Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s; 5.2 version 5.2.0.3 and prior versions; 5.1 version 5.1.0.6 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A9700&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-27888 State: PUBLISHED Published: 2021-03-02T00:04:08 Last Updated: 2024-08-03T21:33:17.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters. Additional Analyst Notes: - CVE Program Container: References: - https://zend.to/changelog.php
CVE ID: CVE-2021-27889 State: PUBLISHED Published: 2021-03-15T16:57:02 Last Updated: 2024-08-03T21:33:17.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mybb/mybb/security/advisories/GHSA-xhj7-3349-mqcm - http://packetstormsecurity.com/files/161908/MyBB-1.8.25-Remote-Command-Execution.html - https://blog.sonarsource.com/mybb-remote-code-execution-chain
CVE ID: CVE-2021-27890 State: PUBLISHED Published: 2021-03-15T17:04:13 Last Updated: 2024-08-03T21:33:16.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mybb/mybb/security/advisories/GHSA-r34m-ccm8-mfhq - http://packetstormsecurity.com/files/161908/MyBB-1.8.25-Remote-Command-Execution.html - https://blog.sonarsource.com/mybb-remote-code-execution-chain
CVE ID: CVE-2021-27891 State: PUBLISHED Published: 2021-03-15T14:07:27 Last Updated: 2024-08-03T21:33:15.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: SSH Tectia Client and Server before 6.4.19 on Windows have weak key generation. ConnectSecure on Windows is affected. Additional Analyst Notes: - CVE Program Container: References: - https://info.ssh.com/tectia-vulnerability-cve-2021-27891
CVE ID: CVE-2021-27892 State: PUBLISHED Published: 2021-03-15T14:08:53 Last Updated: 2024-08-03T21:33:16.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation. ConnectSecure on Windows is affected. Additional Analyst Notes: - CVE Program Container: References: - https://info.ssh.com/tectia-vulnerability-cve-2021-27892
CVE ID: CVE-2021-27893 State: PUBLISHED Published: 2021-03-15T14:05:44 Last Updated: 2024-08-03T21:33:16.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation in nonstandard conditions. ConnectSecure on Windows is affected. Additional Analyst Notes: - CVE Program Container: References: - https://info.ssh.com/tectia-vulnerability-cve-2021-27893
CVE ID: CVE-2021-27899 State: PUBLISHED Published: 2021-04-06T20:48:11 Last Updated: 2024-08-03T21:33:17.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server's certificate, which enables a remote attacker to intercept and alter these communications using a man-in-the-middle attack. All versions before 7.11.1 are affected. Agents for Windows and Cloud are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0004
CVE ID: CVE-2021-27900 State: PUBLISHED Published: 2021-04-06T21:00:55 Last Updated: 2024-08-03T21:33:16.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables a view-only user to change any configuration setting and delete any registered agents. All versions before 7.11.1 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0005
CVE ID: CVE-2021-27901 State: PUBLISHED Published: 2021-03-02T05:56:20 Last Updated: 2024-08-03T21:33:17.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 11 software. They mishandle fingerprint recognition because local high beam mode (LHBM) does not function properly during bright illumination. The LG ID is LVE-SMP-210001 (March 2021). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2021-27902 State: PUBLISHED Published: 2021-06-30T11:56:40 Last Updated: 2024-08-03T21:33:16.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1 - https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ce - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#360---2021-01-26
CVE ID: CVE-2021-27903 State: PUBLISHED Published: 2021-06-30T11:56:48 Last Updated: 2024-08-03T21:33:16.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security - https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38 - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#
raftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38 - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23
CVE ID: CVE-2021-27904 State: PUBLISHED Published: 2021-03-02T06:58:00 Last Updated: 2024-08-03T21:33:16.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. In the implementation of Sharing Groups, the "all org" flag sometimes provided view access to unintended actors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/ca13fee271ad126832c88896776f3050a6c06e64
CVE ID: CVE-2021-27905 State: PUBLISHED Published: 2021-04-13T06:35:20 Last Updated: 2024-08-03T21:33:16.792Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: CWE-918 Description: The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr ver
s for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E - https://security.netapp.com/advisory/ntap-20210611-0009/ - https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E - https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E - https://lists.apache.org/thread.htm
28dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E - https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E - https://lists.apache.org/thread.html/rae9ccaecce9859f709ed1458545d90a4c07163070dc98b5e9e59057f%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r720a4a0497fc90bad5feec8aa18b777912ee15c7eeb5f882adbf523e%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/re9d64bb8e5dfefddcbf255adb4559e13a0df5b818da1b9b51329723f%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rd232d77c57a8ce172359ab098df9512d8b37373ab87c444b
tifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rd232d77c57a8ce172359ab098df9512d8b37373ab87c444be911b430%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r78a3a4f1138a1608b0c6d4a2ee7647848c1a20b0d5c652cd9b02c25a%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r6ccec7fc54d82591b23c143f1f6a6e38f6e03e75db70870e4cb14a1a%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r8f1152a43c36d878bbeb5a92f261e9efaf3af313b033d7acfccea59d%40%3Cnotifications.ofbiz.apache.org%3E
CVE ID: CVE-2021-27906 State: PUBLISHED Published: 2021-03-19T16:05:21.000Z Last Updated: 2025-02-13T16:27:57.655Z Vendors: Apache Software Foundation Products: Apache PDFBox Problem Types: CWE-789 Description: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rf35026148ccc0e1af133501c0d003d052883fcc65107b3ff5d3b61cd%40%3Cusers.pdfbox.apache.org%3E - https://lists.apache.org/thread.html/rf35026148ccc0e1af133501c0d003d052883fcc65107b3ff5d3b61cd%40%3Cusers.pdfbox.apache.org%3E - ht
ts.apache.org/thread.html/rf35026148ccc0e1af133501c0d003d052883fcc65107b3ff5d3b61cd%40%3Cusers.pdfbox.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/03/19/10 - https://lists.apache.org/thread.html/rdf78aef4793362e778e21e34328b0456e302bde4b7e74f229df0ee04%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r64982b768c8a2220b07aaf813bd099a9863de0d13eb212fd4efe208f%40%3Cusers.pdfbox.apache.org%3E - https://lists.apache.org/thread.html/r1d268642f8b52456ee8f876b888b8ed7a9e9568c7770789f3ded7f9e%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r7ee634c21816c69ce829d0c41f35afa2a53a99bdd3c7cce8644fdc0e%40%3Cnotifications.ofbiz.apache.org%3E - htt
e.org/thread.html/r7ee634c21816c69ce829d0c41f35afa2a53a99bdd3c7cce8644fdc0e%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/re1e35881482e07dc2be6058d9b44483457f36133cac67956686ad9b9%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rc69140d894c6a9c67a8097a25656cce59b46a5620c354ceba10543c3%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r9ffe179385637b0b5cbdabd0246118005b4b8232909d2d14cd68ccd3%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/raa35746227f3f8d50fff1db9899524423a718f6f35cd39bd4769fa6c%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r5c8e212
9899524423a718f6f35cd39bd4769fa6c%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r5c8e2125d18af184c80f7a986fbe47eaf0d30457cd450133adc235ac%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PT72QOFDXLJ7PLTN66EMG5EHPTE7TFZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KDA2U4KL2N3XT3PM4ZJEBBA6JJIH2G4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AVLK
ZJEBBA6JJIH2G4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AVLKAHFMPH72TTP25INPZPGX5FODK3H/ - https://lists.apache.org/thread.html/r6e067a6d83ccb6892d0ff867bd216704f21fb0b6a854dea34be04f12%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E - https://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-ale
ty-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2021-27907 State: PUBLISHED Published: 2021-03-05T11:35:15.000Z Last Updated: 2025-02-13T16:27:58.281Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-79 Description: Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “s
ate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r09293fb09f1d617f0d2180c42210e739e2211f8da9bc5c1873bea67a%40%3Cdev.superset.apache.org%3E - https://lists.apache.org/thread.html/r09293fb09f1d617f0d2180c42210e739e2211f8da9bc5c1873bea67a%40%3Cdev.superset.apache.org%3E
CVE ID: CVE-2021-27908 State: PUBLISHED Published: 2021-03-23T19:11:56.967620Z Last Updated: 2024-09-16T16:23:48.079Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: Mautic Products: Mautic Problem Types: CWE-200 Description: In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx
CVE ID: CVE-2021-27909 State: PUBLISHED Published: 2021-08-30T16:00:10.951539Z Last Updated: 2024-09-16T20:52:58.796Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Mautic Products: Mautic Problem Types: CWE-79 Description: For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mauti
ble parameter utilized. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/security/advisories/GHSA-32hw-3pvh-vcvc
CVE ID: CVE-2021-27910 State: PUBLISHED Published: 2021-08-30T15:55:08.436773Z Last Updated: 2024-09-17T01:25:50.835Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: Mautic Products: Mautic Problem Types: CWE-79 Description: Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (iden
of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with
ils page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f
CVE ID: CVE-2021-27911 State: PUBLISHED Published: 2021-08-30T15:55:12.869897Z Last Updated: 2024-09-16T22:30:01.569Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Mautic Products: Mautic Problem Types: CWE-79 Description: Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc. Additional Analyst Notes: - CVE Program Container: References: - https://github
UI, API, 3rd party syncing, forms, etc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/security/advisories/GHSA-72hm-fx78-xwhc
CVE ID: CVE-2021-27912 State: PUBLISHED Published: 2021-08-30T15:55:17.220890Z Last Updated: 2024-09-16T16:17:39.112Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Mautic Products: Mautic Problem Types: CWE-79 Description: Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/security/advisories/GHSA-rh5w-82wh-jhr8
CVE ID: CVE-2021-27913 State: PUBLISHED Published: 2021-08-30T15:55:21.646676Z Last Updated: 2024-09-16T18:08:08.248Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Mautic Products: Mautic Problem Types: CWE-327 Description: The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control This issue affects: Mautic Mautic versions prior to 3.3.4; versions prior to 4.0.0. Additional Analyst Notes: - CVE Program Container
fects: Mautic Mautic versions prior to 3.3.4; versions prior to 4.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/security/advisories/GHSA-x7g2-wrrp-r6h3
CVE ID: CVE-2021-27914 State: PUBLISHED Published: 2022-06-01T15:20:10 Last Updated: 2024-08-03T21:33:17.054Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Mautic Products: Mautic Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/security/advisories/GHSA-jrwm-pr9x-cgq3
CVE ID: CVE-2021-27915 State: PUBLISHED Published: 2024-09-17T14:02:09.969Z Last Updated: 2024-09-17T16:01:29.250Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Mautic Products: Mautic Problem Types: CWE-80 Description: Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions. This could lead to the user having elevated access to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-2rc5-2755-v422
CVE ID: CVE-2021-27916 State: PUBLISHED Published: 2024-09-17T14:20:03.550Z Last Updated: 2024-09-18T21:29:42.899Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Mautic Products: Mautic Problem Types: CWE-22 Description: Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
the implementation of the GrapesJS builder in Mautic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-9fcx-cv56-w58p
CVE ID: CVE-2021-27917 State: PUBLISHED Published: 2024-09-18T21:09:09.987Z Last Updated: 2024-09-19T15:40:48.121Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Mautic Products: Mautic Problem Types: CWE-79 Description: Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2
CVE ID: CVE-2021-27918 State: PUBLISHED Published: 2021-03-10T23:54:43 Last Updated: 2024-08-03T21:33:16.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw - https://security.gentoo.org/glsa/202208-02
CVE ID: CVE-2021-27919 State: PUBLISHED Published: 2021-03-11T00:00:13 Last Updated: 2024-08-03T21:33:17.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G/ - https://lists.fedoraproject.org/archives/list/package-announce%40l
oject.org/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HM7U5JNS5WU66Q3S26PFIU2ITB2ATTQ4/ - https://security.gentoo.org/glsa/202208-02