Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28349
CVE ID: CVE-2021-28350 State: PUBLISHED Published: 2021-04-13T19:33:16 Last Updated: 2024-11-19T16:30:11.645Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
7, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Windows GDI+ Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28350
CVE ID: CVE-2021-28351 State: PUBLISHED Published: 2021-04-13T19:33:17 Last Updated: 2024-08-03T21:40:14.065Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: Elevation of Privilege Description
7, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows Speech Runtime Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28351
CVE ID: CVE-2021-28352 State: PUBLISHED Published: 2021-04-13T19:33:17 Last Updated: 2024-08-03T21:40:14.069Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
time Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28352
CVE ID: CVE-2021-28353 State: PUBLISHED Published: 2021-04-13T19:33:18 Last Updated: 2024-08-03T21:40:14.221Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
time Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28353
CVE ID: CVE-2021-28354 State: PUBLISHED Published: 2021-04-13T19:33:19 Last Updated: 2024-08-03T21:40:14.242Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
time Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28354
CVE ID: CVE-2021-28355 State: PUBLISHED Published: 2021-04-13T19:33:19 Last Updated: 2024-08-03T21:40:14.237Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
time Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28355
CVE ID: CVE-2021-28356 State: PUBLISHED Published: 2021-04-13T19:33:20 Last Updated: 2024-10-01T15:54:29.546Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
time Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28356
CVE ID: CVE-2021-28357 State: PUBLISHED Published: 2021-04-13T19:33:21 Last Updated: 2024-08-03T21:40:14.321Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
time Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28357
CVE ID: CVE-2021-28358 State: PUBLISHED Published: 2021-04-13T19:33:21 Last Updated: 2024-08-03T21:40:14.224Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1
time Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28358
CVE ID: CVE-2021-28359 State: PUBLISHED Published: 2021-05-02T07:55:12 Last Updated: 2024-08-03T21:40:14.401Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: Reflected XSS via Origin Parameter Description: The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR version
5 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336). Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E - https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-28361 State: PUBLISHED Published: 2021-03-13T19:00:31 Last Updated: 2024-08-03T21:40:14.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spdk/spdk/releases/tag/v21.01.1
CVE ID: CVE-2021-28362 State: PUBLISHED Published: 2021-03-24T13:52:03 Last Updated: 2024-08-03T21:40:14.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension header options in an incoming IPv6 packet, there is an attempt to remove the RPL extension headers. Because the packet length and the extension header length are unchecked (with respect to the available data) at this stage, and these variables are susceptible to integer underflow, it is possible to construct an invalid extension header that will cause memory corruption issues and lead to a Denial-of-Service condit
to construct an invalid extension header that will cause memory corruption issues and lead to a Denial-of-Service condition. This is related to rpl-ext-header.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/815128 - https://github.com/contiki-os/contiki/releases
CVE ID: CVE-2021-28363 State: PUBLISHED Published: 2021-03-15T00:00:00 Last Updated: 2024-08-03T21:40:14.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/urllib3/urllib3/commits/main - https:/
ditional Analyst Notes: - CVE Program Container: References: - https://github.com/urllib3/urllib3/commits/main - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/ - https://security.gentoo.org/glsa/202107-36 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://pypi.org/project/urllib3/1.26.4/ - https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 - https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r - https://security.gentoo.org/glsa/202305-02 - https://security.netapp.com/advisory/ntap-20240621-0007/
CVE ID: CVE-2021-28372 State: PUBLISHED Published: 2021-08-17T21:48:35 Last Updated: 2024-08-03T21:40:14.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID). This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the victim TUTK device. Additional Analyst Notes: - CVE Program Container: References: - https://www.throughtek.com/kalay_overview.html - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0020/FEYE-2021-0020.md
/kalay_overview.html - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0020/FEYE-2021-0020.md - https://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html
CVE ID: CVE-2021-28373 State: PUBLISHED Published: 2021-03-13T20:19:34 Last Updated: 2024-08-03T21:40:14.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in production. Semantic version numbers such as 21.03 appear to exist, but are automatically generated from the year and month. They are not releases. Additional Analyst Notes: - CVE Program Container: References: - https://community.tt-rs
d month. They are not releases. Additional Analyst Notes: - CVE Program Container: References: - https://community.tt-rss.org/t/check-password-not-called-if-otp-is-enabled-update-asap-if-youre-using-2fa/4502 - https://git.tt-rss.org/fox/tt-rss/commit/4949e1a59059d9e72ba7a98f783cec312c06c6d2
CVE ID: CVE-2021-28374 State: PUBLISHED Published: 2021-03-15T04:51:56 Last Updated: 2024-08-03T21:40:14.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's existence, uid and gids, home and/or Maildir directory, quota, and some type of password information (such as a hash). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/984810 - https://lists.deb
sh). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/984810 - https://lists.debian.org/debian-lts-announce/2021/04/msg00011.html
CVE ID: CVE-2021-28375 State: PUBLISHED Published: 2021-03-15T04:51:33 Last Updated: 2024-08-03T21:40:14.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/linus/20c40794eb85ea29852d7bc37c55713802a543d6 - https://lore.kernel.org/stable/YD03ew7+6v0XPh6l%40kroah.com/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org
YD03ew7+6v0XPh6l%40kroah.com/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMRQVOTASD3VZP6GE4JJHE27QU6FHTZ6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJPVQZPY3DHPV5I3IVNMSMO6D3PKZISX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XAUNYDTGE6MB4NWL2SIHPCODCLET3JZB/ - https://security.netapp.com/advisory/ntap-20210401-0003/
CVE ID: CVE-2021-28376 State: PUBLISHED Published: 2022-01-12T17:53:37 Last Updated: 2024-08-03T21:40:14.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2021-0006
CVE ID: CVE-2021-28377 State: PUBLISHED Published: 2022-01-12T17:49:31 Last Updated: 2024-08-03T21:40:14.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2021-0007/
CVE ID: CVE-2021-28378 State: PUBLISHED Published: 2021-03-15T05:20:50 Last Updated: 2024-08-03T21:40:14.222Z Severity: LOW (CVSS 3.7 CVSS:3.1/AC:H/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/go-gitea/gitea/pull/14898 - https://blog.gitea.io/2021/03/gitea-1.13.4-is-released/ - https://github.com/PandatiX/CVE-2021-28378
CVE ID: CVE-2021-28379 State: PUBLISHED Published: 2021-03-15T05:56:46 Last Updated: 2024-08-03T21:40:14.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/myvesta/vesta/commit/3402071e950e76b79fa8672a1e09b70d3860f355 - http://packetstormsecurity.com/files/161836/VestaCP-0.9.8-Cross-Site-Request-Forgery.html
CVE ID: CVE-2021-28380 State: PUBLISHED Published: 2021-03-16T19:46:58 Last Updated: 2024-08-03T21:40:14.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2021-003
CVE ID: CVE-2021-28381 State: PUBLISHED Published: 2021-03-16T19:48:52 Last Updated: 2024-08-03T21:40:14.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2021-001
CVE ID: CVE-2021-28382 State: PUBLISHED Published: 2021-06-07T09:45:15 Last Updated: 2024-08-03T21:40:14.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/key-manager/release-notes.html#6001 - https://raxis.com/blog/cve-2021-28382
CVE ID: CVE-2021-28398 State: PUBLISHED Published: 2022-09-05T16:09:29 Last Updated: 2024-08-03T21:40:14.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScript method in harvesters/src/main/java/org/fao/geonet/kernel/harvest/harvester/localfilesystem/LocalFilesystemHarvester.java. The earliest affected version is 3.4.0. Additional Analyst Notes: - CVE Program Container: References: - http
ster.java. The earliest affected version is 3.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://geonetwork-opensource.org/ - https://github.com/geonetwork/core-geonetwork - https://geonetwork-opensource.org/manuals/trunk/en/overview/change-log/version-3.6.0.html - https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-cf8p-c88c-h9jf
CVE ID: CVE-2021-28399 State: PUBLISHED Published: 2021-04-26T13:32:19 Last Updated: 2024-08-03T21:40:14.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function. Additional Analyst Notes: - CVE Program Container: References: - https://www.orangehrm.com/ - https://github.com/C1inton/CVE-Record/blob/master/CVE%20Record/%5BCVE-2021-28399%5DOrangeHRM%204.7.md
CVE ID: CVE-2021-28411 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T18:38:53.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers to escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lerry903/RuoYi/issues/20
CVE ID: CVE-2021-28417 State: PUBLISHED Published: 2021-03-18T11:57:41 Last Updated: 2024-08-03T21:40:14.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seopanel/Seo-Panel/issues/208 - http://packetstormsecurity.com/files/162914/Seo-Panel-4.8.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-28418 State: PUBLISHED Published: 2021-03-18T11:57:46 Last Updated: 2024-08-03T21:40:14.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seopanel/Seo-Panel/issues/207 - http://packetstormsecurity.com/files/162914/Seo-Panel-4.8.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-28419 State: PUBLISHED Published: 2021-03-18T11:57:53 Last Updated: 2024-08-03T21:40:14.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seopanel/Seo-Panel/issues/209 - http://packetstormsecurity.com/files/162322/SEO-Panel-4.8.0-SQL-Injection.html