Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
inux and FortiClientMac 7.0.1 and below, 6.4.6 and below may allow an unauthenticated and network adjacent attacker to perform a man-in-the-middle attack between the EMS and the FCT via the telemetry protocol. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-075
CVE ID: CVE-2021-41029 State: PUBLISHED Published: 2021-12-08T11:29:46 Last Updated: 2024-10-25T13:42:06.438Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWLM Problem Types: Execute unauthorized code or commands Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-114
CVE ID: CVE-2021-41030 State: PUBLISHED Published: 2021-12-08T17:51:12 Last Updated: 2024-10-25T13:39:00.180Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C) Vendors: Fortinet Products: Fortinet FortiClientEMS Problem Types: Escalation of privilege Description: An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated attacker to impersonate an existing user by intercepting and re-using valid SAML authentication messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-19
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-192
CVE ID: CVE-2021-41031 State: PUBLISHED Published: 2022-07-18T16:40:12 Last Updated: 2024-10-25T13:31:02.324Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiClientWindows Problem Types: Escalation of privilege Description: A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and 6.2.9 and below may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for FortiESNAC service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-190
CVE ID: CVE-2021-41032 State: PUBLISHED Published: 2022-05-04T15:25:15 Last Updated: 2024-10-22T20:57:47.370Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:H/RL:W/RC:C) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Information disclosure Description: An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/F
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-147
CVE ID: CVE-2021-41033 State: PUBLISHED Published: 2021-09-13T20:55:09 Last Updated: 2024-08-04T02:59:30.351Z Vendors: The Eclipse Foundation Products: Eclipse Equinox Problem Types: CWE-300 Description: In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation, particularly by installing plug-ins that may then run malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=575688
CVE ID: CVE-2021-41034 State: PUBLISHED Published: 2021-09-29T21:35:09 Last Updated: 2024-08-04T02:59:31.177Z Vendors: The Eclipse Foundation Products: Eclipse Che Problem Types: CWE-924 Description: The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse
untime but only when building Che. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989
CVE ID: CVE-2021-41035 State: PUBLISHED Published: 2021-10-25T15:05:11 Last Updated: 2024-08-04T02:59:30.989Z Vendors: The Eclipse Foundation Products: Eclipse OMR Problem Types: CWE-250, CWE-440 Description: In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/104 - https://github.com/eclipse-openj9/openj9/pull/13740 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=576395 - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2021-41036 State: PUBLISHED Published: 2021-11-02T23:15:09 Last Updated: 2024-08-04T02:59:31.302Z Vendors: The Eclipse Foundation Products: Eclipse Paho MQTT C Client Problem Types: CWE-787 Description: In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse/paho.mqtt.embedded-c/issues/96
CVE ID: CVE-2021-41037 State: PUBLISHED Published: 2022-07-08T03:50:37 Last Updated: 2024-08-04T02:59:30.336Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: The Eclipse Foundation Products: Eclipse Equinox p2 Problem Types: CWE-829 Description: In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then
e particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=577029 - https://github.com/eclipse-equinox/p2/issues/235
CVE ID: CVE-2021-41038 State: PUBLISHED Published: 2021-11-10T17:05:11 Last Updated: 2024-08-04T02:59:30.930Z Vendors: The Eclipse Foundation Products: @theia/plugin-ext Problem Types: CWE-940 Description: In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage(). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924 - https://github.com/eclipse-theia/theia/pull/10125
CVE ID: CVE-2021-41039 State: PUBLISHED Published: 2021-12-01T00:00:00 Last Updated: 2024-08-04T02:59:31.087Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-1050 Description: In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, leading to a loss of performance and possible denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=575314 - https://www.debian.org/security/2023/dsa-5511
CVE ID: CVE-2021-41040 State: PUBLISHED Published: 2022-02-01T11:12:55 Last Updated: 2024-08-04T02:59:31.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Eclipse Wakaama, ever since its inception until 2021-01-14, the CoAP parsing code does not properly sanitize network-received data. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=577968 - https://github.com/eclipse/wakaama/pull/640
CVE ID: CVE-2021-41041 State: PUBLISHED Published: 2022-04-27T02:10:10 Last Updated: 2024-08-04T02:59:31.309Z Vendors: The Eclipse Foundation Products: Eclipse OpenJ9 Problem Types: CWE-252, CWE-843, CWE-908 Description: In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse-openj9/openj9/pull/14935 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=579744
CVE ID: CVE-2021-41042 State: PUBLISHED Published: 2022-07-07T20:55:10 Last Updated: 2024-08-04T02:59:31.150Z Vendors: The Eclipse Foundation Products: Eclipse Lyo Problem Types: CWE-611 Description: In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/287
CVE ID: CVE-2021-41043 State: PUBLISHED Published: 2022-01-05T11:34:51 Last Updated: 2024-08-04T02:59:31.062Z Vendors: The Tcpdump Group Products: tcpslice Problem Types: CWE-416 Description: Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpslice/issues/11
CVE ID: CVE-2021-41054 State: PUBLISHED Published: 2021-09-13T20:43:53 Last Updated: 2024-08-04T02:59:31.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, OACK, and other options. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/atftp/code/ci/d255bf90834fb45be52decf9bc0b4fb46c90f205/ - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41054 - https://lists.debian.org/debian-lts-announce/2021/11/msg00014.html
CVE ID: CVE-2021-41055 State: PUBLISHED Published: 2021-10-11T02:40:43 Last Updated: 2024-08-04T02:59:31.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gajim 1.2.x and 1.3.x before 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted XMPP Last Message Correction (XEP-0308) message in multi-user chat, where the message ID equals the correction ID. Additional Analyst Notes: - CVE Program Container: References: - https://dev.gajim.org/gajim/gajim/-/issues/10638 - https://dev.gajim.org/gajim/gajim/-/tags/gajim-1.3.3
CVE ID: CVE-2021-41057 State: PUBLISHED Published: 2021-11-14T20:21:30 Last Updated: 2024-08-04T02:59:31.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.wibu.com/us/support/security-advisories.html - https://cert-portal.siemens.com/productcert/pdf/ssa-580693.pdf - https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210910-01.pdf
CVE ID: CVE-2021-41061 State: PUBLISHED Published: 2021-09-15T11:21:39 Last Updated: 2024-08-04T02:59:30.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component allows attackers to break encryption by triggering reboots. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/issues/16844
CVE ID: CVE-2021-41063 State: PUBLISHED Published: 2021-12-08T16:31:38 Last Updated: 2024-08-04T02:59:31.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.xylem.com - https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-aanderaa-psa-2021-003.pdf - https://www.xylem.com/en-us/about-xylem/cybersecurity/advisories/ - https://www.cisa.gov/uscert/ics/advisories/icsa-21-334-01
CVE ID: CVE-2021-41064 State: REJECTED Published: N/A Last Updated: 2023-02-09T00:00:00 Description: No description available.
CVE ID: CVE-2021-41065 State: PUBLISHED Published: 2021-12-14T15:31:14 Last Updated: 2024-08-04T02:59:31.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and wait for a privileged user to open a session on the Listary installed host. Listary will automatically access the named pipe and the attacker will be able to duplicate the victim's token to impersonate him. This exploit is valid in certain Windows versions (Microsoft has patched the issue in later Windows 10 builds). Additional Analyst Notes: - CVE Program Container: References: - https://www.listary.com/downl
later Windows 10 builds). Additional Analyst Notes: - CVE Program Container: References: - https://www.listary.com/download - https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e
CVE ID: CVE-2021-41066 State: PUBLISHED Published: 2021-12-14T15:31:09 Last Updated: 2024-08-04T02:59:31.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Listary through 6. When Listary is configured as admin, Listary will not ask for permissions again if a user tries to access files on the system from Listary itself (it will bypass UAC protection; there is no privilege validation of the current user that runs via Listary). Additional Analyst Notes: - CVE Program Container: References: - https://www.listary.com/download - https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e
CVE ID: CVE-2021-41067 State: PUBLISHED Published: 2021-12-14T15:31:05 Last Updated: 2024-08-04T02:59:30.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation of update packages that can cause an installation of malicious content. Additional Analyst Notes: - CVE Program Container: References: - https://www.listary.com/download - https://medium.com/%40tomerp_77017/exploiting-listary-searching
tainer: References: - https://www.listary.com/download - https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e
CVE ID: CVE-2021-41070 State: REJECTED Published: 2021-10-12T16:50:02 Last Updated: 2021-10-12T16:50:02 Description: No description available.
CVE ID: CVE-2021-41071 State: REJECTED Published: 2021-10-12T16:46:21 Last Updated: 2021-10-12T16:46:21 Description: No description available.
CVE ID: CVE-2021-41072 State: PUBLISHED Published: 2021-09-14T00:00:00 Last Updated: 2024-08-04T02:59:31.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem. Additional Analyst Notes: - CVE Progra
nsquashfs process to write through the symbolic link elsewhere in the filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd - https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405 - https://www.debian.org/security/2021/dsa-4987 - https://lists.debian.org/debian-lts-announce/2021/10/msg00017.html - https://security.gentoo.org/glsa/202305-29
CVE ID: CVE-2021-41073 State: PUBLISHED Published: 2021-09-19T16:02:30 Last Updated: 2024-08-04T02:59:31.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2021/09/18/2 - http://www.openwall.com/lists/oss-security/2021/09/18/2 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16c8d2df7ec0eed31b7d3b61cb13206
/09/18/2 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16c8d2df7ec0eed31b7d3b61cb13206a7fb930cc - https://www.debian.org/security/2021/dsa-4978 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAP4TXEZ7J4EZQMQW5SIJMWXG7WZT3F7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J7KSMIOQ4377CVTHMWNGNCWHMCRFRP2T/ - https://security.netapp.com/advisory/ntap-20211014-0003/ - http://www.openwall.com/lists/oss-security/2022/06/04/4
CVE ID: CVE-2021-41075 State: PUBLISHED Published: 2021-10-13T22:12:29 Last Updated: 2024-08-04T02:59:31.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/help/read-me-complete.html#build_125455
CVE ID: CVE-2021-41076 State: REJECTED Published: 2021-09-15T12:44:49 Last Updated: 2021-09-15T12:44:49 Description: No description available.
CVE ID: CVE-2021-41077 State: PUBLISHED Published: 2021-09-14T15:07:31 Last Updated: 2024-08-04T02:59:31.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior (if .travis.yml has been created locally by a customer, and added to git) is for a Travis service to perform builds in a way that prevents public access to customer-specific secret environment data such as signing keys, access credentials, and API tokens. However, during the stated 8-day interv
ecret environment data such as signing keys, access credentials, and API tokens. However, during the stated 8-day interval, secret data could be revealed to an unauthorized actor who forked a public repository and printed files during a build process. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/peter_szilagyi/status/1437646118700175360 - https://twitter.com/peter_szilagyi/status/1437649838477283330 - https://blog.travis-ci.com/2021-09-13-bulletin - https://news.ycombinator.com/item?id=28523350 - https://travis-ci.community/t/security-bulletin/12081 - https://news.ycombinator.com/item?id=28524727
CVE ID: CVE-2021-41078 State: PUBLISHED Published: 2021-10-26T12:08:19 Last Updated: 2024-08-04T02:59:31.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nameko/nameko - https://github.com/nameko/nameko/security/advisories/GHSA-6p52-jr3q-c94g
CVE ID: CVE-2021-41079 State: PUBLISHED Published: 2021-09-16T14:40:25 Last Updated: 2024-08-04T02:59:31.226Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-20 Description: Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E - ht
apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html - https://security.netapp.com/advisory/ntap-20211008-0005/ - https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E - https://www.debian.org/security/2021/dsa-4986
CVE ID: CVE-2021-41080 State: PUBLISHED Published: 2021-11-11T04:26:16 Last Updated: 2024-08-04T02:59:31.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Network Configuration Manager before ﻿﻿125465 is vulnerable to SQL Injection in a hardware details search. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-configuration-manager/security-updates/cve-2021-41080.html
CVE ID: CVE-2021-41081 State: PUBLISHED Published: 2021-11-11T04:27:39 Last Updated: 2024-08-04T02:59:31.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Network Configuration Manager before ﻿﻿125465 is vulnerable to SQL Injection in a configuration search. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-configuration-manager/security-updates/cve-2021-41081.html
CVE ID: CVE-2021-41082 State: PUBLISHED Published: 2021-09-20T20:20:11 Last Updated: 2024-08-04T02:59:31.354Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes