Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-26426 State: PUBLISHED Published: 2021-08-12T18:11:36 Last Updated: 2024-11-18T21:46:19.417Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 8.1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, W
stallation), Windows 8.1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows User Account Profile Picture Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26426
CVE ID: CVE-2021-26427 State: PUBLISHED Published: 2021-10-13T00:26:32 Last Updated: 2024-08-03T20:26:25.215Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 21, Microsoft Exchange Server 2019 Cumulative Update 10 Problem Types: Remote Code Execution Description: Microsoft Exchange Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com
ecution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26427
CVE ID: CVE-2021-26428 State: PUBLISHED Published: 2021-08-12T18:11:37 Last Updated: 2024-08-03T20:26:25.192Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: Azure Sphere Problem Types: Information Disclosure Description: Azure Sphere Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26428
CVE ID: CVE-2021-26429 State: PUBLISHED Published: 2021-08-12T18:11:39 Last Updated: 2024-08-03T20:26:25.436Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L/E:P/RL:O/RC:C) Vendors: Microsoft Products: Azure Sphere Problem Types: Elevation of Privilege Description: Azure Sphere Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26429
CVE ID: CVE-2021-26430 State: PUBLISHED Published: 2021-08-12T18:11:40 Last Updated: 2024-08-03T20:26:25.232Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Azure Sphere Problem Types: Denial of Service Description: Azure Sphere Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26430
CVE ID: CVE-2021-26431 State: PUBLISHED Published: 2021-08-12T18:11:42 Last Updated: 2024-08-03T20:26:25.457Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 21H1, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2 Problem Types: Elevation of Privilege Description: Windows Recovery Environment Agent Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26431 - https://www.zerodayinitiative.com/advisories/ZDI-21-1053/
CVE ID: CVE-2021-26432 State: PUBLISHED Published: 2021-08-12T18:11:44 Last Updated: 2024-08-03T20:26:25.431Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 8.1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012
ore installation), Windows 8.1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26432
CVE ID: CVE-2021-26433 State: PUBLISHED Published: 2021-08-12T18:11:45 Last Updated: 2024-08-03T20:26:25.427Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 8.1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012
s 8.1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2019 Problem Types: Information Disclosure Description: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26433
CVE ID: CVE-2021-26434 State: PUBLISHED Published: 2021-09-15T11:23:00 Last Updated: 2024-08-03T20:26:25.193Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3), Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6), Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8), Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Problem Types: Elevation of Privilege Description: Visual Studio Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Con
of Privilege Description: Visual Studio Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26434 - https://www.zerodayinitiative.com/advisories/ZDI-21-1077/
CVE ID: CVE-2021-26435 State: PUBLISHED Published: 2021-09-15T11:23:01 Last Updated: 2024-08-03T20:26:25.364Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2
er 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Windows Scripting Engine Memory Corruption Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/a
tional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26435
CVE ID: CVE-2021-26436 State: PUBLISHED Published: 2021-09-02T22:25:23 Last Updated: 2024-08-03T20:26:25.450Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: Elevation of Privilege Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26436
CVE ID: CVE-2021-26437 State: PUBLISHED Published: 2021-09-15T11:23:03 Last Updated: 2024-10-01T15:52:57.465Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Visual Studio Code Problem Types: Spoofing Description: Visual Studio Code Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26437
CVE ID: CVE-2021-26439 State: PUBLISHED Published: 2021-09-02T22:25:24 Last Updated: 2024-11-18T20:39:06.299Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge for Android Problem Types: Information Disclosure Description: Microsoft Edge for Android Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26439
CVE ID: CVE-2021-26441 State: PUBLISHED Published: 2021-10-13T00:26:33 Last Updated: 2024-08-03T20:26:25.422Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 8.1, Windows Server 2012, Windows Server 2012 (Serv
Server 2016, Windows Server 2016 (Server Core installation), Windows 8.1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Storage Spaces Controller Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26441 - https://www.zerodayinitiative.com/advisories/ZDI-21-1157/
CVE ID: CVE-2021-26442 State: PUBLISHED Published: 2021-10-13T00:26:35 Last Updated: 2024-08-03T20:26:25.437Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Ser
rver 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows HTTP.sys Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://porta
ge Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26442
CVE ID: CVE-2021-26443 State: PUBLISHED Published: 2021-11-10T00:46:21 Last Updated: 2024-08-03T20:26:25.488Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 2004, Windows Server version 2004, Windows Server version 20H2, Windows 11 version 21H2 Problem Types: Remote Code Execution Description: Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://porta
MBus) Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26443
CVE ID: CVE-2021-26444 State: PUBLISHED Published: 2021-11-10T00:46:23 Last Updated: 2024-08-03T20:26:24.996Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Real Time Operating System Problem Types: Information Disclosure Description: Azure RTOS Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26444
CVE ID: CVE-2021-26461 State: PUBLISHED Published: 2021-06-21T17:10:11 Last Updated: 2024-08-03T20:26:25.470Z Vendors: Apache Software Foundation Products: Apache NuttX Problem Types: CWE-190 Description: Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r806fccf8b003ae812d807c6c7d97950d44ed29b2713418cbe3f2bddd%40%3Cdev.nuttx.apache.org%3E
CVE ID: CVE-2021-26471 State: PUBLISHED Published: 2021-06-08T18:36:14.329310Z Last Updated: 2024-09-16T16:22:33.725Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/cves/CVE-2021-26471/ - https://csirt.divd.nl/cases/DIVD-2020-00011/ - https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ - https://www
-26471/ - https://csirt.divd.nl/cases/DIVD-2020-00011/ - https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ - https://www.wbsec.nl/vembu
CVE ID: CVE-2021-26472 State: PUBLISHED Published: 2021-06-08T18:37:29.497131Z Last Updated: 2024-09-16T22:08:25.211Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/cases/DIVD-2020-00011/ - https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ - https://www.wbsec.nl/vembu - h
sirt.divd.nl/cases/DIVD-2020-00011/ - https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ - https://www.wbsec.nl/vembu - https://csirt.divd.nl/cves/CVE-2021-26472/
CVE ID: CVE-2021-26473 State: PUBLISHED Published: 2021-06-08T18:38:48.809397Z Last Updated: 2024-09-16T22:31:08.161Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/cases/DIVD-2020-00011/ - https://csirt.divd.nl/2021/05/11/Vembu-zero-
ram Container: References: - https://csirt.divd.nl/cases/DIVD-2020-00011/ - https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ - https://www.wbsec.nl/vembu - https://csirt.divd.nl/cves/CVE-2021-26473/
CVE ID: CVE-2021-26474 State: PUBLISHED Published: 2021-06-08T18:39:55.493188Z Last Updated: 2024-09-16T18:34:03.679Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.) Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/cases/DIVD-2020-00011/ - https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ - https://www.wbsec.nl/vembu - https://csirt.divd.nl/cves/CVE-2021-26474/
CVE ID: CVE-2021-26475 State: PUBLISHED Published: 2021-03-01T21:01:49 Last Updated: 2024-08-03T20:26:25.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI. Additional Analyst Notes: - CVE Program Container: References: - https://files.eprints.org/2548/ - https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf
CVE ID: CVE-2021-26476 State: PUBLISHED Published: 2021-03-01T21:01:42 Last Updated: 2024-08-03T20:26:25.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI. Additional Analyst Notes: - CVE Program Container: References: - https://files.eprints.org/2548/ - https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf
CVE ID: CVE-2021-26504 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T17:49:14.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Foddy/node-red-contrib-huemagic/issues/217
CVE ID: CVE-2021-26505 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T17:48:29.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MrSwitch/hello.js/issues/634
CVE ID: CVE-2021-26528 State: PUBLISHED Published: 2021-02-08T20:13:36 Last Updated: 2024-08-03T20:26:25.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cesanta/mongoose/issues/1201
CVE ID: CVE-2021-26529 State: PUBLISHED Published: 2021-02-08T20:13:36 Last Updated: 2024-08-03T20:26:25.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cesanta/mongoose/issues/1203
CVE ID: CVE-2021-26530 State: PUBLISHED Published: 2021-02-08T20:13:36 Last Updated: 2024-08-03T20:26:25.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cesanta/mongoose/issues/1204
CVE ID: CVE-2021-26539 State: PUBLISHED Published: 2021-02-08T16:16:06 Last Updated: 2024-08-03T20:26:25.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22 - https://github.com/apostrophecms/sanitize-html/pull/458 - https://advisory.checkmarx.net/advisory/CX-2021-4308
CVE ID: CVE-2021-26540 State: PUBLISHED Published: 2021-02-08T16:16:07 Last Updated: 2024-08-03T20:26:25.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26 - https://github.com/apostrophecms/sanitize-html/pull/460 - h
phecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26 - https://github.com/apostrophecms/sanitize-html/pull/460 - https://advisory.checkmarx.net/advisory/CX-2021-4309
CVE ID: CVE-2021-26541 State: PUBLISHED Published: 2021-02-08T16:16:08 Last Updated: 2024-08-03T20:26:25.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/domharrington/node-gitlog/pull/65 - https://www.npmjs.com/package/gitlog - https://advisory.checkmarx.net/advisory/CX-2020-4301