Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-33964 State: PUBLISHED Published: 2022-01-18T11:26:52 Last Updated: 2024-08-04T00:05:51.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/set_firewall_level which receives parameters by POST request, and the parameter firewall_level has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.ebuy7.com/item/china-mobile-wireless-router-qualcomm-qiki-wifi6-routing-mesh-network-home-5g-dual-frequency-double-gigabit-port-wall-wall-high-speed-%E2%80%8B%E2%80%8Bh
comm-qiki-wifi6-routing-mesh-network-home-5g-dual-frequency-double-gigabit-port-wall-wall-high-speed-%E2%80%8B%E2%80%8Bhigh-power-enhanced-dormitory-students-an-lianbao-wf-1-628692180620 - http://iot.10086.cn/?l=en-us - https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520 - https://github.com/pokerfacett/MY_CVE_CREDIT/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection11.md
CVE ID: CVE-2021-33965 State: PUBLISHED Published: 2022-01-18T12:01:58 Last Updated: 2024-08-04T00:05:52.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request, and the parameter mesh_enable and mesh_device have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.ebuy7.com/item/china-mobile-wireless-router-qualcomm-qiki-wifi6-routing-mesh-network-home-5g-dual-frequency-double-gigabit-port-wall-wall-high-speed-%E2%80%8B%E2%80%8Bh
comm-qiki-wifi6-routing-mesh-network-home-5g-dual-frequency-double-gigabit-port-wall-wall-high-speed-%E2%80%8B%E2%80%8Bhigh-power-enhanced-dormitory-students-an-lianbao-wf-1-628692180620 - http://iot.10086.cn/?l=en-us - https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520 - https://github.com/pokerfacett/MY_CVE_CREDIT/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection10.md
CVE ID: CVE-2021-33966 State: PUBLISHED Published: 2022-01-21T18:55:13 Last Updated: 2024-08-04T00:05:52.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/162731/Spotweb-Develop-1.4.9-Cross-Site-Scripting.html
CVE ID: CVE-2021-33970 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T16:20:28.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html - https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/ - https://pastebin.com/Qug7tquW
CVE ID: CVE-2021-33971 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T16:18:16.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Total Security (http://www.360totalsecurity.com/) is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: This is a set of vulnerabilities affecting popular software, "360 Safeguard(12.1.0.1004,12.1.0.1005,13.1.0.1001)" , "360 Total Security(10.8.0.1060,10.8.0.1213)", "360 Safe Browser & 360 Chrome(13.0.2170.0)". The attack vector is: On the browser vulnerability, just open a link to complete the
rowser & 360 Chrome(13.0.2170.0)". The attack vector is: On the browser vulnerability, just open a link to complete the vulnerability exploitation remotely; on the client software, you need to locally execute the vulnerability exploitation program, which of course can be achieved with the full chain of browser vulnerability. ¶¶ This is a set of the most serious vulnerabilities that exist on Qihoo 360's PC client a variety of popular software, remote vulnerabilities can be completed by opening a link to arbitrary code execution on both security browsers, with the use of local vulnerabilities, not only help the vulnerability code constitutes an escalation of privileges, er can make the spyware
l vulnerabilities, not only help the vulnerability code constitutes an escalation of privileges, er can make the spyware persistent without being scanned permanently resides on the target PC computer (because local vulnerability against Qihoo 360 company's antivirus kernel flaws); this group of remote and local vulnerability of the perfect match, to achieve an information security fallacy, in Qihoo 360's antivirus vulnerability, not only can not be scanned out of the virus, but will help the virus persistently control the target computer, while Qihoo 360 claims to be a safe browser, which exists in the kernel vulnerability but helped the composition of the remote vulnerability. (Security exp
browser, which exists in the kernel vulnerability but helped the composition of the remote vulnerability. (Security expert "Memory Corruptor" have reported this set of vulnerabilities to the corresponding vendor, all vulnerabilities have been fixed and the vendor rewarded thousands of dollars to the security experts) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html - https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/ - https://pastebin.com/31v5JMcG
CVE ID: CVE-2021-33972 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T16:16:39.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html - https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/ - https://pastebin.com/qDedtZf3
CVE ID: CVE-2021-33973 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T16:07:17.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001 allows attacker to escalate priveleges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html - https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/ - https://pastebin.com/fsLDebg5
CVE ID: CVE-2021-33974 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T16:04:50.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Chrome (https://browser.360.cn/ee/) is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: This is a set of vulnerabilities affecting popular software, and the installation packages correspond to versions "360 Safeguard(12.1.0.1004,12.1.0.1005,13.1.0.1001)" , "360 Total Security(10.8.0.1060,10.8.0.1213)", "360 Safe Browser & 360 Chrome(12. The attack vector is: On the browser vulnerability, just
y(10.8.0.1060,10.8.0.1213)", "360 Safe Browser & 360 Chrome(12. The attack vector is: On the browser vulnerability, just open a link to complete the vulnerability exploitation remotely; on the client software, you need to locally execute the vulnerability exploitation program, which of course can be achieved with the full chain of browser vulnerability. ¶¶ This is a set of the most serious vulnerabilities that exist on Qihoo 360's PC client multiple popular software, remote vulnerabilities can be accomplished by opening a link to arbitrary code execution on both security browsers, in conjunction with the exploitation of local vulnerabilities that allow spyware to persist without being scanne
owsers, in conjunction with the exploitation of local vulnerabilities that allow spyware to persist without being scanned to permanently reside on the target PC computer (because local vulnerabilities target Qihoo 360 company's antivirus software kernel flaws); this set of remote and local vulnerabilities in perfect coordination, to achieve an information security fallacy, on Qihoo 360's antivirus software vulnerability, not only can not be scanned out of the virus, but will help the virus persistently control the target computer, while Qihoo 360 claims to be a secure browser, which exists in the kernel vulnerability but help the composition of the remote vulnerability.(Security expert "Memo
er, which exists in the kernel vulnerability but help the composition of the remote vulnerability.(Security expert "Memory Corruptor" have reported this set of vulnerabilities to the corresponding vendor, all vulnerabilities have been fixed and the vendor rewarded thousands of dollars to this security expert) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html - https://pastebin.com/ms1ivjYe
CVE ID: CVE-2021-33975 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T15:54:16.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html - https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/ - https://pastebin.com/ivNL7s0n
CVE ID: CVE-2021-33981 State: PUBLISHED Published: 2021-09-08T16:50:46 Last Updated: 2024-08-04T00:05:52.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and images of their hunting/fishing licenses. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/p4lsec/1f024d96b44ea733cdae0605c7ce8a49
CVE ID: CVE-2021-33982 State: PUBLISHED Published: 2021-09-08T16:52:37 Last Updated: 2024-08-04T00:05:52.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/p4lsec/1f024d96b44ea733cdae0605c7ce8a49
CVE ID: CVE-2021-33983 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T16:25:07.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Dvidelabs flatcc v.0.6.0 allows local attacker to execute arbitrary code via the fltacc execution of the error_ref_sym function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dvidelabs/flatcc/issues/188
CVE ID: CVE-2021-33988 State: PUBLISHED Published: 2021-10-19T16:53:05 Last Updated: 2024-08-04T00:05:52.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting code in the request form. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nck0099/osTicket/issues/2
CVE ID: CVE-2021-33990 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-13T16:28:22.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/fu2x2000/Liferay_exploit_Poc - http://packetstormsecurity.com/files/171701/Liferay-Portal-6.2.5-Insecure-Permissions.html
CVE ID: CVE-2021-34055 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-02T19:10:12.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Matthias-Wandel/jhead/issues/36 - https://lists.debian.org/debian-lts-announce/2022/12/msg00004.html - https://www.debian.org/security/2022/dsa-5294
CVE ID: CVE-2021-34064 State: REJECTED Published: N/A Last Updated: 2023-02-24T00:00:00 Description: No description available.
CVE ID: CVE-2021-34066 State: PUBLISHED Published: 2021-08-30T18:31:42 Last Updated: 2024-08-04T00:05:52.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EdgeGallery/developer-be/issues/1
CVE ID: CVE-2021-34067 State: PUBLISHED Published: 2021-06-23T21:56:04 Last Updated: 2024-08-04T00:05:52.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/justdan96/tsMuxer/pull/422/files - https://github.com/justdan96/tsMuxer/issues/424
CVE ID: CVE-2021-34068 State: PUBLISHED Published: 2021-06-23T21:56:12 Last Updated: 2024-08-04T00:05:52.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/justdan96/tsMuxer/pull/425/files - https://github.com/justdan96/tsMuxer/issues/427
CVE ID: CVE-2021-34069 State: PUBLISHED Published: 2021-06-23T21:56:18 Last Updated: 2024-08-04T00:05:52.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: Divide-by-zero bug in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/justdan96/tsMuxer/pull/421/files - https://github.com/justdan96/tsMuxer/issues/428
CVE ID: CVE-2021-34070 State: PUBLISHED Published: 2021-06-23T21:56:25 Last Updated: 2024-08-04T00:05:51.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: Out-of-bounds Read in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/justdan96/tsMuxer/pull/429/files - https://github.com/justdan96/tsMuxer/issues/426
CVE ID: CVE-2021-34071 State: PUBLISHED Published: 2021-06-23T21:56:32 Last Updated: 2024-08-04T00:05:52.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/justdan96/tsMuxer/issues/423
CVE ID: CVE-2021-34073 State: PUBLISHED Published: 2022-01-28T16:25:14 Last Updated: 2024-08-04T00:05:52.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category parameter in an add function in category/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49904
CVE ID: CVE-2021-34074 State: PUBLISHED Published: 2021-06-25T15:04:55 Last Updated: 2024-08-04T00:05:52.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path is used in the requests. Additional Analyst Notes: - CVE Program Container: References: - https://k4m1ll0.com/cve-pandorafms754-chained-xss-rce.html
CVE ID: CVE-2021-34075 State: PUBLISHED Published: 2021-06-30T19:07:02 Last Updated: 2024-08-04T00:05:52.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access. Additional Analyst Notes: - CVE Program Container: References: - https://k4m1ll0.com/cve-2021-34075.html
CVE ID: CVE-2021-34076 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-01-27T17:06:00.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HolaAsuka/CVE/issues/1
CVE ID: CVE-2021-34078 State: PUBLISHED Published: 2022-06-01T14:31:56 Last Updated: 2024-08-04T00:05:52.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.checkmarx.net/advisory/CX-2021-4785 - https://github.com/lifion/lifion-verify-deps/commit/be1133d5b78e3caa0004fa60207013dca4e1bf38
CVE ID: CVE-2021-34079 State: PUBLISHED Published: 2022-06-01T14:31:56 Last Updated: 2024-08-04T00:05:52.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.checkmarx.net/advisory/CX-2021-4786 - https://www.npmjs.com/package/docker-tester
CVE ID: CVE-2021-34080 State: PUBLISHED Published: 2022-06-01T14:31:55 Last Updated: 2024-08-04T00:05:52.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest() and the createCert() functions. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.checkmarx.net/advisory/CX-2021-4782
CVE ID: CVE-2021-34081 State: PUBLISHED Published: 2022-06-01T14:31:54 Last Updated: 2024-08-04T00:05:52.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.checkmarx.net/advisory/CX-2021-4780 - https://www.npmjs.com/package/gitsome
CVE ID: CVE-2021-34082 State: PUBLISHED Published: 2022-06-01T14:31:53 Last Updated: 2024-08-04T00:05:52.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.checkmarx.net/advisory/CX-2021-4783 - https://github.com/allenhwkim/proctree/blob/master/index.js#L46
CVE ID: CVE-2021-34083 State: PUBLISHED Published: 2022-06-01T14:31:52 Last Updated: 2024-08-04T00:05:52.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially exposing the server to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.checkmarx.net/advisory/CX-2021-4777 - https://github.com/PatNeedham/google-it/blob/v1.6.2/lib/googleIt.js#L59 - https://gith
kmarx.net/advisory/CX-2021-4777 - https://github.com/PatNeedham/google-it/blob/v1.6.2/lib/googleIt.js#L59 - https://github.com/PatNeedham/google-it/blob/v1.6.2/src/googleIt.js#L34
CVE ID: CVE-2021-34084 State: PUBLISHED Published: 2022-06-01T14:31:52 Last Updated: 2024-08-04T00:05:52.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function. Additional Analyst Notes: - CVE Program Container: References: - https://advisory.checkmarx.net/advisory/CX-2021-4776
CVE ID: CVE-2021-34085 State: PUBLISHED Published: 2022-05-11T17:34:29 Last Updated: 2024-08-04T00:05:52.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: Read access violation in the III_dequantize_sample function in mpglibDBL/layer3.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact, a different vulnerability than CVE-2017-9872. CVE-2017-14409, and CVE-2018-10778. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/drive/folders/1epm65c4_iC0zE5V_leoet4Jyk1Prz2p5?usp=sharing
CVE ID: CVE-2021-34086 State: PUBLISHED Published: 2022-01-10T01:12:48 Last Updated: 2024-08-04T00:05:52.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests. Additional Analyst Notes: - CVE Program Container: References: - https://ultimaker.com/3d-printers/ultimaker-s3 - https://ultimaker.com/3d-printers/ultimaker-s5 - https://ultimaker.com/3d-printers/ultimaker-3 - https://kth.diva-portal.org/smash/get/diva2:1623489/FULLTEXT01.pdf
CVE ID: CVE-2021-34087 State: PUBLISHED Published: 2022-01-10T01:10:25 Last Updated: 2024-08-04T00:05:52.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver can be used for clickjacking. This includes the settings page. Additional Analyst Notes: - CVE Program Container: References: - https://ultimaker.com/3d-printers/ultimaker-s3 - https://ultimaker.com/3d-printers/ultimaker-s5 - https://kth.diva-portal.org/smash/get/diva2:1623489/FULLTEXT01.pdf