Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-20035 State: PUBLISHED Published: 2021-09-27T17:20:12.000Z Last Updated: 2025-10-21T23:25:31.035Z Vendors: SonicWall Products: SMA100 Problem Types: CWE-78 Description: Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022
CVE ID: CVE-2021-20037 State: PUBLISHED Published: 2021-09-21T08:50:11 Last Updated: 2024-08-03T17:30:07.615Z Vendors: SonicWall Products: SonicWall Global VPN Client Problem Types: CWE-276 Description: SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalation which potentially allows command execution in the host operating system. This vulnerability impacts GVC 4.10.5 installer and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0024
CVE ID: CVE-2021-20038 State: PUBLISHED Published: 2021-12-08T09:55:20.000Z Last Updated: 2025-10-21T23:25:23.415Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-121 Description: A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/S
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 - https://github.com/jbaines-r7/badblood - https://www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2/
CVE ID: CVE-2021-20039 State: PUBLISHED Published: 2021-12-08T09:55:21.000Z Last Updated: 2025-09-05T17:09:47.136Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-78 Description: Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 - http://packetstormsecurity.com/files/165563/SonicWall-SMA-100-Series-Aut
al.sonicwall.com/vuln-detail/SNWLID-2021-0026 - http://packetstormsecurity.com/files/165563/SonicWall-SMA-100-Series-Authenticated-Command-Injection.html
CVE ID: CVE-2021-20040 State: PUBLISHED Published: 2021-12-08T09:55:23 Last Updated: 2024-08-03T17:30:07.370Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-23 Description: A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE ID: CVE-2021-20041 State: PUBLISHED Published: 2021-12-08T09:55:24 Last Updated: 2024-08-03T17:30:07.021Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-835 Description: An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles resulting in a loop with unreachable exit condition. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE ID: CVE-2021-20042 State: PUBLISHED Published: 2021-12-08T09:55:25 Last Updated: 2024-08-03T17:30:07.516Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-441 Description: An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE ID: CVE-2021-20043 State: PUBLISHED Published: 2021-12-08T09:55:27 Last Updated: 2024-08-03T17:30:07.600Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-122 Description: A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the nobody user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE ID: CVE-2021-20044 State: PUBLISHED Published: 2021-12-08T09:55:28 Last Updated: 2024-08-03T17:30:07.392Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-78 Description: A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE ID: CVE-2021-20045 State: PUBLISHED Published: 2021-12-08T09:55:29 Last Updated: 2024-08-03T17:30:07.572Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-120 Description: A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potentially execute code as the 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE ID: CVE-2021-20046 State: PUBLISHED Published: 2022-01-07T03:00:11 Last Updated: 2024-08-03T17:30:07.777Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-121 Description: A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0027
CVE ID: CVE-2021-20047 State: PUBLISHED Published: 2021-12-08T09:55:31 Last Updated: 2024-08-03T17:30:07.429Z Vendors: SonicWall Products: SonicWall Global VPN Client Problem Types: CWE-427 Description: SonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search Order Hijacking vulnerability. Successful exploitation via a local attacker could result in remote code execution in the target system. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0025
CVE ID: CVE-2021-20048 State: PUBLISHED Published: 2022-01-07T03:00:12 Last Updated: 2024-08-03T17:30:06.959Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-121 Description: A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0028
CVE ID: CVE-2021-20049 State: PUBLISHED Published: 2021-12-23T01:20:09 Last Updated: 2024-08-03T17:30:07.418Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-204 Description: A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0030
CVE ID: CVE-2021-20050 State: PUBLISHED Published: 2021-12-23T01:20:11 Last Updated: 2024-08-03T17:30:07.388Z Vendors: SonicWall Products: SonicWall SMA100 Problem Types: CWE-284 Description: An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0031
CVE ID: CVE-2021-20051 State: PUBLISHED Published: 2022-05-04T15:20:09 Last Updated: 2024-08-03T17:30:07.581Z Vendors: SonicWall Products: SonicWall Global VPN Client Problem Types: CWE-427 Description: SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability in one of the installer components. Successful exploitation via a local attacker could result in command execution in the target system. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0036
CVE ID: CVE-2021-20066 State: PUBLISHED Published: 2021-02-16T19:48:08 Last Updated: 2024-08-03T17:30:07.411Z Vendors: n/a Products: JSDom Problem Types: Improper Access Control Description: JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-05 - https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951
CVE ID: CVE-2021-20067 State: PUBLISHED Published: 2021-02-16T19:40:25 Last Updated: 2024-08-03T17:30:07.438Z Vendors: n/a Products: Racom MIDGE Firmware Problem Types: Exposure of Sensitive Information to an Unauthorized Actor Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-04
CVE ID: CVE-2021-20068 State: PUBLISHED Published: 2021-02-16T19:41:02 Last Updated: 2024-08-03T17:30:07.640Z Vendors: n/a Products: Racom MIDGE Firmware Problem Types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the error handling functionality of web pages. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-04
CVE ID: CVE-2021-20069 State: PUBLISHED Published: 2021-02-16T19:41:25 Last Updated: 2024-08-03T17:30:07.654Z Vendors: n/a Products: Racom MIDGE Firmware Problem Types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the regionalSettings.php dialogs. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-04
CVE ID: CVE-2021-20070 State: PUBLISHED Published: 2021-02-16T19:45:29 Last Updated: 2024-08-03T17:30:07.114Z Vendors: n/a Products: Racom MIDGE Firmware Problem Types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the virtualization.php dialogs. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-04
CVE ID: CVE-2021-20071 State: PUBLISHED Published: 2021-02-16T19:45:45 Last Updated: 2024-08-03T17:30:07.485Z Vendors: n/a Products: Racom MIDGE Firmware Problem Types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-04
CVE ID: CVE-2021-20072 State: PUBLISHED Published: 2021-02-16T19:46:06 Last Updated: 2024-08-03T17:30:07.416Z Vendors: n/a Products: Racom MIDGE Firmware Problem Types: Relative Path Traversal Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an authenticated directory traveral. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-04
CVE ID: CVE-2021-20073 State: PUBLISHED Published: 2021-02-16T19:43:13 Last Updated: 2024-08-03T17:30:07.437Z Vendors: n/a Products: Racom MIDGE Firmware Problem Types: Cross-Site Request Forgery (CSRF) Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-04
CVE ID: CVE-2021-20074 State: PUBLISHED Published: 2021-02-16T19:43:34 Last Updated: 2024-08-03T17:30:07.408Z Vendors: n/a Products: Racom MIDGE Firmware Problem Types: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows users to escape the provided command line interface and execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-04
CVE ID: CVE-2021-20075 State: PUBLISHED Published: 2021-02-16T19:43:55 Last Updated: 2024-08-03T17:30:07.480Z Vendors: n/a Products: Racom MIDGE Firmware Problem Types: Privilege Escalation Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-04
CVE ID: CVE-2021-20076 State: PUBLISHED Published: 2021-03-03T16:30:39 Last Updated: 2024-08-03T17:30:07.006Z Vendors: n/a Products: Tenable.sc Problem Types: Remote Code Execution Description: Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to perform Remote Code Execution (RCE) on the Tenable.sc server via Hypertext Preprocessor unserialization. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2021-03
CVE ID: CVE-2021-20077 State: PUBLISHED Published: 2021-03-19T18:46:43 Last Updated: 2024-08-03T17:30:07.670Z Vendors: n/a Products: Tenable Nessus Agent Problem Types: Privilege Escalation Description: Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2021-04-0 - https://www.tenable.com/security/tns-2021-07 - https://www.tenable.com/security/tns-2021-04-0
CVE ID: CVE-2021-20078 State: PUBLISHED Published: 2021-04-01T18:03:48 Last Updated: 2024-08-03T17:30:07.492Z Vendors: n/a Products: Manage Engine OpManager Problem Types: Denial of Service Description: Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-10
CVE ID: CVE-2021-20079 State: PUBLISHED Published: 2021-06-29T18:16:35 Last Updated: 2024-08-03T17:30:07.345Z Vendors: n/a Products: Nessus Problem Types: Local Privilege Escalation Description: Nessus versions 8.13.2 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user to upload a specially crafted file that could lead to gaining administrator privileges on the Nessus host. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2021-07
CVE ID: CVE-2021-20080 State: PUBLISHED Published: 2021-04-09T17:21:07 Last Updated: 2024-08-03T17:30:07.498Z Vendors: n/a Products: ManageEngine ServiceDesk Plus, ManageEngine AssetExplorer Problem Types: Unauthenticated Stored Cross-site Scripting (XSS) Description: Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-11
CVE ID: CVE-2021-20081 State: PUBLISHED Published: 2021-06-10T11:01:56 Last Updated: 2024-08-03T17:30:07.431Z Vendors: n/a Products: ManageEngine ServiceDesk Plus Problem Types: Incomplete List of Disallowed Inputs leading to Authenticated Remote Command Execution Description: Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-22
CVE ID: CVE-2021-20083 State: PUBLISHED Published: 2021-04-23T18:47:42 Last Updated: 2024-08-03T17:30:07.501Z Vendors: n/a Products: jquery-plugin-query-object Problem Types: Prototype Pollution Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-query-object.md - http://packetstormsecurity.com/files/166299/WordPress-Core-5.9.0-5.9.1-Cross-Site-Scripting.html - https://lists.fedoraproject.org/ar
stormsecurity.com/files/166299/WordPress-Core-5.9.0-5.9.1-Cross-Site-Scripting.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7CR6VGITIB2TXXZ6B5QRRWPU5S4BXQPD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJX6NVXSRN3RX3YUVEJQ4WUTQSDL3DSR/
CVE ID: CVE-2021-20084 State: PUBLISHED Published: 2021-04-23T17:44:19 Last Updated: 2024-08-03T17:30:07.595Z Vendors: n/a Products: jQuery Sparkle Problem Types: Prototype Pollution Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-sparkle.md
CVE ID: CVE-2021-20085 State: PUBLISHED Published: 2021-04-23T18:41:07 Last Updated: 2024-08-03T17:30:07.445Z Vendors: n/a Products: backbone-query-parameters Problem Types: Prototype Pollution Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/backbone-qp.md
CVE ID: CVE-2021-20086 State: PUBLISHED Published: 2021-04-23T18:11:07.000Z Last Updated: 2025-11-03T21:44:34.084Z Vendors: n/a Products: jquery-bbq Problem Types: Prototype Pollution Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-bbq.md
CVE ID: CVE-2021-20087 State: PUBLISHED Published: 2021-04-23T17:58:23.000Z Last Updated: 2025-08-14T20:55:35.525Z Vendors: n/a Products: jquery-deparam Problem Types: Prototype Pollution Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties into Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-deparam.md
CVE ID: CVE-2021-20088 State: PUBLISHED Published: 2021-04-23T17:49:25 Last Updated: 2024-08-03T17:30:07.646Z Vendors: n/a Products: mootools-more Problem Types: Prototype Pollution Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/mootools-more.md
CVE ID: CVE-2021-20089 State: PUBLISHED Published: 2021-04-23T18:35:40 Last Updated: 2024-08-03T17:30:07.578Z Vendors: n/a Products: purl Problem Types: Prototype Pollution Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject properties into Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/purl.md
CVE ID: CVE-2021-20090 State: PUBLISHED Published: 2021-04-29T00:00:00.000Z Last Updated: 2025-10-21T23:25:47.628Z Vendors: n/a Products: Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3 Problem Types: Path Traversal Description: A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2021-13 - https://www.kb.cert.org/vuls/id/914124 - https://www.secpod.com/blog/arcadyan-based-routers-and-modems-under-acti
1-13 - https://www.kb.cert.org/vuls/id/914124 - https://www.secpod.com/blog/arcadyan-based-routers-and-modems-under-active-exploitation/
CVE ID: CVE-2021-20091 State: PUBLISHED Published: 2021-04-29T14:29:09 Last Updated: 2024-08-03T17:30:07.625Z Vendors: n/a Products: Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3 Problem Types: Static Code Injection Description: The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially gaining remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-13