Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-23209 State: PUBLISHED Published: 2022-03-18T18:00:25.146Z Last Updated: 2025-04-23T18:45:39.935Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Ahmed Kaludi, Mohammed Kaludi Products: AMP for WP – Accelerated Mobile Pages (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress plugin (versions <= 1.0.77.32). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/accelerated-mobile-pages/wordpress-amp-for-wp-
Vulnrichment: References: - https://patchstack.com/database/vulnerability/accelerated-mobile-pages/wordpress-amp-for-wp-accelerated-mobile-pages-plugin-1-0-77-32-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities?_s_id=cve
CVE ID: CVE-2021-23210 State: PUBLISHED Published: 2022-08-25T19:34:49 Last Updated: 2024-08-03T19:05:53.898Z Vendors: n/a Products: SoX (Sound eXchange) Problem Types: CWE-369 Description: A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted file, could cause an application to crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1975670 - https://access.redhat.com/security/cve/CVE-2021-23210 - https://sourceforge.net/p/sox/bugs/351/ - https://security.archlinux.org/CVE-2021-23210
CVE ID: CVE-2021-23211 State: PUBLISHED Published: 2021-06-11T15:46:01 Last Updated: 2024-08-03T19:05:55.310Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Gallagher Products: Command Centre Problem Types: CWE-316 Description: Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key to be discoverable in server memory dumps. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3). Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2021-23211
CVE ID: CVE-2021-23212 State: REJECTED Published: N/A Last Updated: 2023-03-07T21:55:04.873Z Description: No description available.
CVE ID: CVE-2021-23214 State: PUBLISHED Published: 2022-03-04T00:00:00 Last Updated: 2024-08-03T19:05:55.443Z Vendors: n/a Products: postgresql Problem Types: CWE-89 Description: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2022666 - https://www.postgresql.org/support/security/CVE-2021-23214/ - https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba
- https://www.postgresql.org/support/security/CVE-2021-23214/ - https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commit%3Bh=28e24125541545483093819efae9bca603441951 - https://github.com/postgres/postgres/commit/28e24125541545483093819efae9bca603441951 - https://security.gentoo.org/glsa/202211-04
CVE ID: CVE-2021-23215 State: PUBLISHED Published: 2021-06-08T00:00:00 Last Updated: 2024-08-03T19:05:53.906Z Vendors: n/a Products: OpenEXR Problem Types: CWE-400 Description: An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXFLD4ZAXKAIWO6ZPBCQEEDZB5IG676K/ - https://bugzilla.redhat.com/show_bug.cgi?id=1947586 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - h
s://bugzilla.redhat.com/show_bug.cgi?id=1947586 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://www.debian.org/security/2022/dsa-5299 - https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE ID: CVE-2021-23217 State: PUBLISHED Published: 2021-11-20T14:55:23 Last Updated: 2024-08-03T19:05:55.701Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA GPU and Tegra hardware Problem Types: CWE 1190: DMA Device Enabled Too Early in Boot Phase Description: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to instantiate a DMA write operation only within a specific time window timed to corrupt code execution, which may impact confidentiality, integrity, or availability. The scope impact may extend to other components. Additional Analyst Notes: - CVE
dentiality, integrity, or availability. The scope impact may extend to other components. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE ID: CVE-2021-23218 State: PUBLISHED Published: 2022-01-10T15:05:45 Last Updated: 2024-08-03T19:05:55.507Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Mirantis Products: Mirantis Container Runtime Problem Types: CWE-401 Description: When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Mirantis/security/blob/main/advisories/0002.md
CVE ID: CVE-2021-23219 State: PUBLISHED Published: 2021-11-20T14:55:24 Last Updated: 2024-08-03T19:05:55.355Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: NVIDIA Products: NVIDIA GPU and Tegra hardware Problem Types: CWE 1190: DMA Device Enabled Too Early in Boot Phase Description: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to access protected information by identifying, exploiting, and loading vulnerable microcode. Such an attack may lead to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/ans
rmation disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5263
CVE ID: CVE-2021-23220 State: REJECTED Published: N/A Last Updated: 2023-03-07T22:10:44.732Z Description: No description available.
CVE ID: CVE-2021-23222 State: PUBLISHED Published: 2022-03-02T00:00:00 Last Updated: 2024-08-03T19:05:54.487Z Vendors: n/a Products: postgresql Problem Types: CWE-522 Description: A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2022675 - https://www.postgresql.org/support/security/CVE-2021-23222/ - https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=d83cdfdca9d918bbbd6bb209139b94c954da7228 - https://github.com/postgres/postgres/commit/160c0258802d10b0600d7671b1
ff%3Bh=d83cdfdca9d918bbbd6bb209139b94c954da7228 - https://github.com/postgres/postgres/commit/160c0258802d10b0600d7671b1bbea55d8e17d45 - https://security.gentoo.org/glsa/202211-04
CVE ID: CVE-2021-23223 State: PUBLISHED Published: 2022-08-18T00:00:00.000Z Last Updated: 2025-05-05T16:54:11.929Z Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products Problem Types: escalation of privilege Description: Improper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00002.html
CVE ID: CVE-2021-23224 State: REJECTED Published: N/A Last Updated: 2023-03-07T22:13:47.278Z Description: No description available.
CVE ID: CVE-2021-23225 State: PUBLISHED Published: 2022-01-19T20:38:52 Last Updated: 2024-08-03T19:05:54.697Z Vendors: n/a Products: Cacti Problem Types: CWE-79 Description: Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of a new user via "Copy" method at user_admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.cacti.net/info/changelog - https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html
CVE ID: CVE-2021-23227 State: PUBLISHED Published: 2022-01-13T20:27:28.738Z Last Updated: 2025-02-20T20:32:54.088Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Alexander Fuchs Products: PHP Everywhere (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/php-everywhere/wordpress-php-everywhere-plugin-2-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2021-23228 State: PUBLISHED Published: 2021-12-22T18:06:52.089004Z Last Updated: 2024-09-17T02:36:27.721Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03
CVE ID: CVE-2021-23230 State: PUBLISHED Published: 2021-06-11T15:46:01 Last Updated: 2024-08-03T19:05:55.287Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Gallagher Products: Command Centre Problem Types: CWE-89 Description: A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions prior to 8.30.1359 (MR3); 8.20 versions prior to 8.20.1259 (MR5); 8.10 versions prior to 8.10.1284 (MR7); version 8.00 and prior versions. Additional Analys
ons prior to 8.20.1259 (MR5); 8.10 versions prior to 8.10.1284 (MR7); version 8.00 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2021-23230
CVE ID: CVE-2021-23232 State: REJECTED Published: N/A Last Updated: 2023-03-07T22:14:22.844Z Description: No description available.
CVE ID: CVE-2021-23233 State: PUBLISHED Published: 2022-01-21T18:17:37.000Z Last Updated: 2025-04-16T16:47:50.571Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Fresenius Kabi Products: Agilia Link+ Problem Types: CWE-284 Description: Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform critical actions or modify critical configuration parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisor
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
CVE ID: CVE-2021-23236 State: PUBLISHED Published: 2022-01-21T18:17:35.000Z Last Updated: 2025-04-16T16:48:05.390Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Fresenius Kabi Products: Agilia Link+ Problem Types: CWE-400 Description: Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset triggered by pressing a button on the rack system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
CVE ID: CVE-2021-23239 State: PUBLISHED Published: 2021-01-12T00:00:00 Last Updated: 2024-08-03T19:05:55.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2021-23239 - https://www.sudo.ws/stable.html#1.9.5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE42Y35SMJOLONAIBNYNFC7J4
tps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE42Y35SMJOLONAIBNYNFC7J44UUZ2Y6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMY4VSSBIND7VAYSN6T7XIWJRWG4GBB3/ - https://security.gentoo.org/glsa/202101-33 - https://security.netapp.com/advisory/ntap-20210129-0010/ - https://lists.debian.org/debian-lts-announce/2022/11/msg00007.html
CVE ID: CVE-2021-23240 State: PUBLISHED Published: 2021-01-12T08:17:44 Last Updated: 2024-08-03T19:05:54.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2021-23240 - https://www.sudo.ws/stable.html#1.9.5 - https://lists.fedoraproject.org/archives/list/package-an
cgi?id=CVE-2021-23240 - https://www.sudo.ws/stable.html#1.9.5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE42Y35SMJOLONAIBNYNFC7J44UUZ2Y6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMY4VSSBIND7VAYSN6T7XIWJRWG4GBB3/ - https://security.gentoo.org/glsa/202101-33 - https://security.netapp.com/advisory/ntap-20210129-0010/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2021-23241 State: PUBLISHED Published: 2021-01-07T20:19:32 Last Updated: 2024-08-03T19:05:55.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.mercusys.com/en/ - https://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Web%20Server%20Directory%20Traversal.md - https://www.mercurycom.com.cn/product-521-1.html
CVE ID: CVE-2021-23242 State: PUBLISHED Published: 2021-01-07T20:19:22 Last Updated: 2024-08-03T19:05:54.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.mercusys.com/en/ - https://www.mercurycom.com.cn/product-521-1.html - https://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Upnp%20Server%20Directory%20Traversal.md
CVE ID: CVE-2021-23243 State: PUBLISHED Published: 2021-09-27T12:11:01 Last Updated: 2024-08-03T19:05:54.467Z Vendors: n/a Products: OPPO Android Phone with Qualcomm chipset Problem Types: Elevation of Privilege Description: In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used. Additional Analyst Notes: - CVE Program Container: References: - https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1437389627236556800
CVE ID: CVE-2021-23244 State: PUBLISHED Published: 2021-12-27T18:48:24 Last Updated: 2024-08-03T19:05:54.805Z Vendors: n/a Products: OPPO Android Phone Problem Types: Elevation of privilege Description: ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed, attacker can disguise app with the same package name to obtain dangerous permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976
CVE ID: CVE-2021-23246 State: PUBLISHED Published: 2022-03-11T17:54:39 Last Updated: 2024-08-03T19:05:54.436Z Vendors: n/a Products: ACE2 Problem Types: ID Description: In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1502209104851247104
CVE ID: CVE-2021-23247 State: PUBLISHED Published: 2022-04-01T22:17:26 Last Updated: 2024-08-03T19:05:55.554Z Vendors: n/a Products: OPPO Quick App Problem Types: Remote Code Execution Description: A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine Additional Analyst Notes: - CVE Program Container: References: - https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1501448054614794240
CVE ID: CVE-2021-23253 State: PUBLISHED Published: 2021-01-11T15:43:01 Last Updated: 2024-08-03T19:05:55.603Z Vendors: n/a Products: Opera Mini for Android Problem Types: Address bar spoofing Description: Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part (e.g. www.safe.opera.com…) The exact amount depends on the phone screen size but the attacker can craft a number of different domains and target different phones. Starting with version 53.1 Opera Mini displays long URLs with the to
r of different domains and target different phones. Starting with version 53.1 Opera Mini displays long URLs with the top-level domain label aligned to the right of the address field which mitigates the issue. Additional Analyst Notes: - CVE Program Container: References: - https://security.opera.com/address-bar-spoofing-in-opera-mini-opera-security-advisories/
CVE ID: CVE-2021-23258 State: PUBLISHED Published: 2021-12-02T15:40:54.175089Z Last Updated: 2024-09-16T22:02:38.381Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-913 Description: Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE). Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120101
CVE ID: CVE-2021-23259 State: PUBLISHED Published: 2021-12-02T15:40:55.510518Z Last Updated: 2024-09-16T18:33:22.067Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-913 Description: Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE). Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120102
CVE ID: CVE-2021-23260 State: PUBLISHED Published: 2021-12-02T15:40:56.227987Z Last Updated: 2024-09-16T17:08:40.615Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:L) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-79 Description: Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120103
CVE ID: CVE-2021-23261 State: PUBLISHED Published: 2021-12-02T15:40:56.958357Z Last Updated: 2024-09-17T01:57:02.067Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-703 Description: Authenticated administrators may override the system configuration file and cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120104
CVE ID: CVE-2021-23262 State: PUBLISHED Published: 2021-12-02T15:40:57.695452Z Last Updated: 2024-09-16T21:57:11.063Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-913 Description: Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120105
CVE ID: CVE-2021-23263 State: PUBLISHED Published: 2021-12-02T15:40:58.466621Z Last Updated: 2024-09-16T23:36:18.930Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-402 Description: Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120106
CVE ID: CVE-2021-23264 State: PUBLISHED Published: 2021-12-02T15:40:59.160175Z Last Updated: 2024-09-16T19:15:49.969Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-402, CWE-668 Description: Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120107
CVE ID: CVE-2021-23265 State: PUBLISHED Published: 2022-05-16T17:05:22.145199Z Last Updated: 2024-09-16T20:36:21.217Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-269 Description: A logged-in and authenticated user with a Reviewer Role may lock a content item. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051601