Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-25769 State: PUBLISHED Published: 2021-02-03T15:30:34 Last Updated: 2024-08-03T20:11:28.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25770 State: PUBLISHED Published: 2021-02-03T15:31:27 Last Updated: 2024-08-03T20:11:27.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25771 State: PUBLISHED Published: 2021-02-03T15:32:02 Last Updated: 2024-08-03T20:11:27.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25772 State: PUBLISHED Published: 2021-02-03T15:33:26 Last Updated: 2024-08-03T20:11:28.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25773 State: PUBLISHED Published: 2021-02-03T15:32:44 Last Updated: 2024-08-03T20:11:27.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25774 State: PUBLISHED Published: 2021-02-03T15:34:55 Last Updated: 2024-08-03T20:11:27.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25775 State: PUBLISHED Published: 2021-02-03T15:37:52 Last Updated: 2024-08-03T20:11:27.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25776 State: PUBLISHED Published: 2021-02-03T15:34:16 Last Updated: 2024-08-03T20:11:28.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25777 State: PUBLISHED Published: 2021-02-03T15:50:56 Last Updated: 2024-08-03T20:11:28.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25778 State: PUBLISHED Published: 2021-02-03T15:50:21 Last Updated: 2024-08-03T20:11:28.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
CVE ID: CVE-2021-25779 State: PUBLISHED Published: 2021-02-17T14:32:32 Last Updated: 2024-08-03T20:11:28.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Baby Care System v1.0 is vulnerable to SQL injection via the 'id' parameter on the contentsectionpage.php page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TCSWT/Baby-Care-System/blob/main/README.md
CVE ID: CVE-2021-25780 State: PUBLISHED Published: 2021-02-17T14:32:39 Last Updated: 2024-08-03T20:11:28.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to upload content to the server, including PHP files, which could result in command execution and obtaining a shell. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TCSWT/Baby-Care-System/blob/main/README.md
CVE ID: CVE-2021-25783 State: PUBLISHED Published: 2021-12-02T22:21:29 Last Updated: 2024-08-03T20:11:28.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/5
CVE ID: CVE-2021-25784 State: PUBLISHED Published: 2021-12-02T22:21:30 Last Updated: 2024-08-03T20:11:28.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/4
CVE ID: CVE-2021-25785 State: PUBLISHED Published: 2021-12-02T22:21:31 Last Updated: 2024-08-03T20:11:28.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/3
CVE ID: CVE-2021-25786 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T17:50:57.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/qpdf/qpdf/issues/492 - https://lists.debian.org/debian-lts-announce/2023/08/msg00037.html
CVE ID: CVE-2021-25790 State: PUBLISHED Published: 2021-07-23T17:44:14 Last Updated: 2024-08-03T20:11:28.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com - https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html - https://www.exploit-db.com/exploits/49352
CVE ID: CVE-2021-25791 State: PUBLISHED Published: 2021-07-23T17:44:16 Last Updated: 2024-08-03T20:11:28.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com - https://www.exploit-db.com/exploits/49396 - https://www.sourcecodester.com/php/14663/online-doctor-appointment-system-php-full-source-code.html
CVE ID: CVE-2021-25801 State: PUBLISHED Published: 2021-07-26T16:26:55 Last Updated: 2024-08-03T20:11:28.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file. Additional Analyst Notes: - CVE Program Container: References: - https://code.videolan.org/videolan/vlc-3.0/-/commit/f5f8cc3ab8825f178de3f6714bfbff8b3f293fd2
CVE ID: CVE-2021-25802 State: PUBLISHED Published: 2021-07-26T16:26:57 Last Updated: 2024-08-03T20:11:28.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in the AVI_ExtractSubtitle component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file. Additional Analyst Notes: - CVE Program Container: References: - https://code.videolan.org/videolan/vlc-3.0/-/commit/0660acc3ab64d2c3ad99cae887a438f0648faa72
CVE ID: CVE-2021-25803 State: PUBLISHED Published: 2021-07-26T16:26:58 Last Updated: 2024-08-03T20:11:28.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file. Additional Analyst Notes: - CVE Program Container: References: - https://code.videolan.org/videolan/vlc-3.0/-/commit/56cbe9c4b59edbdc5e1bb2687992f3bbf492eccb
CVE ID: CVE-2021-25804 State: PUBLISHED Published: 2021-07-26T16:26:59 Last Updated: 2024-08-03T20:11:28.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL-pointer dereference in "Open" in avi.c of VideoLAN VLC Media Player 3.0.11 can a denial of service (DOS) in the application. Additional Analyst Notes: - CVE Program Container: References: - https://code.videolan.org/videolan/vlc-3.0/-/commit/a7f577ec26d35bbd7b2a3cda89d1b41bde69de9c
CVE ID: CVE-2021-25808 State: PUBLISHED Published: 2021-07-23T19:39:43 Last Updated: 2024-08-03T20:11:28.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/issues/1298
CVE ID: CVE-2021-25809 State: PUBLISHED Published: 2021-07-23T19:39:45 Last Updated: 2024-08-03T20:11:28.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Gingsguard/ucms/blob/main/UCMS%20v.1.5.0%20Information%20leakage.md
CVE ID: CVE-2021-25810 State: PUBLISHED Published: 2021-04-29T15:44:02 Last Updated: 2024-08-03T20:11:28.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.mercusys.com/en/ - https://www.mercurycom.com.cn/product-521-1.html - https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20X18g%20v1.0.5%20Stored%20XSS.md
CVE ID: CVE-2021-25811 State: PUBLISHED Published: 2021-04-29T15:44:03 Last Updated: 2024-08-03T20:11:28.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is exploted the device will not be able to access the webserver unless the listen_http_lan parameter to uhttpd.json is manually fixed. Additional Analyst Notes: - CVE Program Container: References: - https://www.mercusys.com/en/ - https://www.mercurycom.com.cn/product-521-1.html - https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20
s://www.mercurycom.com.cn/product-521-1.html - https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20X18g%20v1.0.5%20Denial%20of%20Service.md
CVE ID: CVE-2021-25812 State: PUBLISHED Published: 2021-04-29T15:44:03 Last Updated: 2024-08-03T20:11:28.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client. Additional Analyst Notes: - CVE Program Container: References: - https://www.zhipinmall.com/prodetail?id=1266#skuId=3020 - http://iot.10086.cn/?l=en-us - https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection.md
CVE ID: CVE-2021-25827 State: PUBLISHED Published: 2023-06-28T00:00:00.000Z Last Updated: 2025-02-13T16:27:50.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://emby.media/community/index.php?/topic/98191-emby-server-46-released/ - https://github.com/MediaBrowser/Emby/issues/3784 - https://github.com/EmbySupport/security/security/advisories/GHSA-fffj-6fr6-3fgf
CVE ID: CVE-2021-25828 State: PUBLISHED Published: 2023-06-28T00:00:00 Last Updated: 2024-12-05T16:51:27.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MediaBrowser/Emby/issues/3785
CVE ID: CVE-2021-25829 State: PUBLISHED Published: 2021-03-01T15:07:19 Last Updated: 2024-08-03T20:11:28.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ONLYOFFICE/DocumentServer - https://github.com/ONLYOFFICE/core - https://github.com/ONLYOFFICE/core/blob/v5.6.4.10/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1722 - https://github.com/ONLYOFF
om/ONLYOFFICE/core/blob/v5.6.4.10/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1722 - https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Comments.h#L299 - https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Core.h#L161 - https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/NotesMaster.h#L148 - https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/NotesSlide.h#L141 - https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPT
Format/NotesSlide.h#L141 - https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Presentation.h#L277 - https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Theme.h#L277 - https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25829
CVE ID: CVE-2021-25830 State: PUBLISHED Published: 2021-03-01T15:07:38 Last Updated: 2024-08-03T20:11:28.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ONLYOFFICE/DocumentServer - https://github.com/ONLYOFFICE/core - https://github.com/ONLYOFFICE/core/blob/v5.6.4.1
ub.com/ONLYOFFICE/DocumentServer - https://github.com/ONLYOFFICE/core - https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/UniFill.cpp#L343 - https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241 - https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918 - https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25830
CVE ID: CVE-2021-25831 State: PUBLISHED Published: 2021-03-01T15:08:37 Last Updated: 2024-08-03T20:11:28.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacker can obtain remote code execution on DocumentServer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ONLYOFFICE/DocumentServer - https://github.com/ONLYOFFICE/core - https://github.com/ONLYOFFICE/core/blob/v5.6.4.1
ub.com/ONLYOFFICE/DocumentServer - https://github.com/ONLYOFFICE/core - https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L241 - https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918 - https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/PPTXFormat/Logic/Fills/BlipFill.cpp#L328 - https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25831
CVE ID: CVE-2021-25832 State: PUBLISHED Published: 2021-03-01T15:08:57 Last Updated: 2024-08-03T20:11:28.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using this vulnerability, an attacker is able to gain remote code executions on DocumentServer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ONLYOFFICE/DocumentServer - https://github.com/ONLYOFFICE/core - https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/DesktopEditor/cximage/CxImage/ximabmp.cpp#L358 - https://github.com/ONLYOFFICE/core/blob/v6.0.1
FICE/core/blob/v6.0.1.15/DesktopEditor/cximage/CxImage/ximabmp.cpp#L358 - https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/DesktopEditor/cximage/CxImage/ximabmp.cpp#L354 - https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L424 - https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L428 - https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25832
CVE ID: CVE-2021-25833 State: PUBLISHED Published: 2021-03-01T15:09:17 Last Updated: 2024-08-03T20:11:28.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain remote code execution on DocumentServer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ONLYOFFICE/DocumentServer - https://github.com/ONLYOFFICE/server - https://github.com/ONLYOFFICE/server/blob/v5.6.0.21/DocServ
FICE/DocumentServer - https://github.com/ONLYOFFICE/server - https://github.com/ONLYOFFICE/server/blob/v5.6.0.21/DocService/sources/converterservice.js#L200 - https://github.com/ONLYOFFICE/server/blob/v5.6.0.21/FileConverter/sources/converter.js#L593 - https://github.com/ONLYOFFICE/server/blob/v5.6.0.21/FileConverter/sources/converter.js#L283 - https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25833
CVE ID: CVE-2021-25834 State: PUBLISHED Published: 2021-02-08T17:53:46 Last Updated: 2024-08-03T20:11:28.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cosmos/ethermint/issues/686
CVE ID: CVE-2021-25835 State: PUBLISHED Published: 2021-02-08T17:57:19 Last Updated: 2024-08-03T20:11:28.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg content and chainIDEpoch, which enables "cross-chain transaction replay" attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cosmos/ethermint/issues/687 - https://github.com/cosmos/ethermint/pull/69
am Container: References: - https://github.com/cosmos/ethermint/issues/687 - https://github.com/cosmos/ethermint/pull/692
CVE ID: CVE-2021-25836 State: PUBLISHED Published: 2021-02-08T17:54:16 Last Updated: 2024-08-03T20:11:28.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. The bytecode set in a FAILED transaction wrongfully remains in memory(stateObject.code) and is further written to persistent store at the Endblock stage, which may be utilized to build honeypot contracts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cosmos/ethermint/issues/667#issuecomment-759284303
CVE ID: CVE-2021-25837 State: PUBLISHED Published: 2021-02-08T17:54:37 Last Updated: 2024-08-03T20:11:28.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cache data will be discarded at EndBlock, it is still valid in the current block, which enables many possible attacks such as an "arbitrary mint token". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/
such as an "arbitrary mint token". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cosmos/ethermint/issues/667#issuecomment-759284107
CVE ID: CVE-2021-25838 State: PUBLISHED Published: 2021-04-26T13:30:38 Last Updated: 2024-08-03T20:11:28.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload. Additional Analyst Notes: - CVE Program Container: References: - https://minthcm.org/ - https://github.com/C1inton/CVE-Record/blob/master/CVE%20Record/%5BCVE-2021-25838%5DMintHCM%203.0.8.md