Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ecurity/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840 - https://issues.liferay.com/browse/LPE-17075
CVE ID: CVE-2021-33328 State: PUBLISHED Published: 2021-08-03T18:41:46 Last Updated: 2024-08-03T23:50:41.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/kn
parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972 - https://issues.liferay.com/browse/LPE-17100
CVE ID: CVE-2021-33330 State: PUBLISHED Published: 2021-08-03T18:50:43 Last Updated: 2024-08-03T23:50:41.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747
nces: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720 - https://issues.liferay.com/browse/LPE-17127
CVE ID: CVE-2021-33331 State: PUBLISHED Published: 2021-08-03T20:43:55 Last Updated: 2024-08-03T23:50:41.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the 'redirect' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627 - https://issues.liferay.com/browse/LPE-17022
CVE ID: CVE-2021-33332 State: PUBLISHED Published: 2021-08-03T20:58:01 Last Updated: 2024-08-03T23:50:41.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/
r: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366 - https://issues.liferay.com/browse/LPE-17053
CVE ID: CVE-2021-33333 State: PUBLISHED Published: 2021-08-03T20:47:50 Last Updated: 2024-08-03T23:50:41.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742 - https://issues.liferay.com/browse/LPE-17032
CVE ID: CVE-2021-33334 State: PUBLISHED Published: 2021-08-03T20:52:00 Last Updated: 2024-08-03T23:50:42.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view all forms and form entries in a site via the forms section in site administration. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/H
CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332 - https://issues.liferay.com/browse/LPE-17039
CVE ID: CVE-2021-33335 State: PUBLISHED Published: 2021-08-03T21:03:38 Last Updated: 2024-08-03T23:50:42.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906 - https://issues.liferay.com/browse/LPE-17103
CVE ID: CVE-2021-33336 State: PUBLISHED Published: 2021-08-04T12:53:41 Last Updated: 2024-08-03T23:50:41.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-nam
learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name - https://issues.liferay.com/browse/LPE-17078
CVE ID: CVE-2021-33337 State: PUBLISHED Published: 2021-08-04T13:15:07 Last Updated: 2024-08-03T23:50:42.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored
s://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-media - https://issues.liferay.com/browse/LPE-17101
CVE ID: CVE-2021-33338 State: PUBLISHED Published: 2021-08-04T13:07:26 Last Updated: 2024-08-03T23:50:42.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276 - https://issues.liferay.com/browse/LPE-17030
CVE ID: CVE-2021-33339 State: PUBLISHED Published: 2021-08-04T12:48:21 Last Updated: 2024-08-03T23:50:42.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934 - https://issues.liferay.com/browse/LPE-17102
CVE ID: CVE-2021-33346 State: PUBLISHED Published: 2021-06-24T15:01:45 Last Updated: 2024-08-03T23:50:41.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/EmYiQing/CVE
CVE ID: CVE-2021-33347 State: PUBLISHED Published: 2021-06-18T10:43:25 Last Updated: 2024-08-03T23:50:42.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JPress v3.3.0 and below. There are XSS vulnerabilities in the template module and tag management module. If you log in to the background by means of weak password, the storage XSS vulnerability can occur. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JPressProjects/jpress/issues/152 - https://github.com/JPressProjects/jpress/issues/152#issuecomment-850119847
CVE ID: CVE-2021-33348 State: PUBLISHED Published: 2021-06-24T14:10:14 Last Updated: 2024-08-03T23:50:41.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jfinal/jfinal/issues/188
CVE ID: CVE-2021-33351 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T20:33:11.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 allows attackers to escalte privileges via a crafted payload in the ticket message field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wyomind.com/magento2/helpdesk-magento-2.html - https://www.exploit-db.com/exploits/50113
CVE ID: CVE-2021-33352 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T20:31:52.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via a phar file upload in the ticket message field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wyomind.com/magento2/helpdesk-magento-2.html - https://www.exploit-db.com/exploits/50113
CVE ID: CVE-2021-33353 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-04T21:11:10.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via the file attachment directory setting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wyomind.com/magento2/helpdesk-magento-2.html - https://www.exploit-db.com/exploits/50113
CVE ID: CVE-2021-33354 State: PUBLISHED Published: 2022-09-30T17:05:26.000Z Last Updated: 2025-05-20T16:14:10.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in htmly before 2.8.1 allows remote attackers to perform arbitrary file deletions via modified file parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/danpros/htmly/issues/462
CVE ID: CVE-2021-33356 State: PUBLISHED Published: 2021-06-09T17:49:58 Last Updated: 2024-08-03T23:50:42.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary commands to /installers/common.sh component that can result in remote command execution with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RaspAP/raspap-webgui/blob/5a7b77459839c9420fac0d10ec28cee1af9bb782/installers/common.sh#L216 - https://github.com/RaspAP/raspap-webgui/blob/5a7b77459839c9420fac0d10ec28cee1af9bb782/installers/common.sh#L
n.sh#L216 - https://github.com/RaspAP/raspap-webgui/blob/5a7b77459839c9420fac0d10ec28cee1af9bb782/installers/common.sh#L231 - https://github.com/RaspAP/raspap-webgui/blob/5a7b77459839c9420fac0d10ec28cee1af9bb782/installers/common.sh#L314 - https://github.com/RaspAP/raspap-webgui/blob/5a7b77459839c9420fac0d10ec28cee1af9bb782/installers/common.sh#L407 - https://github.com/RaspAP/raspap-webgui/blob/5a7b77459839c9420fac0d10ec28cee1af9bb782/installers/common.sh#L510 - https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf
CVE ID: CVE-2021-33357 State: PUBLISHED Published: 2021-06-09T17:51:55 Last Updated: 2024-08-03T23:50:42.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RaspAP/raspap-webgui/blob/master/ajax/networking/get_netcfg.php - https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf
CVE ID: CVE-2021-33358 State: PUBLISHED Published: 2021-06-09T17:53:28 Last Updated: 2024-08-03T23:50:42.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpa_passphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$()" which enables an authenticated attacker to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RaspAP/raspap-webgui/blob/8f0ae3b36aa1020d21477e66010c6b2146e7c222/app/img/wifi-qr-code.php - https://github.com/RaspAP/raspap-webgui/blob/b02660d5ff8d9faa5d3ef49778b23
66010c6b2146e7c222/app/img/wifi-qr-code.php - https://github.com/RaspAP/raspap-webgui/blob/b02660d5ff8d9faa5d3ef49778b23e832851e0f4/includes/hostapd.php - https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf
CVE ID: CVE-2021-33359 State: PUBLISHED Published: 2021-06-09T17:45:57 Last Updated: 2024-08-03T23:50:42.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in gowitness < 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/leonjza/status/1395283512433971202?s=19 - https://github.com/sensepost/gowitness/releases/tag/2.3.6
CVE ID: CVE-2021-33360 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-28T17:08:56.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stoqey/gnuplot/blob/cd76060a15f58348baeef1c5fd867ce856515949/src/index.ts#L211-L217 - https://advisory.checkmarx.net/advisory/CX-2021-4811/
CVE ID: CVE-2021-33361 State: PUBLISHED Published: 2021-09-13T00:00:00 Last Updated: 2024-08-03T23:50:42.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the afra_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1782 - https://github.com/gpac/gpac/commit/a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-33362 State: PUBLISHED Published: 2021-09-13T18:45:52 Last Updated: 2024-08-03T23:50:42.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack buffer overflow in the hevc_parse_vps_extension function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1780 - https://github.com/gpac/gpac/commit/1273cdc706eeedf8346d4b9faa5b33435056061d
CVE ID: CVE-2021-33363 State: PUBLISHED Published: 2021-09-13T00:00:00 Last Updated: 2024-08-03T23:50:42.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the infe_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1786 - https://github.com/gpac/gpac/commit/ec64c7b8966d7e4642d12debb888be5acf18efb9 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-33364 State: PUBLISHED Published: 2021-09-13T00:00:00 Last Updated: 2024-08-03T23:50:42.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the def_parent_box_new function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1783 - https://github.com/gpac/gpac/commit/fe5155cf047252d1c4cb91602048bfa682af0ea7 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-33365 State: PUBLISHED Published: 2021-09-13T00:00:00 Last Updated: 2024-08-03T23:50:42.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the gf_isom_get_root_od function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1784 - https://github.com/gpac/gpac/commit/984787de3d414a5f7d43d0b4584d9469dff2a5a5 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-33366 State: PUBLISHED Published: 2021-09-13T00:00:00 Last Updated: 2024-08-03T23:50:42.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1785 - https://github.com/gpac/gpac/commit/0a85029d694f992f3631e2f249e4999daee15cbf - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-33367 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-03-12T15:09:23.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker to cause a denial of service via a crafted JXR file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/freeimage/discussion/36109/thread/1a4db03d58/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WEG5FTVLVSO26TEEYKORM42WZ4LEHIJB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AXWMZOYJKXWO
4LEHIJB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AXWMZOYJKXWOEEUV7ZKW4BX772F5P2HL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXJ4QSLSK4HLH5ZDMDC42F7XLWLFADRD/
CVE ID: CVE-2021-33371 State: PUBLISHED Published: 2022-07-27T23:15:59 Last Updated: 2024-08-03T23:50:42.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in /nav_bar_action.php of Student Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat box. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49865
CVE ID: CVE-2021-33387 State: PUBLISHED Published: 2023-02-24T00:00:00.000Z Last Updated: 2025-03-12T16:00:22.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bg5sbk/MiniCMS/issues/40
CVE ID: CVE-2021-33388 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T18:20:34.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: dpic 2021.04.10 has a Heap Buffer Overflow in themakevar() function in dpic.y Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/aplevich/dpic/-/issues/8
CVE ID: CVE-2021-33390 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T18:19:26.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: dpic 2021.04.10 has a use-after-free in thedeletestringbox() function in dpic.y. A different vulnerablility than CVE-2021-32421. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/aplevich/dpic/-/issues/10
CVE ID: CVE-2021-33391 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T19:03:45.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/htacg/tidy-html5/issues/946
CVE ID: CVE-2021-33393 State: PUBLISHED Published: 2021-06-09T21:25:52 Last Updated: 2024-08-03T23:50:43.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MucahitSaratar/ipfire-2-25-auth-rce - https://github.com/ipfire/ipfire-2.x/commit/6769d90
ferences: - https://github.com/MucahitSaratar/ipfire-2-25-auth-rce - https://github.com/ipfire/ipfire-2.x/commit/6769d909306d7bdc43d64598872126fcf1b217f6 - https://github.com/ipfire/ipfire-2.x/commits/master?since=2021-05-17&until=2021-05-17 - http://packetstormsecurity.com/files/163158/IPFire-2.25-Remote-Code-Execution.html