Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-33554 State: PUBLISHED Published: 2021-09-13T17:55:49.767891Z Last Updated: 2024-09-17T03:08:06.366Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Geutebrück Products: E2 Series, Encoder G-Code Problem Types: CWE-78 Description: Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/ - https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03
CVE ID: CVE-2021-33555 State: PUBLISHED Published: 2021-08-31T10:32:52.841146Z Last Updated: 2024-09-17T01:36:42.946Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Phoenix Contact Products: WHA-GW-F2D2-0-AS- Z2-ETH, WHA-GW-F2D2-0-AS- Z2-ETH.EIP Problem Types: CWE-22 Description: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2021-027
CVE ID: CVE-2021-33557 State: PUBLISHED Published: 2021-06-17T18:14:52 Last Updated: 2024-08-03T23:50:43.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field. Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=28552 - https://mantisbt.org/blog/archives/mantisbt/699
CVE ID: CVE-2021-33558 State: PUBLISHED Published: 2021-05-27T00:00:00 Last Updated: 2024-08-03T23:50:43.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not part of Boa. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sourceforge.net/projects/boa/files/boa/0.94.13/ - https://github.com/mdanzaruddin/CVE-2021-33558. - https://github.com/mdanzar
forge.net/projects/boa/files/boa/0.94.13/ - https://github.com/mdanzaruddin/CVE-2021-33558. - https://github.com/mdanzaruddin/CVE-2021-33558./issues/1
CVE ID: CVE-2021-33560 State: PUBLISHED Published: 2021-06-08T00:00:00 Last Updated: 2024-08-03T23:50:43.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP. Additional Analyst Notes: - CVE Program Container: References: - https://dev.gnupg.org/T5328 - https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7OAP
6/msg00021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://dev.gnupg.org/T5466 - https://dev.gnupg.org/T5305 - https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61 - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.gentoo.org/glsa/202210-13
CVE ID: CVE-2021-33561 State: PUBLISHED Published: 2021-05-24T22:33:22 Last Updated: 2024-08-03T23:50:43.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopizer-ecommerce/shopizer/commit/197f8c78c8f673b957e41ca2c823afc654c19271 - h
tainer: References: - https://github.com/shopizer-ecommerce/shopizer/commit/197f8c78c8f673b957e41ca2c823afc654c19271 - https://www.exploit-db.com/exploits/49901 - https://github.com/shopizer-ecommerce/shopizer/compare/2.16.0...2.17.0
CVE ID: CVE-2021-33562 State: PUBLISHED Published: 2021-05-24T22:33:12 Last Updated: 2024-08-03T23:50:43.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopizer-ecommerce/shopizer/commit/197f8c78c8f673b957e41ca2c823afc654c19271 - https://www.exploit-db.com/exploits/49901 - https://github.com/shopizer-ecommerce/shopizer/compare/2.16.0...2.1
c19271 - https://www.exploit-db.com/exploits/49901 - https://github.com/shopizer-ecommerce/shopizer/compare/2.16.0...2.17.0
CVE ID: CVE-2021-33563 State: PUBLISHED Published: 2021-05-24T22:45:08 Last Updated: 2024-08-03T23:50:43.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1-other-koel/koel/ - https://github.com/koel/koel/releases/tag/v5.1.4
CVE ID: CVE-2021-33564 State: PUBLISHED Published: 2021-05-29T13:19:16 Last Updated: 2024-08-03T23:50:43.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/markevans/dragonfly/issues/513 - https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e8
s://github.com/markevans/dragonfly/issues/513 - https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5 - https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0 - https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yaml - https://github.com/mlr0p/CVE-2021-33564 - https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/
CVE ID: CVE-2021-33570 State: PUBLISHED Published: 2021-05-25T21:06:34 Last Updated: 2024-08-03T23:50:43.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Paxa/postbird/issues/132 - https://github.com/Paxa/postbird/issues/133 - https://github.com/Paxa/postbird/issues/134 - https://githu
d/issues/132 - https://github.com/Paxa/postbird/issues/133 - https://github.com/Paxa/postbird/issues/134 - https://github.com/Tridentsec-io/postbird - http://packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.html - http://packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.html - https://www.exploit-db.com/exploits/49910 - https://tridentsec.io/blogs/postbird-cve-2021-33570/
CVE ID: CVE-2021-33571 State: PUBLISHED Published: 2021-06-08T00:00:00 Last Updated: 2024-08-03T23:50:43.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) . Additional Analyst Notes: - CVE Program Container: References: - https://docs.djangoproject.com/en/3.2/releases/security/ - https://groups.google.com/g/django-announce/c/sPyjSK
ences: - https://docs.djangoproject.com/en/3.2/releases/security/ - https://groups.google.com/g/django-announce/c/sPyjSKMi8Eo - https://www.djangoproject.com/weblog/2021/jun/02/security-releases/ - https://security.netapp.com/advisory/ntap-20210727-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ - https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc - https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e - https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
CVE ID: CVE-2021-33572 State: PUBLISHED Published: 2021-06-21T11:10:32.776657Z Last Updated: 2024-09-16T23:52:06.428Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: F-Secure Products: F-Secure Products Problem Types: CWE-476 Description: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure products can crash while scanning larger packages/fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en
) of the Anti-Virus engine. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame - https://www.f-secure.com/en/business/support-and-downloads/security-advisories
CVE ID: CVE-2021-33574 State: PUBLISHED Published: 2021-05-25T00:00:00 Last Updated: 2024-08-03T23:50:43.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=27896 - https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1 - https://lists.fedorapr
e.org/bugzilla/show_bug.cgi?id=27896 - https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/ - https://security.netapp.com/advisory/ntap-20210629-0005/ - https://security.gentoo.org/glsa/202107-07 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
CVE ID: CVE-2021-33575 State: PUBLISHED Published: 2021-05-25T22:52:02 Last Updated: 2024-08-03T23:50:43.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PixarAnimationStudios/ruby-jss/blob/e6d48dd8c77f9275c76787d60d3472615fcd9b77/CHANGES.md#160---2021-05-24 - https://github.com/patsplat/plist/tree/ce8f9ae42a114f603ea200c955e420782bffc4ad#label-Security+considerations
CVE ID: CVE-2021-33576 State: PUBLISHED Published: 2021-06-18T10:53:06 Last Updated: 2024-08-03T23:50:43.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0011.md - https://www.cleo.com/cleo-lexicom
CVE ID: CVE-2021-33577 State: PUBLISHED Published: 2021-06-18T10:53:15 Last Updated: 2024-08-03T23:50:43.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0011.md - https://www.cleo.com/cleo-lexicom
CVE ID: CVE-2021-33578 State: PUBLISHED Published: 2021-07-13T13:54:42 Last Updated: 2024-08-03T23:50:43.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading to the ability to bypass authentication, exfiltrate Structured Query Language (SQL) records, and manipulate data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE ID: CVE-2021-33580 State: PUBLISHED Published: 2021-08-18T07:50:10 Last Updated: 2024-08-03T23:50:43.188Z Vendors: Apache Software Foundation Products: Apache Roller Problem Types: CWE-400 Description: User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2. Additional Analyst Notes: - CVE Program Container: R
ng on the server side. This problem has been fixed in Roller 6.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r9d967d80af941717573e531db2c7353a90bfd0886e9b5d5d79f75506%40%3Cuser.roller.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/08/18/1
CVE ID: CVE-2021-33581 State: PUBLISHED Published: 2022-03-30T21:47:48 Last Updated: 2024-08-03T23:50:43.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a PPM connection. This occurs in com.idsscheer.ppmmashup.web.webservice.impl.ZPrestoAdminWebService. Additional Analyst Notes: - CVE Program Container: References: - https://www.softwareag.com/corporate/products/az/mashzone_nextgen/default - https://github.com/blackarrowsec/advisories/tree/master/2021/CVE-2021-33581
CVE ID: CVE-2021-33582 State: PUBLISHED Published: 2021-09-01T05:32:49 Last Updated: 2024-08-03T23:50:43.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16. Additional Analyst Notes: - CVE Program Container: References: - https://www.cyrusimap.org/imap/download/release-notes/index.html - https://github.com/cyrusimap/cyrus-imapd/security/advisories - https://github.com/cyrusimap/cyrus-imapd/commits/
.html - https://github.com/cyrusimap/cyrus-imapd/security/advisories - https://github.com/cyrusimap/cyrus-imapd/commits/master - https://cyrus.topicbox.com/groups/announce/T3dde0a2352462975-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-released - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJZB45QBUN7CZFGOWCZYUYACNBTX7LVS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html
CVE ID: CVE-2021-33583 State: PUBLISHED Published: 2021-09-30T19:19:51 Last Updated: 2024-08-03T23:50:43.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file. Additional Analyst Notes: - CVE Program Container: References: - https://www.compass-security.com/fileadmin/Research/Advisories/2021-12_CSNC-2021-012_timeCard_Hardcoded_Credentials.txt
CVE ID: CVE-2021-33586 State: PUBLISHED Published: 2021-05-27T05:00:36 Last Updated: 2024-08-03T23:50:43.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue. Additional Analyst Notes: - CVE Program Container: References: - https://docs.inspircd.org/security/2021-01/ - https://github.com/inspircd/inspircd/commit/4350a11c663b0d75f8119743bffb7736d87abd4d - https://security.gentoo.org/glsa/202107-22
CVE ID: CVE-2021-33587 State: PUBLISHED Published: 2021-05-28T00:00:00 Last Updated: 2024-08-03T23:50:43.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fb55/css-what/releases/tag/v5.0.1 - https://security.netapp.com/advisory/ntap-20210706-0007/ - https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html
CVE ID: CVE-2021-33589 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-04T21:22:34.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ribose.com/feedback/security - https://open.ribose.com/advisories/ra-2021-05-30/#CVE-2021-33589
CVE ID: CVE-2021-33590 State: PUBLISHED Published: 2021-05-27T10:57:50 Last Updated: 2024-08-03T23:50:43.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: GattLib 0.3-rc1 has a stack-based buffer over-read in get_device_path_from_mac in dbus/gattlib.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/labapart/gattlib/issues/219
CVE ID: CVE-2021-33591 State: PUBLISHED Published: 2021-05-28T10:50:09 Last Updated: 2024-08-03T23:50:43.266Z Vendors: NAVER Products: Naver Comic Viewer Problem Types: CWE-489 Description: An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2021-33591
CVE ID: CVE-2021-33592 State: PUBLISHED Published: 2021-07-19T05:55:10 Last Updated: 2024-08-03T23:50:43.175Z Vendors: NAVER Products: NAVER Toolbar Problem Types: CWE-20 Description: NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in filename parameter can be the cause of bypassing code signing check function. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2021-33592
CVE ID: CVE-2021-33593 State: PUBLISHED Published: 2021-11-02T06:20:09 Last Updated: 2024-08-03T23:50:43.208Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-451 Description: Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2021-43059
CVE ID: CVE-2021-33594 State: PUBLISHED Published: 2021-08-11T10:28:33 Last Updated: 2024-08-03T23:50:43.211Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: F-Secure Products: F-Secure Mobile Security Problem Types: F-Secure Safe browser for Android vulnerable to Address Bar Spoofing Description: An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted a malicious URL, it appears like a legitimate one on the address bar, while the content comes from other domain and presented in a window, covering the original content. A remote attacker can leverage this to perform address bar spoofing attack. Ad
a window, covering the original content. A remote attacker can leverage this to perform address bar spoofing attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame - https://www.f-secure.com/en/business/support-and-downloads/security-advisories - https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-33594
CVE ID: CVE-2021-33595 State: PUBLISHED Published: 2021-08-11T10:28:27 Last Updated: 2024-08-03T23:50:43.177Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: F-Secure Products: F-Secure Mobile Security Problem Types: F-Secure Safe browser for iOS vulnerable to Address Bar Spoofing Description: A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. A remote attacker can leverage this to perform address bar spoofing attack. Additional Analyst Notes: - CVE Program Container: Refer
acker can leverage this to perform address bar spoofing attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame - https://www.f-secure.com/en/business/support-and-downloads/security-advisories - https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-33595
CVE ID: CVE-2021-33596 State: PUBLISHED Published: 2021-08-05T19:26:50 Last Updated: 2024-08-03T23:50:43.276Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: F-Secure Products: F-Secure Mobile Security Problem Types: Fake Apple login prompt in F-Secure SAFE browser for iOS Description: Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded malicious redirect while using F-Secure Safe Browser for iOS. Additional Analyst Notes: -