Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-45458 State: PUBLISHED Published: 2022-01-06T12:35:24 Last Updated: 2024-08-04T04:39:21.117Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: CWE-798 Description: Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1
assword may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy - http://www.openwall.com/lists/oss-security/2022/01/06/7 - http://www.openwall.com/lists/oss-security/2022/01/06/3
CVE ID: CVE-2021-45459 State: PUBLISHED Published: 2021-12-22T05:26:49 Last Updated: 2024-08-04T04:39:21.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/coreybutler/node-windows/compare/1.0.0-beta.5...1.0.0-beta.6 - https://github.com/dwisiswant0/advisory/issues/4 - https://security.netapp.com/advisory/ntap-20220107-0004/
CVE ID: CVE-2021-45460 State: PUBLISHED Published: 2022-01-11T11:27:18 Last Updated: 2024-08-04T04:39:21.093Z Vendors: Siemens Products: SICAM PQ Analyzer Problem Types: CWE-428 Description: A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As there are spaces in this path, attackers with write privilege to those directories might be able to plant executables that will run in place of the legitimate process. Attackers might achieve persistence on the system ("backdoors") or cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pd
service. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-173318.pdf
CVE ID: CVE-2021-45461 State: PUBLISHED Published: 2021-12-22T18:25:54 Last Updated: 2024-08-04T04:39:21.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19. Additional Analyst Notes: - CVE Program Container: References: - https://community.freepbx.org/t/0-day-freepbx-exploit/80092 - https://community.freepbx.org/t/security-issue-potential-rest-phone-apps-rce/80109 - https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Re
ity-issue-potential-rest-phone-apps-rce/80109 - https://wiki.freepbx.org/display/FOP/2021-12-21+SECURITY%3A+Potential+Rest+Phone+Apps+RCE
CVE ID: CVE-2021-45462 State: PUBLISHED Published: 2021-12-23T00:00:00 Last Updated: 2024-08-04T04:39:21.056Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/open5gs/open5gs/commit/a0f2535cb5a29bba6dbbccdb90c74ccd770cc700 - https://www.trendmicro.com/en_us/research/23/i/attacks-on-5g-infrastructure-from-users-devices.html
CVE ID: CVE-2021-45463 State: PUBLISHED Published: 2021-12-23T06:00:57.000Z Last Updated: 2025-11-03T17:30:48.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gegl/-/blob/master/docs/NEWS
tional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gegl/-/blob/master/docs/NEWS.adoc - https://gitlab.gnome.org/GNOME/gegl/-/commit/bfce470f0f2f37968862129d5038b35429f2909b - https://gitlab.gnome.org/GNOME/gimp/-/commit/e8a31ba4f2ce7e6bc34882dc27c97fba993f5868 - https://www.gimp.org/news/2021/12/21/gimp-2-10-30-released/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG635WJCNXHJM5U4BGMAAP4NK2YFTQXK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP5NDNOTMPI335FXE7VUPW7FXYTT7PYN/ - https://gitlab.gnome.org/GNOME/gegl/-/issues/298
CVE ID: CVE-2021-45464 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T16:05:11.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: kvmtool through 39181fc allows an out-of-bounds write, related to virtio/balloon.c and virtio/pci.c. This allows a guest OS user to execute arbitrary code on the host machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cdn.discordapp.com/attachments/921419715170164776/921882173517230100/exploit.c - https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git/log/ - https://www.kalmarunionen.dk/writeups/2021/hxp-2021/lkvm/ - https://git.kernel.org/pub/scm/linux/ke
l/kvmtool.git/log/ - https://www.kalmarunionen.dk/writeups/2021/hxp-2021/lkvm/ - https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git/commit/?id=39181fc6429f4e9e71473284940e35857b42772a
CVE ID: CVE-2021-45465 State: PUBLISHED Published: 2024-01-04T11:20:18.660Z Last Updated: 2025-06-03T14:42:42.914Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Siemens Products: syngo fastView Problem Types: CWE-123 Description: A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing BMP files. This could result in a write-what-where condition and an attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15696) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
current process. (ZDI-CAN-15696) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-688797
CVE ID: CVE-2021-45466 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T15:45:40.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://control-webpanel.com/changelog - https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/
CVE ID: CVE-2021-45467 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-12T00:06:13.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://contro
ipts parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://control-webpanel.com/changelog - https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/
CVE ID: CVE-2021-45468 State: PUBLISHED Published: 2022-01-14T17:58:09 Last Updated: 2024-08-04T04:39:21.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: Imperva Web Application Firewall (WAF) before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WAF security controls and send malicious HTTP POST requests to web servers behind the WAF. Additional Analyst Notes: - CVE Program Container: References: - https://bishopfox.com/blog/imperva-eliminates-critical-exposure
CVE ID: CVE-2021-45469 State: PUBLISHED Published: 2021-12-23T18:45:57 Last Updated: 2024-08-04T04:39:21.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.kernel.org/show_bug.cgi?id=215235 - https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git/commit/?h=dev&id=5598b24efaf4892741c798b425d543e4bed357a1 - http://www.openwall.com/lists/oss-security/2021/12/25/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists
ww.openwall.com/lists/oss-security/2021/12/25/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG7XV2WXKMSMKIQKIBG5LW3Y3GXEWG5Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AK2C4A43BZSWATZWFUHHHUQF3HPIALNP/ - https://security.netapp.com/advisory/ntap-20220114-0003/ - https://www.debian.org/security/2022/dsa-5050 - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096
CVE ID: CVE-2021-45470 State: PUBLISHED Published: 2021-12-23T20:32:50 Last Updated: 2024-08-04T04:39:21.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cve-search/cve-search/pull/629 - https://github.com/cve-search/cve-search/commit/c621f9f0693a728b93ff3b964f948a1d25917207 - https://github.com/cve-search/cve-search/compare/v4.0...v4.1.0
CVE ID: CVE-2021-45471 State: PUBLISHED Published: 2021-12-24T01:04:20 Last Updated: 2024-08-04T04:39:21.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T296578 - https://gerrit.wikimedia.org/r/q/Iac86cf63bd014ef99e83dccfce9b8942e15d2bf9 - https://gerrit.wikimedia.org/r/q/Id9af124427bcd1e85301d2140a38bf47bbc5622c - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5ZT6XES3IS/
CVE ID: CVE-2021-45472 State: PUBLISHED Published: 2021-12-24T01:04:04 Last Updated: 2024-08-04T04:39:21.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T297570 - https://gerrit.wikimedia.org/r/q/I37ece1dfdc80d38055067c9c4fa73ba591acd8bd - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5Z
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5ZT6XES3IS/
CVE ID: CVE-2021-45473 State: PUBLISHED Published: 2021-12-24T01:03:46 Last Updated: 2024-08-04T04:39:21.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar). Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T294693 - https://gerrit.wikimedia.org/r/q/I3cd080a1a7dacd7396d37ee0c98cff0b4e241f8d - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5ZT6XES3IS/
CVE ID: CVE-2021-45474 State: PUBLISHED Published: 2021-12-24T01:03:28 Last Updated: 2024-08-04T04:39:21.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T296605 - https://gerrit.wikimedia.org/r/q/Id1c8910aeac5b452fbabeddab70360765518223e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5ZT6XES3IS/
CVE ID: CVE-2021-45475 State: PUBLISHED Published: 2022-10-27T08:40:10.199575Z Last Updated: 2024-09-17T02:57:02.613Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Yordam Informatics Systems Products: Yordam Library Information Document Automation Program Problem Types: CWE-200 Description: Yordam Library Information Document Automation product before version 19.02 has an unauthenticated Information disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-22-0669
CVE ID: CVE-2021-45476 State: PUBLISHED Published: 2022-10-27T08:55:09.794Z Last Updated: 2025-05-09T19:16:36.027Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Yordam Informatics Systems Products: Yordam Library Information Document Automation Program Problem Types: CWE-79 Description: Yordam Library Information Document Automation product before version 19.02 has an unauthenticated reflected XSS vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-22-0669
CVE ID: CVE-2021-45477 State: PUBLISHED Published: 2023-03-02T08:24:10.566Z Last Updated: 2025-03-05T21:14:14.292Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Yordam Information Technologies Products: Library Automation System Problem Types: CWE-233 Description: Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.This issue affects Library Automation System: before 19.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0119
CVE ID: CVE-2021-45478 State: PUBLISHED Published: 2023-03-02T08:26:02.908Z Last Updated: 2025-03-05T21:13:43.872Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Yordam Information Technologies Products: Library Automation System Problem Types: CWE-233 Description: Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.This issue affects Library Automation System: before 19.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0119
CVE ID: CVE-2021-45479 State: PUBLISHED Published: 2023-03-02T08:30:11.618Z Last Updated: 2024-08-04T04:39:21.151Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Yordam Information Technologies Products: Library Automation System Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation vulnerability in Yordam Information Technologies Library Automation System allows Stored XSS.This issue affects Library Automation System: before 19.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0119
CVE ID: CVE-2021-45480 State: PUBLISHED Published: 2021-12-24T22:55:27 Last Updated: 2024-08-04T04:39:21.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function in net/rds/connection.c in a certain combination of circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/5f9562ebe710c307adc5f666bf1a2162ee7977c0 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.11 - https://www.debian.org/security/2022/dsa-5050 - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.de
.debian.org/security/2022/dsa-5050 - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096
CVE ID: CVE-2021-45481 State: PUBLISHED Published: 2021-12-25T00:04:23 Last Updated: 2024-08-04T04:39:21.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application crash, a different vulnerability than CVE-2021-30889. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3 - http://www.openwall.com/lists/oss-security/2022/01/21/2
CVE ID: CVE-2021-45482 State: PUBLISHED Published: 2021-12-25T00:04:08 Last Updated: 2024-08-04T04:39:21.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability than CVE-2021-30889. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3 - http://www.openwall.com/lists/oss-security/2022/01/21/2
CVE ID: CVE-2021-45483 State: PUBLISHED Published: 2021-12-25T00:03:55 Last Updated: 2024-08-04T04:39:21.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability than CVE-2021-30889. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3 - http://www.openwall.com/lists/oss-security/2022/01/21/2
CVE ID: CVE-2021-45484 State: PUBLISHED Published: 2021-12-25T01:05:21 Last Updated: 2024-08-04T04:39:21.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG. Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/pdf/2112.09604.pdf - http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2021-001.txt.asc
CVE ID: CVE-2021-45485 State: PUBLISHED Published: 2021-12-25T01:05:07 Last Updated: 2024-08-04T04:39:21.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3 - https://arxiv.org/pdf/2112.09604.pdf - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=62f20e068
//arxiv.org/pdf/2112.09604.pdf - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=62f20e068ccc50d6ab66fdb72ba90da2b9418c99 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220121-0001/
CVE ID: CVE-2021-45486 State: PUBLISHED Published: 2021-12-25T01:04:27 Last Updated: 2024-08-04T04:39:21.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4 - https://arxiv.org/pdf/2112.09604.pdf - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/ipv4/route.c?id=aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-45487 State: PUBLISHED Published: 2021-12-25T01:04:12 Last Updated: 2024-08-04T04:39:21.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures. Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/pdf/2112.09604.pdf - http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2021-001.txt.asc
CVE ID: CVE-2021-45488 State: PUBLISHED Published: 2021-12-25T01:03:58 Last Updated: 2024-08-04T04:39:21.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm. Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/pdf/2112.09604.pdf - http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2021-001.txt.asc
CVE ID: CVE-2021-45489 State: PUBLISHED Published: 2021-12-25T01:03:41 Last Updated: 2024-08-04T04:39:21.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG. Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/pdf/2112.09604.pdf - http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2021-001.txt.asc
CVE ID: CVE-2021-45490 State: PUBLISHED Published: 2022-03-28T01:10:43 Last Updated: 2024-08-04T04:39:21.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.3cx.com/community/forums/posts-articles-news/ - https://packetstormsecurity.com/files/166376/3CX-Client-Missing-TLS-Validation.html
CVE ID: CVE-2021-45491 State: PUBLISHED Published: 2022-03-28T01:14:24 Last Updated: 2024-08-04T04:39:21.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: 3CX System through 2022-03-17 stores cleartext passwords in a database. Additional Analyst Notes: - CVE Program Container: References: - https://www.3cx.com/community/forums/posts-articles-news/ - http://packetstormsecurity.com/files/166386/3CX-Phone-System-Cleartext-Passwords.html
CVE ID: CVE-2021-45492 State: PUBLISHED Published: 2022-07-14T15:03:32 Last Updated: 2024-08-04T04:39:21.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions and therefore inherits weak permissions from the C:\ folder. Because entries in the system-wide PATH variable are included in the search order for DLLs, an attacker could perform DLL search-order hijacking to escalate their privileg