Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-27821 State: PUBLISHED Published: 2021-05-25T13:41:33 Last Updated: 2024-08-03T21:33:17.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability which can lead to attackers carrying out arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - http://openwrt.com - http://openwrtorg.com
CVE ID: CVE-2021-27822 State: PUBLISHED Published: 2021-08-19T13:58:57 Last Updated: 2024-08-03T21:33:15.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: A persistent cross site scripting (XSS) vulnerability in the Add Categories module of Vehicle Parking Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Category field. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49595
CVE ID: CVE-2021-27823 State: PUBLISHED Published: 2021-05-25T13:42:36 Last Updated: 2024-08-03T21:33:15.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability was discovered in /index.class.php (via port 8181) on NetWave System 1.0 which allows unauthenticated attackers to exfiltrate sensitive information from the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.netwavesystem.net/ - https://www.mediateknet.net/
CVE ID: CVE-2021-27825 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T17:49:20.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-static/ URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mercurycom.com.cn/product-1-1.html - http://packetstormsecurity.com/files/171771/MAC-1200R-Directory-Traversal.html
CVE ID: CVE-2021-27828 State: PUBLISHED Published: 2021-06-01T11:24:56 Last Updated: 2024-08-03T21:33:15.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries. Additional Analyst Notes: - CVE Program Container: References: - https://www.in4velocity.com/in4suite-erp.html - https://www.exploit-db.com/exploits/49884
CVE ID: CVE-2021-27836 State: PUBLISHED Published: 2021-11-03T16:07:55 Last Updated: 2024-08-03T21:33:15.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discoverered in in function xls_getWorkSheet in xls.c in libxls 1.6.2, allows attackers to cause a denial of service, via a crafted XLS file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libxls/libxls/issues/94 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFOE4Z6T46LA47VXWUVET4ELXRZQ3BWB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y6XOTFEOCHYKZAFCB6H3KNIIFJ3UFV7V/ -
.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y6XOTFEOCHYKZAFCB6H3KNIIFJ3UFV7V/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5D7XXCVFYRRMI4ENXYSD3MZEBS6SMI7E/
CVE ID: CVE-2021-27839 State: PUBLISHED Published: 2021-03-03T18:11:32 Last Updated: 2024-08-03T21:33:16.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigprof-software/online-invoicing-system/releases/tag/4.4 - https://www.jinsonvarghese.com/csv-injection-in-online-invoicing-system/
CVE ID: CVE-2021-27845 State: PUBLISHED Published: 2021-07-15T15:29:06 Last Updated: 2024-08-03T21:33:16.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.c Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jasper-software/jasper/issues/194
CVE ID: CVE-2021-27847 State: PUBLISHED Published: 2021-07-15T15:28:59 Last Updated: 2024-08-03T21:33:15.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point, mask.c#L85. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libvips/libvips/issues/1236
CVE ID: CVE-2021-27850 State: PUBLISHED Published: 2021-04-15T07:40:11 Last Updated: 2024-08-03T21:33:15.996Z Vendors: Apache Software Foundation Products: Apache Tapestry Problem Types: CWE-200, CWE-502 Description: A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http:/
ding a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java obj
` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/04/15/1 - https://security.netapp.com/advisor
s.tapestry.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/04/15/1 - https://security.netapp.com/advisory/ntap-20210528-0002/
CVE ID: CVE-2021-27851 State: PUBLISHED Published: 2021-04-26T15:35:28.989968Z Last Updated: 2024-09-17T02:11:05.201Z Vendors: GNU Guix Products: guix-daemon Problem Types: CWE-264 Description: A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with `guix build`, that makes its build directory world-writable. The user then creates a hardlink to a root-owned file such as /etc/shadow in that build directory. If the user passed the --keep-failed option and the build eventually fails, the daemon
c/shadow in that build directory. If the user passed the --keep-failed option and the build eventually fails, the daemon changes ownership of the whole build tree, including the hardlink, to the user. At that point, the user has write access to the target file. Versions after and including v0.11.0-3298-g2608e40988, and versions prior to v1.2.0-75109-g94f0312546 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://guix.gnu.org/en/blog/2021/risk-of-local-privilege-escalation-via-guix-daemon/ - https://bugs.gnu.org/47229
CVE ID: CVE-2021-27852 State: PUBLISHED Published: 2021-05-27T20:55:11.000Z Last Updated: 2025-10-21T23:25:44.136Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Checkbox Products: Survey Description: Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.kb.cert.org/vuls/id/706695
CVE ID: CVE-2021-27853 State: PUBLISHED Published: 2022-09-27T17:55:09.203Z Last Updated: 2025-11-04T19:12:25.432Z Vendors: IEEE, IETF Products: 802.2, draft-ietf-v6ops-ra-guard, P802.1Q Problem Types: CWE-290 Description: Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/ - https://standards.ieee.org/ieee/802.2/1048/ - https://standards.ieee.org/ieee/802.1Q/10323/ - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisc
tps://standards.ieee.org/ieee/802.1Q/10323/ - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-VU855201-J3z8CKTX - https://kb.cert.org/vuls/id/855201 - https://blog.champtar.fr/VLAN0_LLC_SNAP/
CVE ID: CVE-2021-27854 State: PUBLISHED Published: 2022-09-27T18:40:12.738Z Last Updated: 2025-11-04T19:12:26.598Z Vendors: IETF, IEEE Products: P802.1Q, draft-ietf-v6ops-ra-guard, 802.2 Problem Types: CWE-290 Description: Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/ - https://standards.ieee.org/ieee/802.2/1048/ - https://standards.ieee.org/ieee/802.1Q/10323/ - https://kb.cert.org/vuls/id/855201
standards.ieee.org/ieee/802.2/1048/ - https://standards.ieee.org/ieee/802.1Q/10323/ - https://kb.cert.org/vuls/id/855201 - https://blog.champtar.fr/VLAN0_LLC_SNAP/
CVE ID: CVE-2021-27855 State: PUBLISHED Published: 2021-12-15T16:14:47.069558Z Last Updated: 2024-09-17T02:42:43.452Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: FatPipe Products: WARP, IPVPN, MPVPN Problem Types: CWE-862 Description: FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves administrative privileges. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA001. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabil
ty is FPSA001. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5685.php - https://www.fatpipeinc.com/support/cve-list.php - https://www.zeroscience.mk/codes/fatpipe_privesc.txt
CVE ID: CVE-2021-27856 State: PUBLISHED Published: 2021-12-15T16:14:47.938619Z Last Updated: 2024-09-17T01:31:27.972Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FatPipe Products: WARP, IPVPN, MPVPN Problem Types: Default administrative account with no password Description: FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscienc
r this vulnerability is FPSA002. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5684.php - https://www.fatpipeinc.com/support/cve-list.php - https://www.zeroscience.mk/codes/fatpipe_backdoor.txt
CVE ID: CVE-2021-27857 State: PUBLISHED Published: 2021-12-15T16:14:48.650988Z Last Updated: 2024-09-17T04:29:07.048Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: FatPipe Products: WARP, IPVPN, MPVPN Problem Types: CWE-862 Description: A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, unauthenticated attacker to download a configuration archive. The attacker needs to know or correctly guess the hostname of the target system since the hostname is used as part of the configuration archive file name. Older versions of FatPipe software ma
system since the hostname is used as part of the configuration archive file name. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA003. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5683.php - https://www.fatpipeinc.com/support/cve-list.php - https://www.zeroscience.mk/codes/fatpipe_configdl.txt
CVE ID: CVE-2021-27858 State: PUBLISHED Published: 2021-12-15T16:14:49.376874Z Last Updated: 2024-09-17T01:16:55.538Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: FatPipe Products: WARP, IPVPN, MPVPN Problem Types: CWE-862 Description: A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote attacker to access at least the URL "/fpui/jsp/index.jsp" leading to unknown impact, presumably some violation of confidentiality. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA0
der versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA004. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.php - https://www.fatpipeinc.com/support/cve-list.php - https://www.zeroscience.mk/codes/fatpipe_auth.txt
CVE ID: CVE-2021-27859 State: PUBLISHED Published: 2021-12-15T16:14:50.125637Z Last Updated: 2024-09-16T21:07:27.520Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: FatPipe Products: WARP, IPVPN, MPVPN Problem Types: CWE-862 Description: A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows an authenticated, remote attacker with read-only privileges to create an account with administrative privileges. Older versions of FatPipe software may also be vulnerable. This does not appear to be a CSRF vulnerability. The FatPipe advisory identifier for this vu
are may also be vulnerable. This does not appear to be a CSRF vulnerability. The FatPipe advisory identifier for this vulnerability is FPSA005. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5681.php - https://www.fatpipeinc.com/support/cve-list.php - https://www.zeroscience.mk/codes/fatpipe_csrf.txt
CVE ID: CVE-2021-27860 State: PUBLISHED Published: 2021-12-08T16:15:48.319Z Last Updated: 2025-10-21T23:25:23.273Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FatPipe Products: WARP, IPVPN, MPVPN Description: A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fatpipeinc.com/support/cve-list.php - https://www.
Program Container: - CISA ADP Vulnrichment: References: - https://www.fatpipeinc.com/support/cve-list.php - https://www.ic3.gov/Media/News/2021/211117-2.pdf
CVE ID: CVE-2021-27861 State: PUBLISHED Published: 2022-09-27T18:40:13.742Z Last Updated: 2025-11-04T19:12:27.712Z Vendors: IEEE, IETF Products: 802.2, draft-ietf-v6ops-ra-guard, P802.1Q Problem Types: CWE-130, CWE-290 Description: Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/ - https://standards.ieee.org/ieee/802.2/1048/ - https://standards.ieee.org/ieee/802.1Q/10323/ - https://kb.cert.org/vuls/id/855201 - https://blog.champtar.fr/VLAN0_
/ - https://standards.ieee.org/ieee/802.1Q/10323/ - https://kb.cert.org/vuls/id/855201 - https://blog.champtar.fr/VLAN0_LLC_SNAP/
CVE ID: CVE-2021-27862 State: PUBLISHED Published: 2022-09-27T18:40:14.712Z Last Updated: 2025-11-04T19:12:28.789Z Vendors: IEEE, IETF Products: 802.2, draft-ietf-v6ops-ra-guard-08 Problem Types: CWE-130, CWE-290 Description: Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/08/ - https://standards.ieee.org/ieee/802.2/1048/ - https://kb.cert.org/vuls/id/855201 - https://blog.champtar.fr/VLAN0_LLC_SNAP/
CVE ID: CVE-2021-27876 State: PUBLISHED Published: 2021-03-01T21:49:06.000Z Last Updated: 2025-10-21T23:25:53.626Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated co
e authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veritas.com/content/support/en_US/security/VTS21-001#issue2 - http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html
CVE ID: CVE-2021-27877 State: PUBLISHED Published: 2021-03-01T21:49:36.000Z Last Updated: 2025-10-21T23:25:53.349Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
ent and execute privileged commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veritas.com/content/support/en_US/security/VTS21-001#issue1 - http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html
CVE ID: CVE-2021-27878 State: PUBLISHED Published: 2021-03-01T21:49:24.000Z Last Updated: 2025-10-21T23:25:53.483Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated co
e authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veritas.com/content/support/en_US/security/VTS21-001#issue3 - http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html
CVE ID: CVE-2021-27884 State: PUBLISHED Published: 2021-03-01T23:00:51 Last Updated: 2024-08-03T21:33:16.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi - https://github.com/YMFE/yapi/issues/2117
CVE ID: CVE-2021-27885 State: PUBLISHED Published: 2021-03-02T18:15:32 Last Updated: 2024-08-03T21:33:17.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/e107inc/e107/releases - https://github.com/e107inc/e107/commit/d9efdb9b5f424b4996c276e754a380a5e251f472 - http://packetstormsecurity.com/files/161651/e107-CMS-2.3.0-Cross-Site-Request-Forgery.html
CVE ID: CVE-2021-27886 State: PUBLISHED Published: 2021-03-01T23:40:47 Last Updated: 2024-08-03T21:33:17.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an API request. NOTE: this is NOT a Docker, Inc. product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rakibtg/docker-web-gui/issues/23 - https://github.com/rakibtg/docker-web-gui/commit/79cdc41809f2030fce21a1109898bd79e4190661 - https://www.docker.com/legal/trademark-guidelines - http://packetstormsecurity.com/files/163416/Docker-Dashb
9e4190661 - https://www.docker.com/legal/trademark-guidelines - http://packetstormsecurity.com/files/163416/Docker-Dashboard-Remote-Command-Execution.html
CVE ID: CVE-2021-27887 State: PUBLISHED Published: 2021-06-14T21:23:53.175873Z Last Updated: 2024-09-17T01:20:50.991Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids Ellipse APM 5.3 version 5.3.0.1 and prior versions; 5.2 version 5.2.0.3 and prior versions; 5.1 version 5.1.0.6 and prior versions. Additional Analyst Notes: - CVE Progr