Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-45293 State: PUBLISHED Published: 2021-12-21T17:54:31 Last Updated: 2024-08-04T04:39:20.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WebAssembly/binaryen/issues/4384 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCWLB4PWYQO55F7IGNC7KUYN2MFZE3JP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKGCHPS7UAIOOBGSXDJAUFE5CROTTF6J/
CVE ID: CVE-2021-45297 State: PUBLISHED Published: 2021-12-21T00:00:00 Last Updated: 2024-08-04T04:39:20.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: An infinite loop vulnerability exists in Gpac 1.0.1 in gf_get_bit_size. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1973 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-45310 State: PUBLISHED Published: 2022-02-14T20:15:53 Last Updated: 2024-08-04T04:39:20.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted by sending an unauthenticated HTTP GET request to the https://Switchvox-IP/main?cmd=invalid_browser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IthacaLabs/Sangoma/tree/main/Switchvox_Version%201
lyst Notes: - CVE Program Container: References: - https://github.com/IthacaLabs/Sangoma/tree/main/Switchvox_Version%20102409
CVE ID: CVE-2021-45325 State: PUBLISHED Published: 2022-02-08T14:36:14 Last Updated: 2024-08-04T04:39:20.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL. Additional Analyst Notes: - CVE Program Container: References: - https://blog.gitea.io/2019/01/gitea-1.7.0-is-released/ - https://github.com/go-gitea/gitea/pull/5705
CVE ID: CVE-2021-45326 State: PUBLISHED Published: 2022-02-08T14:48:50 Last Updated: 2024-08-04T04:39:20.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests. Additional Analyst Notes: - CVE Program Container: References: - https://blog.gitea.io/2018/10/gitea-1.5.2-is-released/ - https://github.com/go-gitea/gitea/pull/4840 - https://github.com/go-gitea/gitea/issues/4838
CVE ID: CVE-2021-45327 State: PUBLISHED Published: 2022-02-08T14:57:36 Last Updated: 2024-08-04T04:39:20.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://blog.gitea.io/2020/03/gitea-1.11.2-is-released/ - https://github.com/go-gitea/gitea/pull/10462 - https://github.com/go-gitea/gitea/pull/10465 - https://github.com/go-gitea/gitea/pull/10582
CVE ID: CVE-2021-45328 State: PUBLISHED Published: 2022-02-08T15:14:10 Last Updated: 2024-08-04T04:39:20.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. Additional Analyst Notes: - CVE Program Container: References: - https://blog.gitea.io/2018/06/release-of-1.4.3/ - https://github.com/go-gitea/gitea/issues/4332
CVE ID: CVE-2021-45329 State: PUBLISHED Published: 2022-02-08T22:26:52 Last Updated: 2024-08-04T04:39:20.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field. Additional Analyst Notes: - CVE Program Container: References: - https://blog.gitea.io/2018/09/gitea-1.5.1-is-released/ - https://github.com/go-gitea/gitea/pull/4710
CVE ID: CVE-2021-45330 State: PUBLISHED Published: 2022-02-09T17:16:16 Last Updated: 2024-08-04T04:39:20.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/go-gitea/gitea/issues/4336
CVE ID: CVE-2021-45331 State: PUBLISHED Published: 2022-02-09T17:22:44 Last Updated: 2024-08-04T04:39:20.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once. Additional Analyst Notes: - CVE Program Container: References: - https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/ - https://github.com/go-gitea/gitea/pull/3878
CVE ID: CVE-2021-45334 State: PUBLISHED Published: 2022-01-09T18:57:05 Last Updated: 2024-08-04T04:39:20.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online Thesis Archiving System 1.0 is vulnerable to SQL Injection. An attacker can bypass admin authentication and gain access to admin panel using SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/165272/Online-Thesis-Archiving-System-1.0-SQL-Injection-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/50597 - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-45334 - https://www.nu11secur1ty.com/2022/01/cve-2021-45334.ht
ps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-45334 - https://www.nu11secur1ty.com/2022/01/cve-2021-45334.html
CVE ID: CVE-2021-45335 State: PUBLISHED Published: 2021-12-27T12:29:43 Last Updated: 2024-08-04T04:39:20.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or delete arbitrary system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast-0 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST3%20%26%20CVE-2021-AVST4%20%26%20CVE-2021-AVST5
CVE ID: CVE-2021-45336 State: PUBLISHED Published: 2021-12-27T12:35:42 Last Updated: 2024-08-04T04:39:20.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using system IPC interfaces which could lead to exit the sandbox and acquire SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast-0 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST3%20%26%20CVE-2021-AVST4%20%26%20CV
t-0 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST3%20%26%20CVE-2021-AVST4%20%26%20CVE-2021-AVST5
CVE ID: CVE-2021-45337 State: PUBLISHED Published: 2021-12-27T12:44:28 Last Updated: 2024-08-04T04:39:20.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by "hollowing" process wsc_proxy.exe which could lead to acquire antimalware (AM-PPL) protection. Additional Analyst Notes: - CVE Program Container: References: - https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast-0 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST3%20%26%20CVE-2021-AV
ck-bug-to-avast-0 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST3%20%26%20CVE-2021-AVST4%20%26%20CVE-2021-AVST5
CVE ID: CVE-2021-45338 State: PUBLISHED Published: 2021-12-27T12:53:00 Last Updated: 2024-08-04T04:39:20.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of the main antivirus service which could lead to the (1) arbitrary file delete, (2) write and (3) reset security. Additional Analyst Notes: - CVE Program Container: References: - https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast-0 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-20
r-david-eade-reports-antitrack-bug-to-avast-0 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.1 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.2 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.3
CVE ID: CVE-2021-45339 State: PUBLISHED Published: 2021-12-27T12:57:43 Last Updated: 2024-08-04T04:39:20.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could lead to the bypassing of Avast self-defense. Additional Analyst Notes: - CVE Program Container: References: - https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast-0 - https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST0
CVE ID: CVE-2021-45340 State: PUBLISHED Published: 2022-01-25T11:36:09 Last Updated: 2024-08-04T04:39:20.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libsixel/libsixel/issues/51
CVE ID: CVE-2021-45341 State: PUBLISHED Published: 2022-01-25T00:00:00 Last Updated: 2024-08-04T04:39:20.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreCAD/LibreCAD/issues/1462 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/ - https://www.debian.org/security/2022/dsa-5077 - https://lists.fedoraproject.org/archives/list/packa
ZEA35Q5UB7PDVVVYS/ - https://www.debian.org/security/2022/dsa-5077 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCC2FZ6HZOIK3775K4MTCOUHX6PLGPEL/ - https://security.gentoo.org/glsa/202305-26
CVE ID: CVE-2021-45342 State: PUBLISHED Published: 2022-01-25T00:00:00 Last Updated: 2024-08-04T04:39:20.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreCAD/LibreCAD/issues/1464 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/ - https://www.debian.org/security/2022/dsa-5077 - https://lists.fedoraproject.org/archives/list/packa
CVE ID: CVE-2021-45343 State: PUBLISHED Published: 2022-01-25T00:00:00 Last Updated: 2024-08-04T04:39:20.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreCAD/LibreCAD/issues/1468 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/ - https://www.debian.org/security/2022/dsa-5077 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
www.debian.org/security/2022/dsa-5077 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCC2FZ6HZOIK3775K4MTCOUHX6PLGPEL/ - https://security.gentoo.org/glsa/202305-26
CVE ID: CVE-2021-45345 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-28T15:10:46.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability found in En3rgy WebcamServer v.0.5.2 allows a remote attacker to cause a denial of service via the WebcamServer.exe file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/0xHop/0d065694d56ac3943d8e8c239d80c63f - https://sourceforge.net/projects/webcamserv/ - https://gist.github.com/0xHop/337e65ec684b8866e86f4b25b8f1dbc7
CVE ID: CVE-2021-45346 State: PUBLISHED Published: 2022-02-14T00:00:00 Last Updated: 2024-08-04T04:39:20.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or
ed database file and submit a query against the database, it might read parts of the database that you did not intend or expect. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/guyinatuxedo/sqlite3_record_leaking - https://security.netapp.com/advisory/ntap-20220303-0001/ - https://sqlite.org/forum/forumpost/53de8864ba114bf6 - https://www.sqlite.org/cves.html#status_of_recent_sqlite_cves - https://sqlite.org/forum/forumpost/056d557c2f8c452ed5
CVE ID: CVE-2021-45347 State: PUBLISHED Published: 2022-02-14T18:35:48 Last Updated: 2024-08-04T04:39:20.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/forget-code/zzcms/issues/2
CVE ID: CVE-2021-45348 State: PUBLISHED Published: 2022-02-14T19:31:31 Last Updated: 2024-08-04T04:39:20.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Arbitrary File Deletion vulnerability exists in SourceCodester Attendance Management System v1.0 via the csv parameter in admin/pageUploadCSV.php, which can cause a Denial of Service (crash). Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14173/attendance-management-system.html#comment-96869
CVE ID: CVE-2021-45357 State: PUBLISHED Published: 2022-02-10T17:38:27 Last Updated: 2024-08-04T04:39:20.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/1582
CVE ID: CVE-2021-45364 State: PUBLISHED Published: 2022-02-10T18:38:12 Last Updated: 2024-08-04T04:39:20.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publishing this CVE Record, and that all parties agree that the affected code was not used in any Statamic product Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Stakcery/Web-Security/issues/2
CVE ID: CVE-2021-45379 State: PUBLISHED Published: 2021-12-30T17:35:11 Last Updated: 2024-08-04T04:39:20.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/babelouest/glewlwyd/commit/125281f1c0d4b6a8b49f7e55a757205a2ef01fbe - https://github.com/babelouest/glewlwyd/releases/tag/v2.6.1
CVE ID: CVE-2021-45380 State: PUBLISHED Published: 2022-01-23T16:09:29 Last Updated: 2024-08-04T04:39:20.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inc_head.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/appcms/issues/8
CVE ID: CVE-2021-45382 State: PUBLISHED Published: 2022-02-17T20:07:46.000Z Last Updated: 2025-10-21T23:15:45.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10264 - https://github.com/doudoudedi/D-LINK_Command_Injection1/blob/main/D-LINK_Command_injection.md
CVE ID: CVE-2021-45385 State: PUBLISHED Published: 2022-02-11T15:18:09 Last Updated: 2024-08-04T04:39:20.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load(). When the size information in metadata of the bmp is out of range, it returns without assign memory buffer to `pb->pdata` and did not exit the program. So the program crashes when it tries to access the pb->data, in jfif_encode() at jfif.c:763. This is due to the incomplete patch for CVE-2020-13438. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rockcarry/ffjpeg/issues/47 - https://github.com/rockca
Notes: - CVE Program Container: References: - https://github.com/rockcarry/ffjpeg/issues/47 - https://github.com/rockcarry/ffjpeg/pull/48
CVE ID: CVE-2021-45386 State: PUBLISHED Published: 2022-02-11T00:00:00 Last Updated: 2024-08-04T04:39:20.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/687 - https://security.gentoo.org/glsa/202210-08
CVE ID: CVE-2021-45387 State: PUBLISHED Published: 2022-02-11T00:00:00 Last Updated: 2024-08-04T04:39:20.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/687 - https://security.gentoo.org/glsa/202210-08
CVE ID: CVE-2021-45388 State: REJECTED Published: 2022-01-12T16:13:53 Last Updated: 2022-01-12T16:13:53 Description: No description available.
CVE ID: CVE-2021-45389 State: PUBLISHED Published: 2022-01-04T15:40:34 Last Updated: 2024-08-04T04:39:20.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864. Additional Analyst Notes: - CVE Program Container: References: - https://www.starwindsoftware.com/security/sw-20211512-0001/ - https://www.starwindsoftware.com/security/sw-20211215-0001/
CVE ID: CVE-2021-45391 State: PUBLISHED Published: 2022-02-16T13:13:26 Last Updated: 2024-08-04T04:39:20.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in the goform/setIPv6Status binary file /usr/sbin/httpd via the conType parameter, which causes a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenda.com.cn/ - http://tendawifi.com/index.html - https://www.tenda.com.cn/product/AX12.html - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX12/1
CVE ID: CVE-2021-45392 State: PUBLISHED Published: 2022-02-14T16:25:58 Last Updated: 2024-08-04T04:39:20.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the prefixDelegate parameter, which causes a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenda.com.cn/ - http://tendawifi.com/index.html - https://www.tenda.com.cn/product/AX12.html - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX12/2
CVE ID: CVE-2021-45394 State: PUBLISHED Published: 2022-01-18T11:15:45 Last Updated: 2024-08-04T04:39:20.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spipu/html2pdf - https://www.synacktiv.com/sites/default/files/2022-01/html2pdf_ssrf_deserialization.pdf - https://github.com/spipu/html2pdf/blob/master/CHANGELOG.md
CVE ID: CVE-2021-45401 State: PUBLISHED Published: 2022-02-18T17:31:46 Last Updated: 2024-08-04T04:39:20.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/Tenda_AC10U_command_injection_RCE.pdf
CVE ID: CVE-2021-45402 State: PUBLISHED Published: 2022-02-11T14:36:29 Last Updated: 2024-08-04T04:39:20.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=3cf2b61eb06765e27fec6799292d9fb46d0b7e60 - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=e572ff80f05c33c