Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-40574 State: PUBLISHED Published: 2022-01-13T00:00:00.000Z Last Updated: 2025-03-05T23:03:49.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: The binary MP4Box in Gpac from 0.9.0-preview to 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1897 - https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb - https://www.debian.org/security/2023/dsa-5411 - https://github.com/gpac/gpac/blob/v0.9.0-preview
f25347eebf2dc8c6c1bcb - https://www.debian.org/security/2023/dsa-5411 - https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L232 - https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L304
CVE ID: CVE-2021-40575 State: PUBLISHED Published: 2022-01-13T00:00:00 Last Updated: 2024-08-04T02:44:10.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in reframe_mpgvid.c, which allows attackers to cause a denial of service. This vulnerability is possibly due to an incomplete fix for CVE-2021-40566. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1905 - https://github.com/gpac/gpac/commit/5f2c2a16d30229b6241f02fa28e3d6b810d64858 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40576 State: PUBLISHED Published: 2022-01-13T00:00:00 Last Updated: 2024-08-04T02:44:10.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1904 - https://github.com/gpac/gpac/commit/ad18ece95fa064efc0995c4ab2c985f77fb166ec - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40577 State: PUBLISHED Published: 2021-11-08T17:45:05 Last Updated: 2024-08-04T02:44:10.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 in the Add-Users page via the Name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40J03KR/cve-2021-40577-ec96a831ba71 - http://packetstormsecurity.com/files/165106/Online-Enrollment-Management-System-In-PHP-And-PayPal-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-40578 State: PUBLISHED Published: 2021-12-07T21:13:44 Last Updated: 2024-08-04T02:44:10.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authenticated Blind & Error-based SQL injection vulnerability was discovered in Online Enrollment Management System in PHP and PayPal Free Source Code 1.0, that allows attackers to obtain sensitive information and execute arbitrary SQL commands via IDNO parameter. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40J03KR/cve-2021-40578-127ceaf3f1bb - https://www.nu11secur1ty.com/2021/12/online-enrollment-management-system-sql.html - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/
y.com/2021/12/online-enrollment-management-system-sql.html - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System
CVE ID: CVE-2021-40579 State: PUBLISHED Published: 2021-12-28T11:59:58 Last Updated: 2024-08-04T02:44:10.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: https://www.sourcecodester.com/ Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 is affected by: Incorrect Access Control. The impact is: gain privileges (remote). Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/ - https://medium.com/%40VAPT01/cve-2021-40579-9eac3409fd24
CVE ID: CVE-2021-40589 State: PUBLISHED Published: 2022-06-08T17:58:14 Last Updated: 2024-08-04T02:44:10.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fileheader.bfOffBits. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/zangband/bugs/671/
CVE ID: CVE-2021-40592 State: PUBLISHED Published: 2022-06-08T00:00:00 Last Updated: 2024-08-04T02:44:10.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vulnerability in ISOBMFF reader filter, isoffin_read.c. Function isoffin_process() can result in DoS by infinite loop. To exploit, the victim must open a specially crafted mp4 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/commit/71460d72ec07df766dab0a4d52687529f3efcf0a - https://github.com/gpac/gpac/issues/1876 - https
/github.com/gpac/gpac/commit/71460d72ec07df766dab0a4d52687529f3efcf0a - https://github.com/gpac/gpac/issues/1876 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40595 State: PUBLISHED Published: 2022-01-21T19:03:03 Last Updated: 2024-08-04T02:44:10.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Sourcecodester Online Leave Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username parameter to /leave_system/classes/Login.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-03
CVE ID: CVE-2021-40596 State: PUBLISHED Published: 2022-01-24T14:30:03 Last Updated: 2024-08-04T02:44:10.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Login.php in sourcecodester Online Learning System v2 by oretnom23, allows attackers to execute arbitrary SQL commands via the faculty_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-07
CVE ID: CVE-2021-40597 State: PUBLISHED Published: 2022-06-29T19:44:58 Last Updated: 2024-08-04T02:44:10.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password. Additional Analyst Notes: - CVE Program Container: References: - https://www.edimax.com/edimax/download/download/data/edimax/global/download/ - https://drive.google.com/file/d/1ZPFwAoO8tAD0zrWwVZ9W6-CUCrcM0Exm/view?usp=sharing - https://drive.google.com/file/d/1DZCzVULjchY0rSJBXIPr0gJM1qWCcAZ5/view?usp=sharing
CVE ID: CVE-2021-40604 State: PUBLISHED Published: 2022-06-13T17:45:39 Last Updated: 2024-08-04T02:44:10.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://invisioncommunity.com/release-notes/462-r99/
CVE ID: CVE-2021-40606 State: PUBLISHED Published: 2022-06-28T00:00:00 Last Updated: 2024-08-04T02:44:10.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gf_bs_write_data function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1885 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40607 State: PUBLISHED Published: 2022-06-28T11:04:06 Last Updated: 2024-08-04T02:44:10.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1879
CVE ID: CVE-2021-40608 State: PUBLISHED Published: 2022-06-28T00:00:00 Last Updated: 2024-08-04T02:44:10.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1883 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40609 State: PUBLISHED Published: 2022-06-28T00:00:00 Last Updated: 2024-08-04T02:44:10.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1894 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-40610 State: PUBLISHED Published: 2022-06-09T12:04:11 Last Updated: 2024-08-04T02:44:10.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blackQvQ/emlog/issues/1
CVE ID: CVE-2021-40612 State: PUBLISHED Published: 2021-12-22T12:12:43 Last Updated: 2024-08-04T02:44:10.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an attacker perform command execution without echoes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Opmantek/open-audit/commit/c7595cbb092e410a487f03c0eb536cf19e538860 - https://community.opmantek.com/pages/viewpage.action?pageId=65504438
CVE ID: CVE-2021-40616 State: PUBLISHED Published: 2022-06-14T09:55:34 Last Updated: 2024-08-04T02:44:10.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority is required. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinkcmf/thinkcmf/issues/722
CVE ID: CVE-2021-40617 State: PUBLISHED Published: 2021-10-11T18:28:50.000Z Last Updated: 2025-04-16T14:11:19.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/192 - https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2021-40617.md
CVE ID: CVE-2021-40618 State: PUBLISHED Published: 2021-10-12T17:39:55 Last Updated: 2024-08-04T02:44:10.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in HoldAddressFields.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/193
CVE ID: CVE-2021-40633 State: PUBLISHED Published: 2022-06-14T10:22:11 Last Updated: 2024-08-04T02:44:10.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/giflib/bugs/157/
CVE ID: CVE-2021-40635 State: PUBLISHED Published: 2022-03-03T13:25:20 Last Updated: 2024-08-04T02:44:10.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php. An attacker can inject a SQL query to extract information from the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/195
CVE ID: CVE-2021-40636 State: PUBLISHED Published: 2022-03-03T13:54:40 Last Updated: 2024-08-04T02:44:10.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/198
CVE ID: CVE-2021-40637 State: PUBLISHED Published: 2022-03-03T14:04:21 Last Updated: 2024-08-04T02:51:06.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php. An attacker can inject JavaScript code to get the user's cookie and take over the working session of user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/199
CVE ID: CVE-2021-40639 State: PUBLISHED Published: 2021-09-15T21:17:11 Last Updated: 2024-08-04T02:51:06.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. Additional Analyst Notes: - CVE Program Container: References: - http://jfinalcms.com - https://github.com/jflyfox/jfinal_cms - https://github.com/jflyfox/jfinal_cms/issues/27
CVE ID: CVE-2021-40642 State: PUBLISHED Published: 2022-06-29T10:25:00 Last Updated: 2024-08-04T02:51:06.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Additional Analyst Notes: - CVE Pr
this event by feeding a user suitable links, either directly or via another web site. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/textpattern/textpattern/commit/211fab0093999f59b0b61682aa988ac7d8337aa9 - https://www.huntr.dev/bounties/aadbe434-a376-443b-876f-2a1cbab7847b/
CVE ID: CVE-2021-40643 State: PUBLISHED Published: 2022-06-30T10:41:32 Last Updated: 2024-08-04T02:51:06.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application in the "cacti" configuration page (by default/usr/sbin/sendmail) it is possible to execute any command, which will be executed when we make a test of the configuration ("send test mail"). Additional Analyst Notes: - CVE Program Container: References: - https://eyesofnetwork.com - https://www.eyesofnetwork.com/en/news/vulnerabilite-cacti
CVE ID: CVE-2021-40644 State: PUBLISHED Published: 2022-03-30T20:44:48 Last Updated: 2024-08-04T02:51:06.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in oasys oa_system as of 9/7/2021 in resources/mappers/notice-mapper.xml. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/aaluoxiang/oa_system - https://github.com/novysodope/VulReq/blob/main/oa_system
CVE ID: CVE-2021-40645 State: PUBLISHED Published: 2022-03-30T20:56:16 Last Updated: 2024-08-04T02:51:06.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/glorylion/JFinalOA - https://github.com/novysodope/VulReq/blob/main/JFinalOA
CVE ID: CVE-2021-40647 State: PUBLISHED Published: 2022-09-09T17:57:28 Last Updated: 2024-08-04T02:51:06.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: In man2html 1.6g, a specific string being read in from a file will overwrite the size parameter in the top chunk of the heap. This at least causes the program to segmentation abort if the heap size parameter isn't aligned correctly. In version before GLIBC version 2.29 and aligned correctly, it allows arbitrary write anywhere in the programs memory. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/untaman/cb58123fe89fc65e3984165db5d40933
CVE ID: CVE-2021-40648 State: PUBLISHED Published: 2022-09-09T17:57:38 Last Updated: 2024-08-04T02:51:06.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fd_nextsize, bk_nextsize of the current chunk. The next chunk is then freed later on, causing a freeing of an arbitrary amount of memory. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/untaman/cb58123fe89fc65e3984165db5d40933
CVE ID: CVE-2021-40649 State: PUBLISHED Published: 2022-06-14T09:35:13 Last Updated: 2024-08-04T02:51:06.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set. Additional Analyst Notes: - CVE Program Container: References: - http://connx.com - https://github.com/l00neyhacker/CVE-2021-40649
CVE ID: CVE-2021-40650 State: PUBLISHED Published: 2022-06-14T09:37:05 Last Updated: 2024-08-04T02:51:06.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set. Additional Analyst Notes: - CVE Program Container: References: - http://connx.com - https://github.com/l00neyhacker/CVE-2021-40650
CVE ID: CVE-2021-40651 State: PUBLISHED Published: 2021-09-29T11:59:07 Last Updated: 2024-08-04T02:51:06.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/wFwlbXANRCo - https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md - https://www.exploit-db.com/exploits/50259
CVE ID: CVE-2021-40654 State: PUBLISHED Published: 2021-09-24T20:02:49 Last Updated: 2024-08-04T02:51:06.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Ilovewomen/D-LINK-DIR-615
CVE ID: CVE-2021-40655 State: PUBLISHED Published: 2021-09-24T20:11:51.000Z Last Updated: 2025-10-21T23:25:31.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Ilovewomen/D-LINK-DIR-605/
CVE ID: CVE-2021-40656 State: PUBLISHED Published: 2022-04-08T15:09:33 Last Updated: 2024-08-04T02:51:06.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libsixel/libsixel/issues/25
CVE ID: CVE-2021-40658 State: PUBLISHED Published: 2022-06-14T10:53:12 Last Updated: 2024-08-04T02:51:06.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”. Additional Analyst Notes: - CVE Program Container: References: - https://tanmay26.medium.com/textpattern-4-8-7-is-affected-by-html-injection-in-the-body-parameter-1a7be2441b70
CVE ID: CVE-2021-40660 State: PUBLISHED Published: 2022-06-14T13:16:20 Last Updated: 2024-08-04T02:51:06.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/javadelight/delight-nashorn-sandbox/issues/117
CVE ID: CVE-2021-40661 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-07T13:40:42.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). It was possible to traverse the folders of the affected host by providing a traversal path to the 'webpage' parameter in AutoCE.ini This could allow a remote unauthenticated adversary to access additional files on the affected system. This could also allow the adversar
a remote unauthenticated adversary to access additional files on the affected system. This could also allow the adversary to perform further enumeration against the affected host to identify the versions of the systems in use, in order to launch further attacks in future. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mt.com/au/en/home/products/Industrial_Weighing_Solutions/Terminals-and-Controllers/terminals-bench-floor-scales/advanced-bench-floor-applications/IND780/IND780_.html#overviewpm - https://sidsecure.au/blog/cve-2021-40661/?_sm_pdc=1&_sm_rid=MRRqb4KBDnjBMJk24b40LMS3SKqPMqb4KVn32Kr
CVE ID: CVE-2021-40662 State: PUBLISHED Published: 2022-03-21T20:39:46 Last Updated: 2024-08-04T02:51:06.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-83-2021-08-11-High-impact-Moderate-risk-Cross-Site-Request-Forgery-CSRF-leading-to-Remote-Code-Execution - https://febin0x4e4a.wordpress.com/2022/03/22/cve-2021-40662-chamilo-lms-1-11-14-rce/ - https://febinj.medium.com/cve-2021-40662-ch
bin0x4e4a.wordpress.com/2022/03/22/cve-2021-40662-chamilo-lms-1-11-14-rce/ - https://febinj.medium.com/cve-2021-40662-chamilo-lms-1-11-14-rce-5301bad245d7