Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-20092 State: PUBLISHED Published: 2021-04-29T14:29:16 Last Updated: 2024-08-03T17:30:07.564Z Vendors: n/a Products: Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3 Problem Types: Improper Access Control Description: The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive information from an unauthorized actor. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-13
CVE ID: CVE-2021-20093 State: PUBLISHED Published: 2021-06-16T11:09:02 Last Updated: 2024-08-03T17:30:07.515Z Vendors: n/a Products: Wibu-Systems CodeMeter Problem Types: Buffer Over-read Description: A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-24 - https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-01.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf - htt
s/security_advisories/Advisory_WIBU-210423-01.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02
CVE ID: CVE-2021-20094 State: PUBLISHED Published: 2021-06-16T11:09:07 Last Updated: 2024-08-03T17:30:07.586Z Vendors: n/a Products: Wibu-Systems CodeMeter Problem Types: Uncaught Exception Description: A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to crash the CodeMeter Runtime Server. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-24 - https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210423-02.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf - https://us-cert.cisa.gov/ics/advi
_WIBU-210423-02.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02
CVE ID: CVE-2021-20095 State: REJECTED Published: 2021-04-29T14:06:56 Last Updated: 2021-06-16T15:02:01 Description: No description available.
CVE ID: CVE-2021-20096 State: PUBLISHED Published: 2021-05-25T11:31:10 Last Updated: 2024-08-03T17:30:07.337Z Vendors: n/a Products: OpenOversight Problem Types: Cross-site Request Forgery Description: Cross-site request forgery in OpenOversight 0.6.4 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-18
CVE ID: CVE-2021-20099 State: PUBLISHED Published: 2021-06-28T10:29:13 Last Updated: 2024-08-03T17:30:07.420Z Vendors: n/a Products: Nessus Agent Problem Types: Local Privilege Escalation Description: Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local administrator to run specific Windows executables as the Nessus host. This is different than CVE-2021-20100. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2021-12
CVE ID: CVE-2021-20100 State: PUBLISHED Published: 2021-06-28T10:29:19 Last Updated: 2024-08-03T17:30:07.663Z Vendors: n/a Products: Nessus Agent Problem Types: Local Privilege Escalation Description: Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local administrator to run specific Windows executables as the Nessus host. This is different than CVE-2021-20099. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2021-12
CVE ID: CVE-2021-20101 State: PUBLISHED Published: 2021-06-29T15:30:39 Last Updated: 2024-08-03T17:30:07.625Z Vendors: n/a Products: AppNitro Machform Problem Types: Host Header Injection Description: Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE ID: CVE-2021-20102 State: PUBLISHED Published: 2021-06-29T15:30:45 Last Updated: 2024-08-03T17:30:07.598Z Vendors: n/a Products: AppNitro Machform Problem Types: Cross-Site Request Forgery Description: Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE ID: CVE-2021-20103 State: PUBLISHED Published: 2021-06-29T15:30:51 Last Updated: 2024-08-03T17:30:07.450Z Vendors: n/a Products: AppNitro Machform Problem Types: Unauthenticated File Upload Description: Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through upload.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE ID: CVE-2021-20104 State: PUBLISHED Published: 2021-06-29T15:31:01 Last Updated: 2024-08-03T17:30:07.637Z Vendors: n/a Products: AppNitro Machform Problem Types: Remote Code Execution Description: Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms through upload.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE ID: CVE-2021-20105 State: PUBLISHED Published: 2021-06-29T15:37:41 Last Updated: 2024-08-03T17:30:07.572Z Vendors: n/a Products: AppNitro Machform Problem Types: Open Redirect Description: Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE ID: CVE-2021-20106 State: PUBLISHED Published: 2021-07-21T10:20:42 Last Updated: 2024-08-03T17:30:07.478Z Vendors: n/a Products: Nessus Agent Problem Types: Local Privilege Escalation Description: Nessus Agent versions 8.2.5 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user to upload a specially crafted file that could lead to gaining administrator privileges on the Nessus host. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2021-13
CVE ID: CVE-2021-20107 State: PUBLISHED Published: 2021-06-30T13:21:56 Last Updated: 2024-08-03T17:30:08.193Z Vendors: n/a Products: SLOAN Problem Types: Improper Access Control Description: There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device. Some of these control the flow of water, the sensitivity of the sensors, and information about maintenance. Additional Analyst
these control the flow of water, the sensitivity of the sensors, and information about maintenance. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-26-0
CVE ID: CVE-2021-20108 State: PUBLISHED Published: 2021-07-19T14:34:05 Last Updated: 2024-08-03T17:30:07.471Z Vendors: n/a Products: Manage Engine Asset Explorer Agent Problem Types: Denial of service Description: Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory
ge engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-29
CVE ID: CVE-2021-20109 State: PUBLISHED Published: 2021-07-19T14:24:30 Last Updated: 2024-08-03T17:30:07.481Z Vendors: n/a Products: Manage Engine Asset Explorer Agent Problem Types: Heap overflow Description: Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload r
responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using vswprintf. This is written to a buffer only 0x2000 bytes big. If POST payload is larger, then heap overflow will occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-30
CVE ID: CVE-2021-20110 State: PUBLISHED Published: 2021-07-19T14:48:14 Last Updated: 2024-08-03T17:30:07.426Z Vendors: n/a Products: Manage Engine Asset Explorer Agent Problem Types: Arbitrary Code Execution Description: Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In httphandler.cpp, the agent reaching out over HTTP is vulnerable to an Integer Overflow, which can be turned into a
. In httphandler.cpp, the agent reaching out over HTTP is vulnerable to an Integer Overflow, which can be turned into a Heap Overflow allowing for remote code execution as NT AUTHORITY/SYSTEM on the agent machine. The Integer Overflow occurs when receiving POST response from the Manage Engine server, and the agent calling "HttpQueryInfoW" in order to get the "Content-Length" size from the incoming POST request. This size is taken, but multiplied to a larger amount. If an attacker specifies a Content-Length size of 1073741823 or larger, this integer arithmetic will wrap the value back around to smaller integer, then calls "calloc" with this size to allocate memory. The following API "Internet
value back around to smaller integer, then calls "calloc" with this size to allocate memory. The following API "InternetReadFile" will copy the POST data into this buffer, which will be too small for the contents, and cause heap overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-31
CVE ID: CVE-2021-20111 State: PUBLISHED Published: 2021-07-29T17:57:30 Last Updated: 2024-08-03T17:30:07.606Z Vendors: n/a Products: TCExam Problem Types: Stored XSS Description: A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tce_filemanager.php could upload a malicious javascript payload which would be triggered when another user views the file. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-32
CVE ID: CVE-2021-20112 State: PUBLISHED Published: 2021-07-29T18:00:21 Last Updated: 2024-08-03T17:30:07.345Z Vendors: n/a Products: TCExam Problem Types: Stored XSS Description: A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tce_select_mediafile.php could upload a malicious javascript payload which would be triggered when another user views the file. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-32
CVE ID: CVE-2021-20113 State: PUBLISHED Published: 2021-07-29T18:00:49 Last Updated: 2024-08-03T17:30:07.624Z Vendors: n/a Products: TCExam Problem Types: Observable Discrepancy Description: An exposure of sensitive information vulnerability exists in TCExam <= 14.8.1. If a password reset request was made for an email address that was not registered with a user then we would be presented with an ‘unknown email’ error. If an email is given that is registered with a user then this error will not appear. A malicious actor could abuse this to enumerate the email addresses of Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-32
CVE ID: CVE-2021-20114 State: PUBLISHED Published: 2021-07-29T18:00:55 Last Updated: 2024-08-03T17:30:07.420Z Vendors: n/a Products: TCExam Problem Types: Exposure of Sensitive Information to an Unauthorized Actor Description: When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database backup files. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-32
CVE ID: CVE-2021-20115 State: PUBLISHED Published: 2021-08-05T20:38:20 Last Updated: 2024-08-03T17:30:07.373Z Vendors: n/a Products: TCExam Problem Types: Reflected Cross-Site Scripting Description: A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tce_filemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf. Additional Analyst Notes: - CVE Program Container: References: -
victim's session or performing actions on their behalf. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-32
CVE ID: CVE-2021-20116 State: PUBLISHED Published: 2021-08-05T20:38:27 Last Updated: 2024-08-03T17:30:07.684Z Vendors: n/a Products: TCExam Problem Types: Reflected Cross-Site Scripting Description: A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir parameters in tce_select_mediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf. Additional Analyst Notes: - CVE Program Container: Referenc
the victim's session or performing actions on their behalf. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-32
CVE ID: CVE-2021-20117 State: PUBLISHED Published: 2021-09-09T11:26:52 Last Updated: 2024-08-03T17:30:07.760Z Vendors: n/a Products: Nessus Agent Problem Types: Local Privilege Escalation Description: Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. This is different than CVE-2021-20118. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2021-15
CVE ID: CVE-2021-20118 State: PUBLISHED Published: 2021-09-09T11:26:58 Last Updated: 2024-08-03T17:30:07.525Z Vendors: n/a Products: Nessus Agent Problem Types: Local Privilege Escalation Description: Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. This is different than CVE-2021-20117. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2021-15
CVE ID: CVE-2021-20119 State: PUBLISHED Published: 2021-11-09T18:13:22 Last Updated: 2024-08-03T17:30:07.568Z Vendors: n/a Products: Arris SurfBoard SB8200 Problem Types: Insecure Password Change Utility Description: The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the administrator password. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-49
CVE ID: CVE-2021-20120 State: PUBLISHED Published: 2021-10-21T16:27:20 Last Updated: 2024-08-03T17:30:07.478Z Vendors: n/a Products: Arris SurfBoard SB8200 Problem Types: Cross Site Request Forgery Description: The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker could make configuration changes (such as changing the administrative password) without the consent of the user. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-45
CVE ID: CVE-2021-20121 State: PUBLISHED Published: 2021-10-11T16:48:55 Last Updated: 2024-08-03T17:30:07.637Z Vendors: n/a Products: Telus Wi-Fi Hub (PRV65B444A-S-TS) Problem Types: Arbitrary file read Description: The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is vulnerable to an authenticated arbitrary file read. An authenticated user with physical access to the device can read arbitrary files from the device by preparing and connecting a specially prepared USB drive to the device, and making a series of crafted requests to the device's web interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-41
CVE ID: CVE-2021-20122 State: PUBLISHED Published: 2021-10-11T16:48:59 Last Updated: 2024-08-03T17:30:07.433Z Vendors: n/a Products: Telus Wi-Fi Hub (PRV65B444A-S-TS) Problem Types: Command Injection Description: The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiple parameters passed to tr69_cmd.cgi. A remote attacker connected to the router's LAN and authenticated with a super user account, or using a bypass authentication vulnerability like CVE-2021-20090 could leverage this issue to run commands or gain a shell as root on the target device. Additional Analyst Notes: - CVE Program Container: Reference
run commands or gain a shell as root on the target device. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-41
CVE ID: CVE-2021-20123 State: PUBLISHED Published: 2021-10-13T15:47:58.000Z Last Updated: 2025-10-21T23:25:28.693Z Vendors: n/a Products: Draytek VigorConnect Problem Types: Path Traversal Description: A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2021-42
CVE ID: CVE-2021-20124 State: PUBLISHED Published: 2021-10-13T15:48:03.000Z Last Updated: 2025-10-21T23:25:28.553Z Vendors: n/a Products: Draytek VigorConnect Problem Types: Path Traversal Description: A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2021-42
CVE ID: CVE-2021-20125 State: PUBLISHED Published: 2021-10-13T15:48:08 Last Updated: 2024-08-03T17:30:07.504Z Vendors: n/a Products: Draytek VigorConnect Problem Types: Unrestricted Upload of File with Dangerous Type Description: An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3. An unauthenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-42
CVE ID: CVE-2021-20126 State: PUBLISHED Published: 2021-10-13T15:48:15 Last Updated: 2024-08-03T17:30:07.598Z Vendors: n/a Products: Draytek VigorConnect Problem Types: Cross-Site Request Forgery Description: Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-42
CVE ID: CVE-2021-20127 State: PUBLISHED Published: 2021-10-13T15:49:25 Last Updated: 2024-08-03T17:30:07.367Z Vendors: n/a Products: Draytek VigorConnect Problem Types: Improper Access Control Description: An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-B3. This allows an authenticated user to arbitrarily delete files in any location on the target operating system with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-42
CVE ID: CVE-2021-20128 State: PUBLISHED Published: 2021-10-13T15:49:30 Last Updated: 2024-08-03T17:30:07.492Z Vendors: n/a Products: Draytek VigorConnect Problem Types: Cross-site Scripting Description: The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as user input is not properly sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-42