Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-40223 State: PUBLISHED Published: 2021-09-09T11:04:50 Last Updated: 2024-08-04T02:27:31.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configuration (User Configuration dialog, Task Configuration dialog and set logging filter dialog). This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts). The XSS payload will be triggered when the user accesses some specific sections of the application. Additional Analyst Notes: - CVE Program Container: References: - https://github
me specific sections of the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/asang17/CVE-2021-XSS
CVE ID: CVE-2021-40226 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-05-01T17:57:08.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: xpdfreader 4.03 is vulnerable to Buffer Overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=42185
CVE ID: CVE-2021-40238 State: PUBLISHED Published: 2021-09-15T16:19:57 Last Updated: 2024-08-04T02:27:31.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs" functionality of Webuzo. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8e - https://www.webuzo.com/blog/webuzo-2-9-0-launched/
CVE ID: CVE-2021-40239 State: PUBLISHED Published: 2021-10-11T18:20:34 Last Updated: 2024-08-04T02:27:31.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in the latest version of Miniftpd in the do_retr function in ftpproto.c Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Gabe-commiter/Miniftpd/issues/2
CVE ID: CVE-2021-40241 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-07T13:43:45.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: xfig 3.2.7 is vulnerable to Buffer Overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992395 - https://lists.debian.org/debian-lts-announce/2023/03/msg00005.html
CVE ID: CVE-2021-40247 State: PUBLISHED Published: 2022-01-21T18:58:35 Last Updated: 2024-08-04T02:27:31.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/B%26E%20Tracker-by:oretnom23-v1.0 - https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
CVE ID: CVE-2021-40260 State: PUBLISHED Published: 2021-11-08T20:14:01 Last Updated: 2024-08-04T02:27:31.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester Tailor Management 1.0 via the (1) eid parameter in (a) partedit.php and (b) customeredit.php, the (2) id parameter in (a) editmeasurement.php and (b) addpayment.php, and the (3) error parameter in index.php. Additional Analyst Notes: - CVE Program Container: References: - https://sisl.lab.uic.edu/projects/chess/tailor-management/
CVE ID: CVE-2021-40261 State: PUBLISHED Published: 2021-11-08T20:42:39 Last Updated: 2024-08-04T02:27:31.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the (1) user_username and (2) category parameters in save_class.php, the (3) firstname, (4) class, and (5) status parameters in student_table.php, the (6) category and (7) class_name parameters in add_class1.php, the (8) fname, (9) mname,(10) lname, (11) address, (12) class, (13) gfname, (14) gmname, (15) glname, (16) rship, (17) status, (18) transport, and (19) route parameters in add_student.php, the (20) fn
gmname, (15) glname, (16) rship, (17) status, (18) transport, and (19) route parameters in add_student.php, the (20) fname, (21) mname, (22) lname, (23) address, (24) class, (25) fgname, (26) gmname, (27) glname, (28) rship, (29) status, (30) transport, and (31) route parameters in save_stud.php,the (32) status, (33) fname, and (34) lname parameters in add_user.php, the (35) username, (36) firstname, and (37) status parameters in users.php, the (38) fname, (39) lname, and (40) status parameters in save_user.php, and the (41) activity_log, (42) aprjun, (43) class, (44) janmar, (45) Julsep,(46) octdec, (47) Students and (48) users parameters in table_name. Additional Analyst Notes: - CVE Prog
ar, (45) Julsep,(46) octdec, (47) Students and (48) users parameters in table_name. Additional Analyst Notes: - CVE Program Container: References: - https://sisl.lab.uic.edu/projects/chess/casap-automated-enrollment-system/
CVE ID: CVE-2021-40262 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T18:09:23.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack exhaustion issue was discovered in FreeImage before 1.18.0 via the Validate function in PluginRAW.cpp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/freeimage/bugs/338/
CVE ID: CVE-2021-40263 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T18:07:32.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/freeimage/bugs/336/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6GKMK74POW3RU7F4HLUJE7XEFLQDO35/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFRQ76ZDPSWT7OH6FJDLSFWBXVBE6JDN/
CVE ID: CVE-2021-40264 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T18:05:24.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: NULL pointer dereference vulnerability in FreeImage before 1.18.0 via the FreeImage_CloneTag function inFreeImageTag.cpp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/freeimage/bugs/335/
CVE ID: CVE-2021-40265 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T18:03:08.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap overflow bug exists FreeImage before 1.18.0 via ofLoad function in PluginJPEG.cpp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/freeimage/bugs/337/
CVE ID: CVE-2021-40266 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T18:00:41.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is vulnerabile to null pointer dereference. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/freeimage/bugs/334/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6GKMK74POW3RU7F4HLUJE7XEFLQDO35/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFRQ76ZDPSWT7OH6FJDLSFWBXVBE6JDN/
CVE ID: CVE-2021-40272 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T20:19:41.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hosakauk/exploits/blob/master/itrs_op5_monitor_xss.pdf
CVE ID: CVE-2021-40279 State: PUBLISHED Published: 2021-12-09T15:54:43 Last Updated: 2024-08-04T02:27:31.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/aaaahuia/b99596c6de9bd6f60e0ddb7bf0bd13c4
CVE ID: CVE-2021-40280 State: PUBLISHED Published: 2021-12-09T15:58:56 Last Updated: 2024-08-04T02:27:31.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/aaaahuia/1fd31c1ebcddfe4c95268fa4f31fc312
CVE ID: CVE-2021-40281 State: PUBLISHED Published: 2021-12-09T16:18:51 Last Updated: 2024-08-04T02:27:31.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/aaaahuia/583b062b686cdff27554e3c6fa5ac94e
CVE ID: CVE-2021-40282 State: PUBLISHED Published: 2021-12-09T16:27:28 Last Updated: 2024-08-04T02:27:31.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary users. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/aaaahuia/1343e3aa06b031ea621b5701cebcee3e
CVE ID: CVE-2021-40284 State: PUBLISHED Published: 2021-09-09T16:18:25 Last Updated: 2024-08-04T02:27:31.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service. This vulnerability exists in the web interface "/cgi-bin/New_GUI/Igmp.asp". Authenticated remote attackers can trigger this vulnerability by sending a long string in parameter 'igmpsnoopEnable' via an HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10245
CVE ID: CVE-2021-40285 State: PUBLISHED Published: 2022-08-26T12:50:32 Last Updated: 2024-08-04T02:27:31.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/danpros/htmly/issues/462
CVE ID: CVE-2021-40288 State: PUBLISHED Published: 2021-12-07T19:13:36 Last Updated: 2024-08-04T02:27:31.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in TP-Link AX10v1 before V1_211014, allows a remote unauthenticated attacker to disconnect an already connected wireless client via sending with a wireless adapter specific spoofed authentication frames Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/us/support/download/archer-ax10/v1/#Firmware
CVE ID: CVE-2021-40289 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-05-01T17:47:45.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/phachon/mm-wiki/issues/319
CVE ID: CVE-2021-40292 State: PUBLISHED Published: 2021-10-12T17:31:05 Last Updated: 2024-08-04T02:27:31.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zyx0814/dzzoffice/issues/195
CVE ID: CVE-2021-40303 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-05-01T15:33:04.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/50097
CVE ID: CVE-2021-40309 State: PUBLISHED Published: 2021-09-24T15:09:59 Last Updated: 2024-08-04T02:27:31.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cp_id_miss_attn parameter from TakeAttendance.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request as a user with access to "Take Attendance" functionality to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic - https://www.exploit-db.com/exploits/50249 - https:
m Container: References: - https://github.com/OS4ED/openSIS-Classic - https://www.exploit-db.com/exploits/50249 - https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md
CVE ID: CVE-2021-40310 State: PUBLISHED Published: 2021-09-24T15:07:24 Last Updated: 2024-08-04T02:27:31.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic - https://www.youtube.com/watch?v=aPKPUDmmYpc - https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md
CVE ID: CVE-2021-40313 State: PUBLISHED Published: 2021-12-06T20:22:58 Last Updated: 2024-08-04T02:27:31.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/1469
CVE ID: CVE-2021-40317 State: PUBLISHED Published: 2022-05-26T12:04:52 Last Updated: 2024-08-04T02:27:31.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/1470
CVE ID: CVE-2021-40323 State: PUBLISHED Published: 2021-10-04T05:37:50 Last Updated: 2024-08-04T02:27:31.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a - https://github.com/cobbler/cobbler/releases/tag/v3.3.0
CVE ID: CVE-2021-40324 State: PUBLISHED Published: 2021-10-04T05:39:51 Last Updated: 2024-08-04T02:27:31.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a - https://github.com/cobbler/cobbler/releases/tag/v3.3.0
CVE ID: CVE-2021-40325 State: PUBLISHED Published: 2021-10-04T05:43:54 Last Updated: 2024-08-04T02:27:31.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobbler before 3.3.0 allows authorization bypass for modification of settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a - https://github.com/cobbler/cobbler/releases/tag/v3.3.0
CVE ID: CVE-2021-40326 State: PUBLISHED Published: 2022-08-29T04:54:36 Last Updated: 2024-08-04T02:27:31.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker can write to an arbitrary file, and display controlled contents, during signature verification. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2021-40327 State: PUBLISHED Published: 2022-01-13T15:31:35 Last Updated: 2024-08-04T02:27:31.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/support/arm-security-updates - https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/ - https://tf-m-user-guide.trustedfirmware.org/
ty-updates - https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/ - https://tf-m-user-guide.trustedfirmware.org/docs/security/security_advisories/profile_small_key_id_encoding_vulnerability.html
CVE ID: CVE-2021-40329 State: PUBLISHED Published: 2021-09-27T16:22:11 Last Updated: 2024-08-04T02:27:31.919Z Vendors: Ping Identity Products: PingFederate Problem Types: Incorrect Access Control Description: The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pingidentity.com/bundle/pingfederate-103/page/cou1615333347158.html
CVE ID: CVE-2021-40330 State: PUBLISHED Published: 2021-08-31T00:00:00 Last Updated: 2024-08-04T02:27:31.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/git/git/commit/a02ea577174ab8ed18f847cf1693f213e0b9c473 - https://github.com/git/git/compare/v2.30.0...v2.30.1 - https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html
CVE ID: CVE-2021-40331 State: PUBLISHED Published: 2023-05-05T07:55:06.554Z Last Updated: 2024-10-11T17:07:19.817Z Vendors: Apache Software Foundation Products: Apache Ranger Hive Plugin Problem Types: CWE-732 Description: An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
rsion 2.4.0 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/s68yls6cnkdmzn1k4hqt50vs6wjvt2rn
CVE ID: CVE-2021-40333 State: PUBLISHED Published: 2021-12-02T18:29:36.828706Z Last Updated: 2024-09-17T00:15:37.686Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) Vendors: Hitachi Energy Products: FOX61x, XCM20 Problem Types: CWE-521 Description: Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000062
Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000062&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000069&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40334 State: PUBLISHED Published: 2021-12-02T18:28:18.525907Z Last Updated: 2024-09-16T23:11:57.958Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hitachi Energy Products: FOX61x, XCM20 Problem Types: CWE-431 Description: Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker that exploits the vulnerability by activating SSH on port TCP 5558 to cause disruption to the NMS and NE communication. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A. Additional Analyst Notes: - CVE Program Container: Reference
prior to R15A. Hitachi Energy XCM20 versions prior to R15A. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000062&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000069&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40335 State: PUBLISHED Published: 2022-07-25T14:32:14.467555Z Last Updated: 2024-09-16T23:40:51.199Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Hitachi Energy Products: MSM Problem Types: CWE-352 Description: A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery (CSRF), which if exploited could lead an attacker to gain unauthorized access to the web application and perform an unwanted operation on it without the knowledge of the legitimate user
rized access to the web application and perform an unwanted operation on it without the knowledge of the legitimate user. An attacker, who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., link is sent per E-Mail, could perform harmful command on MSM through its web server interface. This issue affects: Hitachi Energy MSM V2.2 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000085&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40336 State: PUBLISHED Published: 2022-07-25T14:34:20.375500Z Last Updated: 2024-09-17T02:58:14.314Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Hitachi Energy Products: MSM Problem Types: CWE-113 Description: A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session cookies. Thus, an attacker who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to