Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-31547 State: PUBLISHED Published: 2021-04-22T02:30:35 Last Updated: 2024-08-03T23:03:33.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T223654 - https://gerrit.wikimedia.org/r/q/I3f7dbd8b873d411e37c8c3aac2339bf5ec36907d - https://gerrit.wikimedia.org/r/q/I4900b1be73323599d74e3164447f81eded094d75
CVE ID: CVE-2021-31548 State: PUBLISHED Published: 2021-04-22T02:30:22 Last Updated: 2024-08-03T23:03:33.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T272333 - https://gerrit.wikimedia.org/r/q/Ifac795125927d584a31d95e1b4c4241eef860fa1
CVE ID: CVE-2021-31549 State: PUBLISHED Published: 2021-04-22T02:30:10 Last Updated: 2024-08-03T23:03:33.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppressed MediaWiki usernames to unprivileged users. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T274152 - https://gerrit.wikimedia.org/r/q/I6063c02fa261c4cc0e6dbbb2db4e111eb85912c2 - https://gerrit.wikimedia.org/r/q/I71a6d521bd12931ce60eec4d2dc35af19146000f
CVE ID: CVE-2021-31550 State: PUBLISHED Published: 2021-04-22T02:30:00 Last Updated: 2024-08-03T23:03:33.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T270767 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Commentbox/+/651934/
CVE ID: CVE-2021-31551 State: PUBLISHED Published: 2021-04-22T02:29:51 Last Updated: 2024-08-03T23:03:33.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T259433 - https://gerrit.wikimedia.org/r/q/Ibe68b070ee791cd0c8e7f50eb04ac4e066b1512c - https://gerrit.wikimedia.org/r/q/I5e0abbc2f80e6bda255b3b32a4df39a7fe7d3793 - https://gerrit.wikimedia.org/r/q/I20b63bd38779d2ccbe2d86f9879df85ca3b685f
/q/I5e0abbc2f80e6bda255b3b32a4df39a7fe7d3793 - https://gerrit.wikimedia.org/r/q/I20b63bd38779d2ccbe2d86f9879df85ca3b685f6
CVE ID: CVE-2021-31552 State: PUBLISHED Published: 2021-04-22T02:29:41 Last Updated: 2024-08-03T23:03:33.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while blocking only the IP address used to create an account (and not the user account itself). Such rules could also be used by a nefarious, unprivileged user to catalog and enumerate any number of IP addresses related to these account creations. Additional Analyst Notes: - CVE Program Container: Ref
te any number of IP addresses related to these account creations. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T152394 - https://gerrit.wikimedia.org/r/q/I8bae477ad7e4d0190335363ac2decf28e4313da1
CVE ID: CVE-2021-31553 State: PUBLISHED Published: 2021-04-22T02:29:31 Last Updated: 2024-08-03T23:03:33.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the cu_log database table such that denial of service occurred for certain CheckUser extension pages and functionality. For example, the attacker could turn off Special:CheckUserLog and thus interfere with usage tracking. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T275669 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/C
ainer: References: - https://phabricator.wikimedia.org/T275669 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667023 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667024 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667025 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667027 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666963 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666964
CVE ID: CVE-2021-31554 State: PUBLISHED Published: 2021-04-22T02:29:19 Last Updated: 2024-08-03T23:03:33.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly handled account blocks for certain automatically created MediaWiki user accounts, thus allowing nefarious users to remain unblocked. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T272244 - https://gerrit.wikimedia.org/r/q/Ie1f4333d5b1c9d17fb2236fe38a31de427a4cc48
CVE ID: CVE-2021-31555 State: PUBLISHED Published: 2021-04-22T02:28:51 Last Updated: 2024-08-03T23:03:33.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarc_version (aka oauth_registered_consumer.oarc_version) parameter's length. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T277388 - https://gerrit.wikimedia.org/r/q/I222c053b4b14ac1ad0f5b3a51565b1b9cd4c139d
CVE ID: CVE-2021-31556 State: PUBLISHED Published: 2021-08-12T21:38:44 Last Updated: 2024-08-03T23:03:33.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key will fit in a MySQL blob. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T277380 - https://gerrit.wikimedia.org/r/q/I13ff0350a9a0a3cd5ab3e1f82dd0d8d9c13cf9e9 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/ - https://lists.fedoraproject.or
st/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
CVE ID: CVE-2021-31558 State: PUBLISHED Published: 2021-12-22T18:06:51.363723Z Last Updated: 2024-09-16T18:40:05.583Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr” of the script “DIAE_hierarchyHandler.ashx”. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03
CVE ID: CVE-2021-31559 State: PUBLISHED Published: 2022-05-06T16:35:19 Last Updated: 2024-08-03T23:03:33.306Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-288 Description: A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0503.html
CVE ID: CVE-2021-31562 State: PUBLISHED Published: 2022-01-21T18:17:40.000Z Last Updated: 2025-04-16T16:47:21.698Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Fresenius Kabi Products: Agilia Link+ Problem Types: CWE-327 Description: The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in different ways. An attacker may be able to eavesdrop on transferred data, manipulate data allegedly secured by SSL/TLS, and impersonate an entity to gain access to sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
access to sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
CVE ID: CVE-2021-31566 State: PUBLISHED Published: 2022-08-23T00:00:00 Last Updated: 2024-08-03T23:03:33.486Z Vendors: n/a Products: libarchive Problem Types: CWE-59 Description: An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/issues/1566 - https://github.com/libarchive/li
Program Container: References: - https://github.com/libarchive/libarchive/issues/1566 - https://github.com/libarchive/libarchive/commit/b41daecb5ccb4c8e3b2c53fd6147109fc12c3043 - https://bugzilla.redhat.com/show_bug.cgi?id=2024237 - https://access.redhat.com/security/cve/CVE-2021-31566 - https://lists.debian.org/debian-lts-announce/2022/11/msg00030.html
CVE ID: CVE-2021-31567 State: PUBLISHED Published: 2022-01-28T19:09:54.368Z Last Updated: 2025-02-20T20:32:09.560Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS. Additional Analyst Notes: - CVE Program Container: - CIS
web server home directory and download any file within the OS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/download-monitor/#developers - https://github.com/WPChill/download-monitor/blob/master/changelog.txt - https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-arbitrary-file-download-vulnerability
CVE ID: CVE-2021-31571 State: PUBLISHED Published: 2021-04-22T17:56:24 Last Updated: 2024-08-03T23:03:33.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRTOS/FreeRTOS-Kernel/commit/47338393f1f79558f6144213409f09f81d7c4837
CVE ID: CVE-2021-31572 State: PUBLISHED Published: 2021-04-22T17:56:35 Last Updated: 2024-08-03T23:03:33.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRTOS/FreeRTOS-Kernel/commit/d05b9c123f2bf9090bce386a244fc934ae44db5b
CVE ID: CVE-2021-31573 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T14:40:09.765Z Vendors: MediaTek, Inc. Products: EN7528, EN7580 Problem Types: Elevation of Privilege Description: In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-acknowledgements
CVE ID: CVE-2021-31574 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T14:36:30.701Z Vendors: MediaTek, Inc. Products: EN7528, EN7580 Problem Types: Elevation of Privilege Description: In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-acknowledgements
CVE ID: CVE-2021-31575 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T15:27:49.451Z Vendors: MediaTek, Inc. Products: EN7528, EN7580 Problem Types: Elevation of Privilege Description: In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-acknowledgements
CVE ID: CVE-2021-31576 State: PUBLISHED Published: 2023-02-06T00:00:00 Last Updated: 2024-08-03T23:03:33.568Z Vendors: MediaTek, Inc. Products: EN7528, EN7580 Problem Types: Elevation of Privilege Description: In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB00123241. Additional Analyst Notes: - CVE Program Container: References: - https://corp.mediatek.com/product-security-acknowledgements
CVE ID: CVE-2021-31577 State: PUBLISHED Published: 2023-02-06T00:00:00 Last Updated: 2024-08-03T23:03:33.246Z Vendors: MediaTek, Inc. Products: EN7528, EN7580 Problem Types: Elevation of Privilege Description: In Boa, there is a possible escalation of privilege due to a missing permission check. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB00123241. Additional Analyst Notes: - CVE Program Container: References: - https://corp.mediatek.com/product-security-acknowledgements
CVE ID: CVE-2021-31578 State: PUBLISHED Published: 2023-02-06T00:00:00 Last Updated: 2024-08-03T23:03:33.483Z Vendors: MediaTek, Inc. Products: EN7528, EN7580 Problem Types: Elevation of Privilege Description: In Boa, there is a possible escalation of privilege due to a stack buffer overflow. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB00123241. Additional Analyst Notes: - CVE Program Container: References: - https://corp.mediatek.com/product-security-acknowledgements
CVE ID: CVE-2021-31579 State: PUBLISHED Published: 2021-07-22T18:27:17 Last Updated: 2024-08-03T23:03:33.409Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Akkadian Products: Provisioning Manager Engine (PME) Problem Types: CWE-798 Description: Akkadian Provisioning Manager Engine (PME) ships with a hard-coded credential, akkadianuser:haakkadianpassword. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later). Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/06/08/akkadian-provi
itional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/
CVE ID: CVE-2021-31580 State: PUBLISHED Published: 2021-07-22T18:27:18 Last Updated: 2024-08-03T23:03:33.574Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Akkadian Products: Provisioning Manager Engine (PME) Problem Types: CWE-78 Description: The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be bypassed by switching the OpenSSH channel from `shell` to `exec` and providing the ssh client a single execution parameter. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later). Additional Analyst Notes: - C
g Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later). Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/
CVE ID: CVE-2021-31581 State: PUBLISHED Published: 2021-07-22T18:27:19 Last Updated: 2024-08-03T23:03:33.468Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Akkadian Products: Provisioning Manager Engine (PME) Problem Types: CWE-269 Description: The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later). Additional An
dian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later). Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/
CVE ID: CVE-2021-31583 State: PUBLISHED Published: 2021-04-23T20:52:09 Last Updated: 2024-08-03T23:03:33.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in callforward/time/set/save (POST tsetname); Reflected XSS in addressbook (GET filter); Stored XSS in addressbook/save (POST firstname, lastname, company); and Reflected XSS in statistics/versions (GET lang). Additional Analyst Notes: - CVE
OST firstname, lastname, company); and Reflected XSS in statistics/versions (GET lang). Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities - https://www.sipwise.com - http://packetstormsecurity.com/files/162316/Sipwise-C5-NGCP-CSC-Cross-Site-Scripting.html - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5648.php - http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.html
CVE ID: CVE-2021-31584 State: PUBLISHED Published: 2021-04-23T20:53:55 Last Updated: 2024-08-03T23:03:33.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sipwise C5 NGCP www_csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks for actions with administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities - https://www.sipwise.com - http://packetstormsecurity.com/files/162318/Sipwise-C5-NGCP-CSC-Cross-Site-Request-Forgery.html - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5649.php - http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2
w.zeroscience.mk/en/vulnerabilities/ZSL-2021-5649.php - http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.html
CVE ID: CVE-2021-31585 State: PUBLISHED Published: 2021-06-23T11:19:28 Last Updated: 2024-08-03T23:03:33.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow local access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/accellion/CVEs - https://github.com/accellion/CVEs/blob/main/CVE-2021-31585.txt
CVE ID: CVE-2021-31586 State: PUBLISHED Published: 2021-06-23T11:20:36 Last Updated: 2024-08-03T23:03:33.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/accellion/CVEs - https://github.com/accellion/CVEs/blob/main/CVE-2021-31586.txt
CVE ID: CVE-2021-31589 State: PUBLISHED Published: 2022-01-05T11:26:49 Last Updated: 2024-08-03T23:03:33.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which allows the injection of unauthenticated, specially-crafted web requests without proper sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://www.beyondtrust.com/docs/release-notes/index.htm - http://packetstormsecurity.com/files/165408/BeyondTrust-Remote-Support-6.0-Cross-Site-Scripting.html - https://cxsecurity.com/issue/WLB-2022010013
CVE ID: CVE-2021-31590 State: PUBLISHED Published: 2021-07-19T19:45:41 Last Updated: 2024-08-03T23:03:33.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pwndoc