Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-20866 State: PUBLISHED Published: 2021-12-13T06:40:14 Last Updated: 2024-08-03T17:53:22.640Z Vendors: Delicious Brains Products: Advanced Custom Fields and Advanced Custom Fields Pro Problem Types: Missing authorization Description: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.advancedcustomfields.com/ - https://wordpress.org/plugins/advanced-custom-fields/ - https://jvn.jp/en/jp/JVN09136
://www.advancedcustomfields.com/ - https://wordpress.org/plugins/advanced-custom-fields/ - https://jvn.jp/en/jp/JVN09136401/index.html
CVE ID: CVE-2021-20867 State: PUBLISHED Published: 2021-12-13T06:40:16 Last Updated: 2024-08-03T17:53:22.983Z Vendors: Delicious Brains Products: Advanced Custom Fields and Advanced Custom Fields Pro Problem Types: Missing authorization Description: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.advancedcustomfields.com/ - https://wordpress.org/plugins/advanced-custom-fields/ - https://jvn.jp/en/jp/JVN09136401
www.advancedcustomfields.com/ - https://wordpress.org/plugins/advanced-custom-fields/ - https://jvn.jp/en/jp/JVN09136401/index.html
CVE ID: CVE-2021-20868 State: PUBLISHED Published: 2022-01-04T03:05:20 Last Updated: 2024-08-03T17:53:23.012Z Vendors: KONICA MINOLTA, INC. Products: bizhub series Problem Types: Incorrect authorization Description: Incorrect authorization vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earli
lier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizh
754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier, bizhub C3320i G00-B6 and earlier, bizhub 4750i/4050i G00-22 and earlier, bizhub 4700i G00-22 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, and bizhub 4752/4052 GC9-X4 and earlier) allows an attacker on the adjacent network to obtain user credentials if external server authentication is enabled via a specific SOAP message sent by an administrative user. Additional Analyst Notes: - CVE Program Container: References: - https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html - https://www.konicam
Container: References: - https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html - https://www.konicaminolta.jp/business/support/important/211224_01_01.html - https://jvn.jp/en/vu/JVNVU95192472/index.html - https://jvn.jp/vu/JVNVU95192472/index.html
CVE ID: CVE-2021-20869 State: PUBLISHED Published: 2022-01-04T03:05:22 Last Updated: 2024-08-03T17:53:22.996Z Vendors: KONICA MINOLTA, INC. Products: bizhub series Problem Types: Exposure of sensitive information to an unauthorized actor Description: Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub
7i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364
earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier, bizhub C3320i G00-B6 and earlier, bizhub 4750i/4050i G00-22 and earlier, bizhub 4700i G00-22 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, and bizhub 4752/4052 GC9-X4 and earlier) allows an attacker on the adjacent network to obtain some of user credentials if LDAP server authentication is enabled via a specific SOAP message. Additional Analyst Notes: - CVE Program Container: References: - https://www.konicaminolta.com/global/newsroom/topics
e. Additional Analyst Notes: - CVE Program Container: References: - https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html - https://www.konicaminolta.jp/business/support/important/211224_01_01.html - https://jvn.jp/en/vu/JVNVU95192472/index.html - https://jvn.jp/vu/JVNVU95192472/index.html
CVE ID: CVE-2021-20870 State: PUBLISHED Published: 2022-01-04T03:05:24 Last Updated: 2024-08-03T17:53:23.136Z Vendors: KONICA MINOLTA, INC. Products: bizhub series Problem Types: Improper handling of exceptional conditions Description: Improper handling of exceptional conditions vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earl
izhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier,
e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier, bizhub C3320i G00-B6 and earlier, bizhub 4750i/4050i G00-22 and earlier, bizhub 4700i G00-22 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, bizhub 4752/4052 GC9-X4 and earlier, bizhub C3850/C3350/3850FS, bizhub 4750/4050, bizhub C3110, bizhub C3100P) allows a physical attacker to obtain unsent scanned image data when scanned data transmission is stopped due to the network error by ejecting a HDD before the scan job times out. Additional Analyst Notes: - CVE Program Contai
due to the network error by ejecting a HDD before the scan job times out. Additional Analyst Notes: - CVE Program Container: References: - https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html - https://www.konicaminolta.jp/business/support/important/211224_01_01.html - https://jvn.jp/en/vu/JVNVU95192472/index.html - https://jvn.jp/vu/JVNVU95192472/index.html
CVE ID: CVE-2021-20871 State: PUBLISHED Published: 2022-01-04T03:05:25 Last Updated: 2024-08-03T17:53:22.675Z Vendors: KONICA MINOLTA, INC. Products: bizhub series Problem Types: Exposure of sensitive information to an unauthorized actor Description: Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub
earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier, bizhub C3320i G00-B6 and earlier, bizhub 4750i/4050i G00-22 and earlier, bizhub 4700i G00-22 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, and bizhub 4752/4052 GC9-X4 and earlier) allows an attacker on the adjacent network to obtain the credentials if the destination information including credentials are registered in the address book via a specific SOAP message. Additional Analyst Notes: - CVE Program Container: References: - https://www.ko
ddress book via a specific SOAP message. Additional Analyst Notes: - CVE Program Container: References: - https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html - https://www.konicaminolta.jp/business/support/important/211224_01_01.html - https://jvn.jp/en/vu/JVNVU95192472/index.html - https://jvn.jp/vu/JVNVU95192472/index.html
CVE ID: CVE-2021-20872 State: PUBLISHED Published: 2022-01-04T03:05:27 Last Updated: 2024-08-03T17:53:23.090Z Vendors: KONICA MINOLTA, INC. Products: bizhub series Problem Types: Protection mechanism failure Description: Protection mechanism failure vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8
B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and ear
, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, bizhub 4752/4052 GC9-X4 and earlier) allows a physical attacker to bypass the firmware integrity verification and to install malicious firmware. Additional Analyst Notes: - CVE Program Container: References: - https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html - https://www.konicaminolta.jp/business/support/important/211224_01_01.html - https://jvn.jp/en/vu/JVNVU95192472/index.html - https://jvn.jp/vu/JVNVU95192472/index.html
CVE ID: CVE-2021-20873 State: PUBLISHED Published: 2021-12-28T01:30:12 Last Updated: 2024-08-03T17:53:23.086Z Vendors: Yappli, Inc. Products: Yappli Problem Types: Improper Authorization in Handler for Custom URL Scheme Description: Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may be directed to unintended sites via a specially crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://support.yappli.co.jp/hc/ja/articles/
afted URL. Additional Analyst Notes: - CVE Program Container: References: - https://support.yappli.co.jp/hc/ja/articles/4410249902745 - https://jvn.jp/en/jp/JVN66422035/index.html
CVE ID: CVE-2021-20874 State: PUBLISHED Published: 2021-12-24T06:30:29 Last Updated: 2024-08-03T17:53:23.075Z Vendors: Japan Total System Co.,Ltd. Products: GroupSession Free edition, GroupSession byCloud, GroupSession ZION Problem Types: Incorrect Permission Assignment for Critical Resource Description: Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container:
the server and obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://groupsession.jp/info/info-news/security20211220 - https://jvn.jp/en/jp/JVN79798166/index.html
CVE ID: CVE-2021-20875 State: PUBLISHED Published: 2021-12-24T06:30:30 Last Updated: 2024-08-03T17:53:23.086Z Vendors: Japan Total System Co.,Ltd. Products: GroupSession Free edition, GroupSession byCloud, GroupSession ZION Problem Types: Open Redirect Description: Open redirect vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks by having a user to access a specially crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://groupsession.jp/info/info-news/se
crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://groupsession.jp/info/info-news/security20211220 - https://jvn.jp/en/jp/JVN79798166/index.html
CVE ID: CVE-2021-20876 State: PUBLISHED Published: 2021-12-24T06:30:32 Last Updated: 2024-08-03T17:53:23.073Z Vendors: Japan Total System Co.,Ltd. Products: GroupSession Free edition, GroupSession byCloud, GroupSession ZION Problem Types: Path Traversal Description: Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on the published site's server via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://groupsessi
te's server via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://groupsession.jp/info/info-news/security20211220 - https://jvn.jp/en/jp/JVN79798166/index.html
CVE ID: CVE-2021-20877 State: PUBLISHED Published: 2022-02-08T10:30:31 Last Updated: 2024-08-03T17:53:23.123Z Vendors: Canon Products: Canon laser printers and small office multifunctional printers Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP11
W, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://cweb.canon.jp/e-support/info/211221xss.html - https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Print
l - https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scripting - https://www.canon-europe.com/support/product-security-latest-news/ - https://jvn.jp/en/jp/JVN64806328/index.html - https://jvn.jp/jp/JVN64806328/index.html
CVE ID: CVE-2021-20986 State: PUBLISHED Published: 2021-02-16T16:35:48.460903Z Last Updated: 2024-09-16T23:46:42.601Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hilscher, Pepper+Fuchs Products: PROFINET IO Device, PCV/PXV/PGV, PXV/PGV B28 Profisafe, OHV, OIT, PHA, WCS Problem Types: CWE-787 Description: A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication. Additional Analyst Notes: - CVE Program Container: References: - https://kb.hilscher.com/display/ISMS/2020-12-03+Denial+of+Service+vulnerability+in+P
VE Program Container: References: - https://kb.hilscher.com/display/ISMS/2020-12-03+Denial+of+Service+vulnerability+in+PROFINET+IO+Device - https://cert.vde.com/en-us/advisories/vde-2021-006
CVE ID: CVE-2021-20987 State: PUBLISHED Published: 2021-02-16T16:37:09.731457Z Last Updated: 2024-09-16T16:23:03.443Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hilscher, Pepper+Fuchs Products: EtherNet/IP Core V2, PCV/PXV/PGV, WCS Problem Types: CWE-787 Description: A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through network or make devices crash without recovery. Additional Analyst Notes: - CVE Program Container: References: - https://kb.hilscher.com/pages/viewpage.action?pageId=108969480 - https://cert.vde.com/en-us/advisories/vde-2021-007
CVE ID: CVE-2021-20988 State: PUBLISHED Published: 2021-05-13T13:45:24.410430Z Last Updated: 2024-09-16T17:49:09.628Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hilscher, Pepperl+Fuchs Products: rcX RTOS, Ethernet IO Modules ICE1-16, Ethernet IO Modules ICE1-8 Problem Types: CWE-119 Description: In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. This may lead to a denial of service of the affected device. Additional Analyst Notes: - CVE Program Container: References: - https://kb.hilscher.com/display/ISMS/2019-04-10+Wrong+handling+of+the+UDP+checksum - https://cert.vde.
er: References: - https://kb.hilscher.com/display/ISMS/2019-04-10+Wrong+handling+of+the+UDP+checksum - https://cert.vde.com/de-de/advisories/vde-2021-018
CVE ID: CVE-2021-20989 State: PUBLISHED Published: 2021-04-19T14:05:02.362822Z Last Updated: 2024-09-17T00:42:24.901Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Fibar Group S.A Products: Fibaro Home Center Problem Types: CWE-295 Description: Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is re
sed to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ - http://seclists.org/fulldisclosure/2021/Apr/27 - http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html
CVE ID: CVE-2021-20990 State: PUBLISHED Published: 2021-04-19T14:05:02.510969Z Last Updated: 2024-09-16T16:42:28.116Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Fibar Group S.A Products: Fibaro Home Center Problem Types: CWE-306 Description: In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode. Additional Analyst Notes: - CVE Program Container: References: - https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ - http://seclists.org/fulld
ram Container: References: - https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ - http://seclists.org/fulldisclosure/2021/Apr/27 - http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html
CVE ID: CVE-2021-20991 State: PUBLISHED Published: 2021-04-19T14:05:02.629936Z Last Updated: 2024-09-16T17:42:55.068Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fibar Group S.A Products: Fibaro Home Center Problem Types: CWE-78 Description: In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ - http://seclists.org/fulldisclosure/2021/Apr/27 - http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MIT
r/ - http://seclists.org/fulldisclosure/2021/Apr/27 - http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html
CVE ID: CVE-2021-20992 State: PUBLISHED Published: 2021-04-19T14:05:02.730887Z Last Updated: 2024-09-17T02:36:30.816Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fibar Group S.A Products: Fibaro Home Center Problem Types: CWE-319 Description: In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ - http://seclists.org/fulldisclosure/2021/Apr/27 - htt
- https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ - http://seclists.org/fulldisclosure/2021/Apr/27 - http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html