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the attacker is able to execute statements for which they don't have the necessary privileges otherwise. Impala deployments with Apache Sentry or Apache Ranger authorization enabled may be vulnerable
ry privileges otherwise. Impala deployments with Apache Sentry or Apache Ranger authorization enabled may be vulnerable to privilege escalation if an authenticated attacker is able to hijack a session or query from another authenticated user with privileges not assigned to the attacker. Impala deployments with audit logging enabled may be vulnerable to incorrect audit logging as a user could undertake actions that were logged under the name of a different authenticated user. Constructing an attack requires a high degree of technical sophistication and access to the Impala system as an authenticated user. Mitigation: If an Impala deployment uses Apache Sentry, Apache Ranger or audit logging,
ystem as an authenticated user. Mitigation: If an Impala deployment uses Apache Sentry, Apache Ranger or audit logging, then users should upgrade to a version of Impala with the fix for IMPALA-10600. The Impala 4.0 release includes this fix. This hides session secrets from the logs to eliminate the risk of any attack using this mechanism. In lieu of an upgrade, restricting access to logs that expose secrets will reduce the risk of an attack. Restricting access to the Impala deployment to trusted users will also reduce the risk of an attack. Log redaction techniques can be used to redact secrets from the logs. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apac
sed to redact secrets from the logs. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rb54f54a91b7abaf1ed772f3a9cec290153c24881b25567b06f1b4a8c%40%3Cuser.impala.apache.org%3E - https://lists.apache.org/thread.html/rb54f54a91b7abaf1ed772f3a9cec290153c24881b25567b06f1b4a8c%40%3Cuser.impala.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/07/22/3 - https://lists.apache.org/thread.html/rb54f54a91b7abaf1ed772f3a9cec290153c24881b25567b06f1b4a8c%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-28132 State: PUBLISHED Published: 2021-03-11T06:33:40 Last Updated: 2024-08-03T21:33:17.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI. Additional Analyst Notes: - CVE Program Container: References: - https://abuyv.com/cve/lucy-file-upload-RCE