Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-27278 State: PUBLISHED Published: 2021-04-22T17:50:14 Last Updated: 2024-08-03T20:48:16.195Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-22 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attack
issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the current user on the host system. Was ZDI-CAN-12130. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-412/
CVE ID: CVE-2021-27279 State: PUBLISHED Published: 2021-02-22T19:04:20 Last Updated: 2024-08-03T20:48:16.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode). Additional Analyst Notes: - CVE Program Container: References: - https://mybb.com/versions/1.8.25/ - https://github.com/mybb/mybb/security/advisories/GHSA-6483-hcpp-p75w - https://github.com/mybb/mybb/commit/cb781b49116bf5c4d8deca3e17498122b701677a
CVE ID: CVE-2021-27280 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T16:45:04.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/langhsu/mblog/issues/44 - https://github.com/langhsu/mblog/
CVE ID: CVE-2021-27285 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T16:17:56.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands via /opt/tsce4/torque6/bin/getJobsByShell. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fjh1997/CVE-2021-27285
CVE ID: CVE-2021-27288 State: PUBLISHED Published: 2021-04-14T13:48:25 Last Updated: 2024-08-03T20:48:16.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Comment" field in "/profile/activity" page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/X2Engine/X2CRM/issues/183
CVE ID: CVE-2021-27289 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-16T14:25:22.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12), where the Zigbee anti-replay mechanism - based on the frame counter field - is improperly implemented. As a result, an attacker within wireless range can resend captured packets with a higher sequence number, which the devices incorrectly accept as legitimate messages. This allows spoofed commands to be injected without authentication, triggering fal
rectly accept as legitimate messages. This allows spoofed commands to be injected without authentication, triggering false alerts and misleading the user through notifications in the mobile application used to monitor the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/49169 - https://www.youtube.com/watch?v=5IFUpRKEioA - https://www.youtube.com/watch?v=XFOy3wSlC9Q - https://www.youtube.com/watch?v=yc9IEt5IMmA - https://packetstormsecurity.com/files/160331/Ksix-Zigbee-Devices-Playback-Protection-Bypass.html - https://github.com/TheMalwareGuardian/CVE-2021-27289
CVE ID: CVE-2021-27290 State: PUBLISHED Published: 2021-03-12T21:47:41 Last Updated: 2024-08-03T20:48:16.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option. Additional Analyst Notes: - CVE Program Container: References: - https://npmjs.com - https://www.oracle.com/security-alerts/cpuoct2021.html - https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf - https://github.com/yetingli/SaveResults/blob/main/pdf
https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf - https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-27291 State: PUBLISHED Published: 2021-03-17T12:31:15 Last Updated: 2024-08-03T20:48:16.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/b-c-ds/b1a2cc0c68a35c57188575eb496de5ce - https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14 - https://lists.
188575eb496de5ce - https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14 - https://lists.debian.org/debian-lts-announce/2021/03/msg00024.html - https://www.debian.org/security/2021/dsa-4878 - https://www.debian.org/security/2021/dsa-4889 - https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSJRFHALQ7E3UV4FFMFU2YQ6LUDHAI55/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSLD67LFGXOX2K5YNESSWAS4AGZIJTUQ/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html
CVE ID: CVE-2021-27292 State: PUBLISHED Published: 2021-03-17T12:34:48 Last Updated: 2024-08-03T20:48:16.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14 - https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76 - https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111d
b-c-ds/6941d80d6b4e694df4bc269493b7be76 - https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566
CVE ID: CVE-2021-27293 State: PUBLISHED Published: 2021-07-12T10:47:01 Last Updated: 2024-08-03T20:48:16.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://restsharp.dev/ - https://github.com/restsharp/RestSharp/issues/1556
CVE ID: CVE-2021-27294 State: REJECTED Published: 2022-07-13T12:55:06 Last Updated: 2022-07-13T12:55:06 Description: No description available.
CVE ID: CVE-2021-27306 State: PUBLISHED Published: 2021-03-18T14:02:16 Last Updated: 2024-08-03T20:48:16.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT. Additional Analyst Notes: - CVE Program Container: References: - https://docs.konghq.com/enterprise/changelog/#core-1 - https://medium.com/%40sew.campos/cve-2021-27306-access-an-authenticated-route-on-kong-api-gateway-6ae3d81968a3
CVE ID: CVE-2021-27308 State: PUBLISHED Published: 2021-03-22T14:49:40 Last Updated: 2024-08-03T20:48:16.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/4images/4images/issues/3 - http://packetstormsecurity.com/files/162946/4Images-1.8-Cross-Site-Scripting.html
CVE ID: CVE-2021-27309 State: PUBLISHED Published: 2021-03-23T13:28:32 Last Updated: 2024-08-03T20:48:16.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22module%22%20xss.md
CVE ID: CVE-2021-27310 State: PUBLISHED Published: 2021-03-23T13:27:19 Last Updated: 2024-08-03T20:48:16.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22language%22%20xss.md
CVE ID: CVE-2021-27312 State: PUBLISHED Published: 2024-04-03T00:00:00 Last Updated: 2024-08-28T19:01:23.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via modules/gleez/classes/request.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gleez/cms/issues/805 - https://gist.github.com/LioTree/8d10d123d31f50db05a25586e62a87ba
CVE ID: CVE-2021-27314 State: PUBLISHED Published: 2021-03-04T23:32:50 Last Updated: 2024-08-03T20:48:16.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/161641/Doctor-Appointment-System-1.0-SQL-Injection.html
CVE ID: CVE-2021-27315 State: PUBLISHED Published: 2021-03-24T13:41:50 Last Updated: 2024-08-03T20:48:16.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/161641/Doctor-Appointment-System-1.0-SQL-Injection.html
CVE ID: CVE-2021-27316 State: PUBLISHED Published: 2021-03-24T13:44:58 Last Updated: 2024-08-03T20:48:16.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/161641/Doctor-Appointment-System-1.0-SQL-Injection.html
CVE ID: CVE-2021-27317 State: PUBLISHED Published: 2021-03-01T20:16:34 Last Updated: 2024-08-03T20:48:16.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the comment parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14182/doctor-appointment-system.html - http://packetstormsecurity.com/files/161574/Doctor-Appointment-System-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-27318 State: PUBLISHED Published: 2021-03-01T20:14:14 Last Updated: 2024-08-03T20:48:16.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the lastname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14182/doctor-appointment-system.html - http://packetstormsecurity.com/files/161574/Doctor-Appointment-System-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-27319 State: PUBLISHED Published: 2021-03-24T13:45:59 Last Updated: 2024-08-03T20:48:16.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/161642/Doctor-Appointment-System-1.0-Blind-SQL-Injection.html
CVE ID: CVE-2021-27320 State: PUBLISHED Published: 2021-03-24T13:46:28 Last Updated: 2024-08-03T20:48:16.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14182/doctor-appointment-system.html - http://packetstormsecurity.com/files/161642/Doctor-Appointment-System-1.0-Blind-SQL-Injection.html
CVE ID: CVE-2021-27328 State: PUBLISHED Published: 2021-02-19T18:23:22 Last Updated: 2024-08-03T20:48:16.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware and can read sensitive information, such as a password or decryption key. Additional Analyst Notes: - CVE Program Container: References: - http://yeastar.com - https://github.com/SQSamir/CVE-2021-27328 - http://packetstormsecurity.com/files/161560/Yeastar-TG400-GSM-Gateway-91.3.0.3-Path-Traversal.html
CVE ID: CVE-2021-27329 State: PUBLISHED Published: 2021-02-18T17:23:32 Last Updated: 2024-08-03T20:48:16.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Friendica 2021.01 allows SSRF via parse_url?binurl= for DNS lookups or HTTP requests to arbitrary domain names. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/friendica/friendica/issues/9929
CVE ID: CVE-2021-27330 State: PUBLISHED Published: 2021-02-25T15:11:58 Last Updated: 2024-08-03T20:48:16.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents. Additional Analyst Notes: - CVE Program Container: References: - http://www.triconsole.com/ - http://www.triconsole.com/php/calendar_datepicker.php - https://www.exploit-db.com/exploits/49597 - http://packetstormsecurity.com/files/161570/Triconsole
ndar_datepicker.php - https://www.exploit-db.com/exploits/49597 - http://packetstormsecurity.com/files/161570/Triconsole-3.75-Cross-Site-Scripting.html
CVE ID: CVE-2021-27332 State: PUBLISHED Published: 2021-07-22T18:46:48 Last Updated: 2024-08-03T20:48:16.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php. Additional Analyst Notes: - CVE Program Container: References: - http://casap.com - https://github.com/BigTiger2020/CASAP-Automated-Enrollment-System/blob/main/CASAP-Automated-Enrollment-System-6.md
CVE ID: CVE-2021-27335 State: PUBLISHED Published: 2021-02-18T17:51:19 Last Updated: 2024-08-03T20:48:16.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter. Additional Analyst Notes: - CVE Program Container: References: - https://hacked0x90.net/index.php/2021/02/15/kollectapp-insecure-java-deserialization/
CVE ID: CVE-2021-27338 State: PUBLISHED Published: 2021-07-20T11:50:24 Last Updated: 2024-08-03T20:48:16.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Faraday Edge before 3.7 allows XSS via the network/create/ page and its network name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.faraday.net/products/faradayedge - https://github.com/Pho03niX/CVE-2021-27338/blob/main/CVE-2021-27338
CVE ID: CVE-2021-27340 State: PUBLISHED Published: 2021-09-16T13:48:33 Last Updated: 2024-08-03T20:48:16.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/158 - https://github.com/OS4ED/openSIS-Classic/releases - https://github.com/OS4ED/openSIS-Classic/commit/f78407d5291c686c3f416073dcb9143f3a3d5489#diff-24b751f2072f058259d033016938101f9fa29884ebcc09ce7eb88def3421e5ba
CVE ID: CVE-2021-27341 State: PUBLISHED Published: 2021-09-16T13:47:48 Last Updated: 2024-08-03T20:48:16.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/158 - https://github.com/OS4ED/openSIS-Classic/releases - https://github.com/OS4ED/openSIS-Classic/commit/f78407d5291c686c3f416073dcb9143f3a3d5489#diff-24b751f2072f058259d033016938101f9fa29884ebcc09ce7eb88def3421e5ba
CVE ID: CVE-2021-27342 State: PUBLISHED Published: 2021-05-17T12:20:43 Last Updated: 2024-08-03T20:48:16.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumvent the anti-brute-force cool-down delay period via a timing-based side-channel attack Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10225 - https://github.com/guywhataguy/D-Link-CVE-2021-27342-exploit/blob/main/dlink-telnet-exploit-CVE-2021-27342.py - https://blog.whtaguy.c
.com/guywhataguy/D-Link-CVE-2021-27342-exploit/blob/main/dlink-telnet-exploit-CVE-2021-27342.py - https://blog.whtaguy.com/2021/05/d-link-router-cve-2021-27342.html
CVE ID: CVE-2021-27343 State: PUBLISHED Published: 2021-04-06T12:07:12 Last Updated: 2024-08-03T20:48:16.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: SerenityOS Unspecified is affected by: Buffer Overflow. The impact is: obtain sensitive information (context-dependent). The component is: /Userland/Libraries/LibCrypto/ASN1/DER.h Crypto::der_decode_sequence() function. The attack vector is: Parsing RSA Key ASN.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SerenityOS/serenity/issues/5317 - https://github.com/SerenityOS/serenity/pull/5344 - https://github.com/SerenityOS/serenity/commit/48fbf6a88d4822a1e5470cf08f29464511bd72c1
CVE ID: CVE-2021-27345 State: PUBLISHED Published: 2021-06-10T15:45:02 Last Updated: 2024-08-03T20:48:16.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ckolivas/lrzip/issues/164 - https://lists.debian.org/debian-lts-announce/2022/04/msg00012.html
CVE ID: CVE-2021-27347 State: PUBLISHED Published: 2021-06-10T15:37:06 Last Updated: 2024-08-03T20:48:16.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ckolivas/lrzip/issues/165 - https://lists.debian.org/debian-lts-announce/2022/04/msg00012.html
CVE ID: CVE-2021-27349 State: PUBLISHED Published: 2021-03-31T21:34:09 Last Updated: 2024-08-03T20:48:16.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/woo-order-export-lite/#developers
CVE ID: CVE-2021-27351 State: PUBLISHED Published: 2021-02-19T18:57:52 Last Updated: 2024-08-03T20:48:16.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session. Additional Analyst Notes: - CVE Program Container: References: - https://0ffsecninja.github.io/Telegram:CVE-2021-2735.html - https://security.gentoo.org/glsa/202105-07
CVE ID: CVE-2021-27352 State: PUBLISHED Published: 2021-03-29T15:28:05 Last Updated: 2024-08-03T20:48:16.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site after a successful login. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1kSDlPASBCgJEINxTSIsjMWrU4u4T5XCc/view?usp=sharing - https://www.ilch.de/ - https://github.com/xoffense/POC/blob/main/Ilch%202.1.42%20Open%20redirect
CVE ID: CVE-2021-27357 State: PUBLISHED Published: 2021-04-06T12:07:36 Last Updated: 2024-08-03T20:48:16.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: RIOT-OS 2020.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/issues/16018
CVE ID: CVE-2021-27358 State: PUBLISHED Published: 2021-03-18T19:43:04 Last Updated: 2024-08-03T20:48:16.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/grafana/blob/master/CHANGELOG.md - https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/ - https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17 - https://security.netapp.com/advisory/ntap-20210513-0007/