Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43545 State: PUBLISHED Published: 2021-12-08T21:19:27 Last Updated: 2024-08-04T04:03:06.902Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Denial of Service when using the Location API in a loop Description: Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-53/ - https://www.mozilla.org/security/advisories/mfsa2021-54/ - https://www.mozilla.org/security/advisories/mfsa2021-52/ - https://bugzilla.mozilla.
/security/advisories/mfsa2021-54/ - https://www.mozilla.org/security/advisories/mfsa2021-52/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1720926 - https://www.debian.org/security/2021/dsa-5026 - https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html - https://www.debian.org/security/2022/dsa-5034 - https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html - https://security.gentoo.org/glsa/202202-03 - https://security.gentoo.org/glsa/202208-14
CVE ID: CVE-2021-43546 State: PUBLISHED Published: 2021-12-08T21:19:22 Last Updated: 2024-08-04T04:03:08.444Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Cursor spoofing could overlay user interface when native cursor is zoomed Description: It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-53/ - https://www.mozilla.org/security/advisories/mfsa2021-54/ - https://www.mozilla.org/security/advisories/mfsa202
021-53/ - https://www.mozilla.org/security/advisories/mfsa2021-54/ - https://www.mozilla.org/security/advisories/mfsa2021-52/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1737751 - https://www.debian.org/security/2021/dsa-5026 - https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html - https://www.debian.org/security/2022/dsa-5034 - https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html - https://security.gentoo.org/glsa/202202-03 - https://security.gentoo.org/glsa/202208-14
CVE ID: CVE-2021-43547 State: PUBLISHED Published: 2022-05-05T15:19:13.000Z Last Updated: 2025-04-16T16:23:26.254Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: TwinOaks Computing Products: CoreDX DDS Problem Types: CWE-406 Description: TwinOaks Computing CoreDX DDS versions prior to 5.9.1 are susceptible to exploitation when an attacker sends a specially crafted packet to flood target devices with unwanted traffic. This may result in a denial-of-service condition and information exposure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02 - http://www.twinoaksco
- CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02 - http://www.twinoakscomputing.com/coredx/download
CVE ID: CVE-2021-43548 State: PUBLISHED Published: 2021-12-27T18:48:22.881596Z Last Updated: 2024-09-16T16:38:33.233Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Philips Products: Patient Information Center iX (PIC iX) Problem Types: CWE-20 Description: Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-02
CVE ID: CVE-2021-43549 State: PUBLISHED Published: 2021-11-18T14:18:48.609013Z Last Updated: 2024-09-16T23:00:26.909Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: OSIsoft Products: PI Web API Problem Types: CWE-79 Description: A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a malicious website. As a result, a victim may disclose sensitive information to the attacker or be provided with false information. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-313-06
CVE ID: CVE-2021-43550 State: PUBLISHED Published: 2021-12-27T18:48:23.613762Z Last Updated: 2024-09-16T19:00:27.450Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Philips Products: Efficia CM Series, Patient Information Center iX (PIC iX) Problem Types: CWE-327 Description: The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communications between Patient Information Center iX (PIC iX) Versions C.02 and C.03 and Efficia CM Series Revisions A.01 to C.0x and 4.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/
A.01 to C.0x and 4.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-02
CVE ID: CVE-2021-43551 State: PUBLISHED Published: 2021-11-17T18:19:44.773827Z Last Updated: 2024-09-16T23:16:08.135Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: OSIsoft Products: PI Vision Problem Types: CWE-79 Description: A remote attacker with write access to PI Vision could inject code into a display. Unauthorized information disclosure, modification, or deletion is possible if a victim views or interacts with the infected display using Microsoft Internet Explorer. The impact affects PI System data and other data accessible with victim's user permissions. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/a
ctim's user permissions. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-313-05
CVE ID: CVE-2021-43552 State: PUBLISHED Published: 2021-12-27T18:48:22.163893Z Last Updated: 2024-09-17T00:16:34.580Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Philips Products: Patient Information Center iX (PIC iX) Problem Types: CWE-321 Description: The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02, C.02, and C.03. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-02
CVE ID: CVE-2021-43553 State: PUBLISHED Published: 2021-11-17T18:20:51.041571Z Last Updated: 2024-09-16T19:46:25.035Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: OSIsoft Products: PI Vision Problem Types: CWE-863 Description: PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a Limits property. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-313-05
CVE ID: CVE-2021-43554 State: PUBLISHED Published: 2021-12-28T18:17:44.936698Z Last Updated: 2024-09-16T17:38:43.627Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: WinProladder Problem Types: CWE-787 Description: FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-320-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-030/ - https://www.zerodayinitiative.com/advisories/ZDI-22-033/ - https://w
/www.zerodayinitiative.com/advisories/ZDI-22-030/ - https://www.zerodayinitiative.com/advisories/ZDI-22-033/ - https://www.zerodayinitiative.com/advisories/ZDI-22-028/
CVE ID: CVE-2021-43555 State: PUBLISHED Published: 2021-11-19T18:16:13.024233Z Last Updated: 2024-09-17T02:41:16.473Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: mySCADA Products: myDESIGNER Problem Types: CWE-23 Description: mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulnerable to a path traversal payload. This vulnerability may allow an attacker to plant files on the file system in arbitrary locations or overwrite existing files, resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advi
emote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-313-04
CVE ID: CVE-2021-43556 State: PUBLISHED Published: 2021-12-28T18:17:39.233815Z Last Updated: 2024-09-16T20:01:55.103Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: WinProladder Problem Types: CWE-121 Description: FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-320-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-029/ - https://www.zerodayinitiative.com/advisories/ZDI-22-032/ - ht
https://www.zerodayinitiative.com/advisories/ZDI-22-029/ - https://www.zerodayinitiative.com/advisories/ZDI-22-032/ - https://www.zerodayinitiative.com/advisories/ZDI-22-031/
CVE ID: CVE-2021-43557 State: PUBLISHED Published: 2021-11-22T08:25:09 Last Updated: 2024-08-04T04:03:07.927Z Vendors: Apache Software Foundation Products: Apache APISIX Problem Types: Use Nginx's $request_uri variable without verification Description: The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom p
rnal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h - http://www.openwall.com/lists/oss-security/2021/11/22/1 - http://www.openwall.com/lists/oss-security/2021/11/22/2 - http://www.openwall.com/lists/oss-security/2021/11/23/1
CVE ID: CVE-2021-43558 State: PUBLISHED Published: 2021-11-22T15:59:46 Last Updated: 2024-08-04T04:03:07.933Z Vendors: n/a Products: moodle Problem Types: CWE-79 Description: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2021515 - https://moodle.org/mod/forum/discuss.php?d=429097
CVE ID: CVE-2021-43559 State: PUBLISHED Published: 2021-11-22T16:00:05 Last Updated: 2024-08-04T04:03:08.286Z Vendors: n/a Products: moodle Problem Types: CWE-352 Description: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2021517 - https://moodle.org/mod/forum/discuss.php?d=429099
CVE ID: CVE-2021-43560 State: PUBLISHED Published: 2021-11-22T16:00:22 Last Updated: 2024-08-04T04:03:08.485Z Vendors: n/a Products: moodle Problem Types: CWE-863 Description: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2021519 - https://moodle.org/mod/forum/discuss.php?d=429100
CVE ID: CVE-2021-43561 State: PUBLISHED Published: 2021-11-10T14:59:32 Last Updated: 2024-08-04T04:03:07.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2021-015
CVE ID: CVE-2021-43562 State: PUBLISHED Published: 2021-11-10T15:01:18 Last Updated: 2024-08-04T04:03:08.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL, resulting in SSRF. As a result, an attacker can download various content from a remote location and save it to a user-controlled filename, which may result in Remote Code Execution. A TYPO3 backend user account is required to exploit this. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory
ed to exploit this. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2021-017
CVE ID: CVE-2021-43563 State: PUBLISHED Published: 2021-11-10T15:02:41 Last Updated: 2024-08-04T04:03:08.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to download various media files from the DAM system. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2021-017
CVE ID: CVE-2021-43564 State: PUBLISHED Published: 2021-11-10T15:04:20 Last Updated: 2024-08-04T04:03:08.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf). Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2021-018
CVE ID: CVE-2021-43565 State: PUBLISHED Published: 2022-09-06T17:03:42 Last Updated: 2024-08-04T04:03:07.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/golang-announce - https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs
CVE ID: CVE-2021-43566 State: PUBLISHED Published: 2022-01-11T15:15:01 Last Updated: 2024-08-04T04:03:08.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.samba.org/show_bug.cgi?id=13979 - https://security.netapp.com/advisory/ntap-20220110-0001/ - https://www.samba.org/samba/securi
rg/show_bug.cgi?id=13979 - https://security.netapp.com/advisory/ntap-20220110-0001/ - https://www.samba.org/samba/security/CVE-2021-43566.html
CVE ID: CVE-2021-43568 State: PUBLISHED Published: 2021-11-09T21:06:02 Last Updated: 2024-08-04T04:03:08.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/ - https://github.com/starkbank/ecdsa-elixir/releases/tag/v1.0.1
CVE ID: CVE-2021-43569 State: PUBLISHED Published: 2021-11-09T21:05:06 Last Updated: 2024-08-04T04:03:07.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/ - https://github.com/starkbank/ecdsa-dotnet/releases/tag/v1.3.2
CVE ID: CVE-2021-43570 State: PUBLISHED Published: 2021-11-09T21:05:46 Last Updated: 2024-08-04T04:03:07.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/ - https://github.com/starkbank/ecdsa-java/releases/tag/v1.0.1
CVE ID: CVE-2021-43571 State: PUBLISHED Published: 2021-11-09T21:05:34 Last Updated: 2024-08-04T04:03:08.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/ - https://github.com/starkbank/ecdsa-node/releases/tag/v1.1.3
CVE ID: CVE-2021-43572 State: PUBLISHED Published: 2021-11-09T21:05:20 Last Updated: 2024-08-04T04:03:08.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/ - https://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1 - https://github.com/starkbank/ecdsa-python/commit/d1361706
ttps://github.com/starkbank/ecdsa-python/releases/tag/v2.0.1 - https://github.com/starkbank/ecdsa-python/commit/d136170666e9510eb63c2572551805807bd4c17f
CVE ID: CVE-2021-43573 State: PUBLISHED Published: 2021-11-11T03:58:13 Last Updated: 2024-08-04T04:03:08.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10. It exists in the client code when processing a malformed IE length of HT capability information in the Beacon and Association response frame. Additional Analyst Notes: - CVE Program Container: References: - https://www.amebaiot.com/en/security_bulletin/cve-2021-43573/
CVE ID: CVE-2021-43574 State: PUBLISHED Published: 2021-11-15T14:18:31 Last Updated: 2024-08-04T04:03:08.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://help.atmail.com/hc/en-us/sections/115003283988 - https://medium.com/%40bhattronit96/cve-2021-43574-696041dcab9e
CVE ID: CVE-2021-43575 State: PUBLISHED Published: 2021-11-09T22:45:21 Last Updated: 2024-08-04T04:03:08.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a similar issue to CVE-2021-36799. NOTE: The vendor disputes this because it is not the responsibility of the ETS to securely store cryptographic key material when it is not being exported Additional Analyst Notes: - CVE Program Container: References: - https://github.com/robertguetzkow/ets5-password-recovery
CVE ID: CVE-2021-43576 State: PUBLISHED Published: 2021-11-12T10:35:20 Last Updated: 2024-08-04T04:03:08.612Z Vendors: Jenkins project Products: Jenkins pom2config Plugin Description: Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2415 - http://www.openwall.com/lists/oss-security
ences: - https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2415 - http://www.openwall.com/lists/oss-security/2021/11/12/1 - https://www.zerodayinitiative.com/advisories/ZDI-21-1314/
CVE ID: CVE-2021-43577 State: PUBLISHED Published: 2021-11-12T10:35:21 Last Updated: 2024-08-04T04:03:08.419Z Vendors: Jenkins project Products: Jenkins OWASP Dependency-Check Plugin Description: Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2488 - http://www.openwall.com/lists/oss-security/2021/11/12/1
CVE ID: CVE-2021-43578 State: PUBLISHED Published: 2021-11-12T10:35:23 Last Updated: 2024-08-04T04:03:08.542Z Vendors: Jenkins project Products: Jenkins Squash TM Publisher (Squash4Jenkins) Plugin Description: Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2525 - http://www.openwall.com/lists/oss-
r: References: - https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2525 - http://www.openwall.com/lists/oss-security/2021/11/12/1