Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
a47b58c7904118f40965d5 - http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20210503/000036.html - https://github.com/neomutt/neomutt/commit/fa1db5785e5cfd9d3cd27b7571b9fe268d2ec2dc - https://security.gentoo.org/glsa/202105-05
CVE ID: CVE-2021-32056 State: PUBLISHED Published: 2021-05-10T13:05:40 Last Updated: 2024-08-03T23:17:28.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall. Additional Analyst Notes: - CVE Program Container: References: - https://cyrus.topicbox.com/groups/announce/T056901c106ecfce3/cyrus-imap-3-4-1-released - https://cyrus.topicbox.com/groups/announce/T126392718bc29d6b/cyrus-imap-3-2-7-released - https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.1.html - https://www.cyru
6b/cyrus-imap-3-2-7-released - https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.1.html - https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.7.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJZB45QBUN7CZFGOWCZYUYACNBTX7LVS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM/
CVE ID: CVE-2021-32061 State: PUBLISHED Published: 2021-11-29T03:00:48 Last Updated: 2024-08-03T23:17:28.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sa7mon/S3Scanner/releases/tag/2.0.2 - https://github.com/sa7mon/S3Scanner/issues/122 - https://vuln.ryotak.me/advisories/62
CVE ID: CVE-2021-32062 State: PUBLISHED Published: 2021-05-05T18:39:41 Last Updated: 2024-08-03T23:17:28.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI). Additional Analyst Notes: - CVE Program Container: References: - https://mapserver.org/development/changelog/changelog-7-6.html - https://mapserver.org/development/changelog/changelog-7-4.html - https://mapserver.org/development/changelo
g-7-6.html - https://mapserver.org/development/changelog/changelog-7-4.html - https://mapserver.org/development/changelog/changelog-7-2.html - https://mapserver.org/development/changelog/changelog-7-0.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNORAZCJ7AIPJFUY6WGLYIA3QVPWFXFY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVWUC4EOW5WZAZGPLRTZS5QXNUEBPQ5/
CVE ID: CVE-2021-32066 State: PUBLISHED Published: 2021-08-01T00:00:00 Last Updated: 2024-08-03T23:17:28.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1178562 - https://lists.debian.org/debian-lts-a
es: - CVE Program Container: References: - https://hackerone.com/reports/1178562 - https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20210902-0004/ - https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ - https://github.com/ruby/ruby/commit/a21a3b7d23704a01d34bd79d09dc37897e00922a - https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html - https://security.gentoo.org/glsa/202401-27
CVE ID: CVE-2021-32067 State: PUBLISHED Published: 2021-08-13T15:27:42 Last Updated: 2024-08-03T23:17:28.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0005
CVE ID: CVE-2021-32068 State: PUBLISHED Published: 2021-08-13T15:28:55 Last Updated: 2024-08-03T23:17:27.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to modify application data and state. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0005
CVE ID: CVE-2021-32069 State: PUBLISHED Published: 2021-08-13T15:37:36 Last Updated: 2024-08-03T23:17:28.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0005
CVE ID: CVE-2021-32070 State: PUBLISHED Published: 2021-08-13T15:31:11 Last Updated: 2024-08-03T23:17:28.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response. A successful exploit could allow an attacker to modify the browser header and redirect users. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0005
CVE ID: CVE-2021-32071 State: PUBLISHED Published: 2021-08-13T15:31:56 Last Updated: 2024-08-03T23:17:28.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful exploit could allow an attacker to view and modify application data, and cause a denial of service for users. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0005
CVE ID: CVE-2021-32072 State: PUBLISHED Published: 2021-08-13T15:32:58 Last Updated: 2024-08-03T23:17:28.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0005
CVE ID: CVE-2021-32073 State: PUBLISHED Published: 2021-05-14T23:20:08 Last Updated: 2024-08-03T23:17:29.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ky-j/dedecms/issues/12
CVE ID: CVE-2021-32074 State: PUBLISHED Published: 2021-05-07T04:01:29 Last Updated: 2024-08-03T23:17:28.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/vault-action/blob/master/CHANGELOG.md - https://github.com/hashicorp/vault-action/pull/208 - https://github.com/hashicorp/vault-action/issues/205 - https://discuss.hashicorp.com/t/hcsec-2021-13-vault-github-action-did
s://github.com/hashicorp/vault-action/issues/205 - https://discuss.hashicorp.com/t/hcsec-2021-13-vault-github-action-did-not-correctly-mask-multi-line-secrets-in-output/24128
CVE ID: CVE-2021-32075 State: PUBLISHED Published: 2021-05-24T12:42:04 Last Updated: 2024-08-03T23:17:28.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/relogicgames - https://vuln.ryotak.me/advisories/42 - https://store.steampowered.com/news/app/105600/view/3062989030626131236 - https://terraria.fandom.com/wiki/1.4.2.3
CVE ID: CVE-2021-32076 State: PUBLISHED Published: 2021-08-26T14:53:25.774505Z Last Updated: 2024-09-17T01:00:44.305Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: Web Help Desk Problem Types: CWE-290 Description: Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback. Additional Analyst Notes: - CVE Program Container: R
d changing the referrer from the public IP address to the loopback. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076
CVE ID: CVE-2021-32077 State: PUBLISHED Published: 2021-05-06T23:00:51 Last Updated: 2024-08-03T23:17:28.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (SSN) values via a brute-force attack on a (sometimes hidden) search field, because the last four SSN digits are part of the supported combination of search selectors. This discloses doctors' and nurses' social security numbers and PII. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritystream.com/legacy/msow-solutions - https://www.marbasec.com/blog/cve-2
rogram Container: References: - https://www.veritystream.com/legacy/msow-solutions - https://www.marbasec.com/blog/cve-2021-32077-fun-with-social-security-numbers
CVE ID: CVE-2021-32078 State: PUBLISHED Published: 2021-06-17T14:13:38 Last Updated: 2024-08-03T23:17:29.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4. Additional Analyst Notes: - CVE Program Container: References: - https://kirtikumarar.com/CVE-2021-32078.txt - https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e4
e447ccfaae35fe9f651f9d7e15166f - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f - https://security.netapp.com/advisory/ntap-20210813-0002/
CVE ID: CVE-2021-32089 State: PUBLISHED Published: 2021-05-11T20:39:29 Last Updated: 2024-08-03T23:17:28.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. An unauthenticated attacker can upload arbitrary files to the filesystem that can then be accessed through the web interface. This can lead to information disclosure and code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://www.zebra.com/us/en/support-downloads/rfid/rfid-readers/fx9500.html - https://www
ogram Container: References: - https://www.zebra.com/us/en/support-downloads/rfid/rfid-readers/fx9500.html - https://www.securifera.com/advisories/cve-2021-32089/
CVE ID: CVE-2021-32090 State: PUBLISHED Published: 2021-05-07T03:52:36 Last Updated: 2024-08-03T23:17:28.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/hack-the-stack-with-localstack - https://portswigger.net/daily-swig/localstack-zero-day-vulnerabilities-chained-to-achieve-remote-takeover-of-local-instances
CVE ID: CVE-2021-32091 State: PUBLISHED Published: 2021-05-07T03:52:26 Last Updated: 2024-08-03T23:17:28.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/hack-the-stack-with-localstack - https://portswigger.net/daily-swig/localstack-zero-day-vulnerabilities-chained-to-achieve-remote-takeover-of-local-instances
CVE ID: CVE-2021-32092 State: PUBLISHED Published: 2021-05-07T03:52:18 Last Updated: 2024-08-03T23:17:29.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeover - https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealed
CVE ID: CVE-2021-32093 State: PUBLISHED Published: 2021-05-07T03:52:07 Last Updated: 2024-08-03T23:17:29.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeover - https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealed
CVE ID: CVE-2021-32094 State: PUBLISHED Published: 2021-05-07T03:51:58 Last Updated: 2024-08-03T23:17:29.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeover - https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealed
CVE ID: CVE-2021-32095 State: PUBLISHED Published: 2021-05-07T03:51:47 Last Updated: 2024-08-03T23:17:29.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeover - https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealed
CVE ID: CVE-2021-32096 State: PUBLISHED Published: 2021-05-07T03:51:37 Last Updated: 2024-08-03T23:17:29.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeover - https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealed
CVE ID: CVE-2021-32098 State: PUBLISHED Published: 2021-05-07T03:51:23 Last Updated: 2024-08-03T23:17:29.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained - https://pandorafms.com/blog/whats-new-in-pandora-fms-743/ - https://portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fms-could-trigger-remote-execution-attack
CVE ID: CVE-2021-32099 State: PUBLISHED Published: 2021-05-07T03:51:15 Last Updated: 2024-08-03T23:17:28.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained - https://pandorafms.com/blog/whats-new-in-pandora-fms-743/ - https://portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fm
rafms.com/blog/whats-new-in-pandora-fms-743/ - https://portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fms-could-trigger-remote-execution-attack
CVE ID: CVE-2021-32100 State: PUBLISHED Published: 2021-05-07T03:51:05 Last Updated: 2024-08-03T23:17:29.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained - https://pandorafms.com/blog/whats-new-in-pandora-fms-743/ - https://portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fms-could-trigger-remote-execution-attack
CVE ID: CVE-2021-32101 State: PUBLISHED Published: 2021-05-07T03:50:56 Last Updated: 2024-08-03T23:17:28.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability - https://community.sonarsource.com/t/openemr
tps://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability - https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592 - https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431 - https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal
CVE ID: CVE-2021-32102 State: PUBLISHED Published: 2021-05-07T03:50:46 Last Updated: 2024-08-03T23:17:29.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability - https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592 - https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431 - https://portswigger.net/daily-swig/healthcare-security-openemr-fi
.org/t/openemr-5-0-2-patch-5-has-been-released/15431 - https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal - https://www.open-emr.org/wiki/index.php/Old_Outdated_OpenEMR_Patches
CVE ID: CVE-2021-32103 State: PUBLISHED Published: 2021-05-07T03:50:35 Last Updated: 2024-08-03T23:17:29.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability - https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592 - https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/
nerability-puts-health-records-at-risk/33592 - https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431 - https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal
CVE ID: CVE-2021-32104 State: PUBLISHED Published: 2021-05-07T03:50:23 Last Updated: 2024-08-03T23:17:29.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability - https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592 - https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431 - https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-s
t/openemr-5-0-2-patch-5-has-been-released/15431 - https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal - https://www.open-emr.org/wiki/index.php/Old_Outdated_OpenEMR_Patches
CVE ID: CVE-2021-32106 State: PUBLISHED Published: 2021-06-08T12:40:04 Last Updated: 2024-08-03T23:17:29.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/icecoder/ICEcoder - https://groups.google.com/g/icecoder/c/xcAc8_1UPxQ - https://prophaze.com/cve/icecoder-8-0-multipe-results-php-replace-cross-site-scripting/