Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
portonly/RT-AC68P/HelpDesk_download/ - https://www.asus.com/supportonly/RT-AC68R/HelpDesk_download/ - https://www.asus.com/supportonly/RT-AC68RW/HelpDesk_download/ - https://www.asus.com/supportonly/RT-AC68U/HelpDesk_download/ - https://www.asus.com/supportonly/RT-AC58U/HelpDesk_download/ - https://www.asus.com/supportonly/RT-AC85U/HelpDesk_download/ - https://www.asus.com/supportonly/RT-AC65U/HelpDesk_download/ - https://www.asus.com/supportonly/RT-AC68W/HelpDesk_download/
CVE ID: CVE-2021-3129 State: PUBLISHED Published: 2021-01-12T14:07:38.000Z Last Updated: 2025-10-21T23:35:30.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ambionics.io/blog/laravel-debug-rce - https://github.com/facade/ignition/pull/334 - http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-
g-rce - https://github.com/facade/ignition/pull/334 - http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html - http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html
CVE ID: CVE-2021-3130 State: PUBLISHED Published: 2021-01-20T15:45:14 Last Updated: 2024-08-03T16:45:51.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible. Additional Analyst Notes: - CVE Program Container: References: - https://opmantek.com/network-discovery-inventory-software/ - https://raw.githubusercontent.com/B0D0B0P0T/CVE/main/CVE-2021-3130
CVE ID: CVE-2021-3131 State: PUBLISHED Published: 2021-01-13T15:46:02 Last Updated: 2024-08-03T16:45:51.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jet-pentest/CVE-2021-3131
CVE ID: CVE-2021-3133 State: PUBLISHED Published: 2021-01-12T18:57:19 Last Updated: 2024-08-03T16:45:51.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2454670/ - https://wordpress.org/plugins/sb-elementor-contact-form-db/#developers - https://advisory.checkmarx.net/advisory/CX-2020-4293
CVE ID: CVE-2021-3134 State: PUBLISHED Published: 2021-01-12T19:05:47 Last Updated: 2024-08-03T16:45:51.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mubu 2.2.1 allows local users to gain privileges to execute commands, aka CNVD-2020-68878. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2638444 - http://mubu.com/doc/d5501245199
CVE ID: CVE-2021-3135 State: PUBLISHED Published: 2021-07-19T20:01:13 Last Updated: 2024-08-03T16:45:51.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id parameter in a td_ajax_block API call. Additional Analyst Notes: - CVE Program Container: References: - https://themeforest.net/item/newspaper/5489609 - https://tagdiv.com/newspaper/
CVE ID: CVE-2021-3137 State: PUBLISHED Published: 2021-01-20T03:17:14 Last Updated: 2024-08-03T16:45:51.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49437
CVE ID: CVE-2021-3138 State: PUBLISHED Published: 2021-01-14T03:30:11 Last Updated: 2024-08-03T16:45:51.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/releases - https://github.com/Mesh3l911/Disource - http://packetstormsecurity.com/files/162256/Discourse-2.7.0-2FA-Bypass.html
CVE ID: CVE-2021-3139 State: PUBLISHED Published: 2021-01-13T15:33:45 Last Updated: 2024-08-03T16:45:51.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?i
ent algorithm. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1178372 - https://bugzilla.suse.com/attachment.cgi?id=844938 - https://www.openwall.com/lists/oss-security/2021/01/12/12 - http://www.openwall.com/lists/oss-security/2021/01/13/5 - https://github.com/open-iscsi/tcmu-runner/pull/644
CVE ID: CVE-2021-3141 State: PUBLISHED Published: 2021-03-18T04:03:39 Last Updated: 2024-08-03T16:45:51.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attacker, who could gain access to the Management Server and change the Stealth configuration. Additional Analyst Notes: - CVE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=62
CVE ID: CVE-2021-3142 State: REJECTED Published: 2021-01-28T05:35:56 Last Updated: 2021-01-28T05:35:56 Description: No description available.
CVE ID: CVE-2021-3144 State: PUBLISHED Published: 2021-02-27T00:00:00 Last Updated: 2024-08-03T16:45:51.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saltstack/salt/releases - https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/ - https://lists.fedoraproject.org/archives/list/
nce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/ - https://security.gentoo.org/glsa/202103-01 - https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html - https://www.debian.org/security/2021/dsa-5011 - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2021-3145 State: PUBLISHED Published: 2021-09-10T18:12:57 Last Updated: 2024-08-03T16:45:51.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication. Additional Analyst Notes: - CVE Program Container: References: - https://ionic.io/products/identity-vault - http://packetstormsecurity.com/files/164085/Ionic-Identity-Vault-4.7-Android-Biometric-Authentication-Bypass.html
CVE ID: CVE-2021-3146 State: PUBLISHED Published: 2021-04-08T19:46:48 Last Updated: 2024-08-03T16:45:51.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://professional.dolby.com/siteassets/pdfs/dolby-dax2-security-advisory-2021-04-07.pdf
CVE ID: CVE-2021-3148 State: PUBLISHED Published: 2021-02-27T00:00:00 Last Updated: 2024-08-03T16:45:51.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saltstack/salt/releases - https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists
ments/active-saltstack-cve-release-2021-feb-25/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/ - https://security.gentoo.org/glsa/202103-01 - https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html - https://www.debian.org/security/2021/dsa-5011 - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2021-3149 State: PUBLISHED Published: 2021-02-22T01:48:18 Last Updated: 2024-08-03T16:45:51.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authentication by the attacker) because the system C library function is used unsafely. Additional Analyst Notes: - CVE Program Container: References: - https://www.netshieldcorp.com/netshield-appliances/ - https://www.digitaldefense.com/resources/vulnerability-research/netshield-corporation-nano-25/ - https://kc.mcafee.com/corporate/index?page=content&id=SB10356
CVE ID: CVE-2021-3150 State: PUBLISHED Published: 2021-03-15T18:48:55 Last Updated: 2024-08-03T16:45:51.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject arbitrary web script or HTML via the user name. The issue is fixed with the version 4.8.1 Additional Analyst Notes: - CVE Program Container: References: - https://wiki.cryptshare.com/display/CSM/Update+from+v4.7.1+to+v4.8.1 - https://kc.mcafee.com/corporate/index?page=content&id=SB10356
CVE ID: CVE-2021-3151 State: PUBLISHED Published: 2021-02-27T04:15:03 Last Updated: 2024-08-03T16:45:51.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__MONITORING__CONFIG__ADDRESS, or SM2__C__MONITORING__CONFIG__ADDRESS. Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-056 - https://www.i-doit.or
ainer: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-056 - https://www.i-doit.org/news/ - http://packetstormsecurity.com/files/162815/i-doit-1.15.2-Cross-Site-Scripting.html
CVE ID: CVE-2021-3152 State: PUBLISHED Published: 2021-01-21T15:10:51 Last Updated: 2024-08-03T16:45:51.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Home Assistant does have a security update that is worthwhile in addressing this situation Additional Analyst Notes: - CVE Program Container: References: - https://www.home-assistant.io/blog/2021/01/14/security-bulletin/ - https://www.hom
CVE Program Container: References: - https://www.home-assistant.io/blog/2021/01/14/security-bulletin/ - https://www.home-assistant.io/blog/2021/01/22/security-disclosure/
CVE ID: CVE-2021-3153 State: PUBLISHED Published: 2021-03-26T02:51:57 Last Updated: 2024-08-03T16:45:51.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2021-06-terraform-enterprise-organization-level-mfa-requirement-was-not-enforced/22401
CVE ID: CVE-2021-3154 State: PUBLISHED Published: 2021-05-04T13:02:56 Last Updated: 2024-08-03T16:45:51.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords via macro Injection. NOTE: this had a distinct fix relative to CVE-2020-35481. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-2_release_notes.htm
CVE ID: CVE-2021-3155 State: PUBLISHED Published: 2022-02-17T22:15:16 Last Updated: 2024-08-03T16:45:51.372Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Canonical Ltd. Products: snapd Problem Types: CWE-276 Description: snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1 Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5292-1 - https://github.com/snapcore/snapd/commit/6bcaeeccd16ed82
References: - https://ubuntu.com/security/notices/USN-5292-1 - https://github.com/snapcore/snapd/commit/6bcaeeccd16ed8298a301dd92f6907f88c24cc85 - https://github.com/snapcore/snapd/commit/7d2a966620002149891446a53cf114804808dcca
CVE ID: CVE-2021-3156 State: PUBLISHED Published: 2021-01-26T00:00:00.000Z Last Updated: 2025-10-21T23:35:29.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html - http://seclists.org/fulldisclosure/2021/Jan/79 - http://www.openwall.com/lists/oss-security/2021/01/26/3 - https://security.gentoo.org/gl
rg/fulldisclosure/2021/Jan/79 - http://www.openwall.com/lists/oss-security/2021/01/26/3 - https://security.gentoo.org/glsa/202101-33 - https://www.debian.org/security/2021/dsa-4839 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/ - http://www.openwall.com/lists/oss-security/2021/01/27/1 - http://www.openwall.com/lists/oss-security/2021/01/27/2 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM - https://www.kb.cert.org/v
isco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM - https://www.kb.cert.org/vuls/id/794544 - http://seclists.org/fulldisclosure/2021/Feb/42 - http://www.openwall.com/lists/oss-security/2021/02/15/1 - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.sudo.ws/stable.html#1.9.5p2 - https://www.openwall.com/lists/oss-security/2021/01/26/3 - http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html - https://security.netapp.com/advisory/ntap-20210128-0002/ - https://security.netapp.com/advisory/ntap-20210128-0001/ - http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html - http
/ntap-20210128-0001/ - http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html - http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html - http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html - https://support.apple.com/kb/HT212177 - https://kc.mcafee.com/corporate/index?page=content&id=SB10348 - https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability - https://www.synology.com/security/advisory/Synology_SA_21_02 - http://www.openwall.com/lists/oss-security/2021/09/14
y - https://www.synology.com/security/advisory/Synology_SA_21_02 - http://www.openwall.com/lists/oss-security/2021/09/14/2 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - http://www.openwall.com/lists/oss-security/2024/01/30/8 - http://www.openwall.com/lists/oss-security/2024/01/30/6 - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html - http://seclists.org/fulldisclosure/2024/Feb/3 - https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156
CVE ID: CVE-2021-3159 State: PUBLISHED Published: 2021-07-23T14:48:05 Last Updated: 2024-08-03T16:45:51.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG, SHTML, or MHT file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fa1c0n1/m01e-wiki/blob/main/my-vulns/landray-ekp.md
CVE ID: CVE-2021-3160 State: PUBLISHED Published: 2021-01-28T19:37:46 Last Updated: 2024-08-03T16:45:51.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote attacker to inject unsecure serialized Java object using a specially crafted HTTP request, resulting in an unauthenticated remote code execution on the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.aca.fr/solution/assurex-solution-gestion-des-contrats-assurance/ - https://www.digital.security/fr/sites/default/files/advisories/cert-ds_advisory_cve-2021-316
n-des-contrats-assurance/ - https://www.digital.security/fr/sites/default/files/advisories/cert-ds_advisory_cve-2021-3160.txt
CVE ID: CVE-2021-3162 State: PUBLISHED Published: 2021-01-15T21:54:59 Last Updated: 2024-08-03T16:45:51.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://docs.docker.com/docker-for-mac/release-notes/#docker-desktop-community-2500 - https://twitter.com/_r3ggi
CVE ID: CVE-2021-3163 State: PUBLISHED Published: 2021-04-12T20:35:07 Last Updated: 2024-08-03T16:45:51.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://quilljs.com - https://burninatorsec.blogspot.com/2021/04/cve-2021-3163-xss-slab-quill-js.html - https://github
- https://quilljs.com - https://burninatorsec.blogspot.com/2021/04/cve-2021-3163-xss-slab-quill-js.html - https://github.com/quilljs/quill/issues/3273 - https://github.com/quilljs/quill/issues/3364
CVE ID: CVE-2021-3164 State: PUBLISHED Published: 2021-01-21T05:45:20 Last Updated: 2024-08-03T16:45:51.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permission in order to upload and execute an arbitrary file via a POST request to resources.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Little-Ben/ChurchRota - https://github.com/rmccarth/cve-2021-3164
CVE ID: CVE-2021-3165 State: PUBLISHED Published: 2021-01-26T22:39:14 Last Updated: 2024-08-03T16:45:51.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI. Additional Analyst Notes: - CVE Program Container: References: - https://orionhridoy.me - https://www.smtagent.com/support - https://packetstormsecurity.com/files/160906/SmartAgent-3.1.0-Privilege-Escalation.html
CVE ID: CVE-2021-3166 State: PUBLISHED Published: 2021-01-18T04:55:03 Last Updated: 2024-08-03T16:45:51.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3_805 devices. An attacker can upload arbitrary file content as a firmware update when the filename Settings_DSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update, resulting in a persistent outage of those services. Additional Analyst Notes: - CVE Program Container: References: - https://kaisersource.github.io/dsl-n14u - https://github.com/kaisersource/kaisersource.github.io/blob/main/_posts/20
: - https://kaisersource.github.io/dsl-n14u - https://github.com/kaisersource/kaisersource.github.io/blob/main/_posts/2021-01-17-dsl-n14u.md
CVE ID: CVE-2021-3167 State: PUBLISHED Published: 2021-03-15T15:06:46 Last Updated: 2024-08-03T16:45:51.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs. Additional Analyst Notes: - CVE Program Container: References: - https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html - https://my.cloudera.com/knowledge/TSB-2021-466-CDE-authentication-tokens-exposed-in-pod-and?id=310163 - https://docs.cloudera.com/data-engineering/cloud/release-notes/topics/cde-general-known-issues.html
CVE ID: CVE-2021-3169 State: PUBLISHED Published: 2021-07-23T00:00:00 Last Updated: 2024-08-03T16:45:51.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets. Additional Analyst Notes: - CVE Program Container: References: - https://mp.weixin.qq.com/s/5tgcaIrnDnGP-LvWPw9YCg - https://s.tencent.com/research/bsafe/1228.html - https://blog.fit2cloud.com/?p=1764