Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-33183 State: PUBLISHED Published: 2021-06-01T09:50:10.399918Z Last Updated: 2024-09-17T03:33:59.466Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Synology Products: Synology Docker Problem Types: CWE-22 Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18.09.0-0515 allows local users to read or write arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_21_08
CVE ID: CVE-2021-33184 State: PUBLISHED Published: 2021-06-01T09:50:14.363388Z Last Updated: 2024-09-17T04:09:07.776Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Synology Products: Synology Download Station Problem Types: CWE-918 Description: Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_23
CVE ID: CVE-2021-33185 State: PUBLISHED Published: 2021-06-18T21:49:20 Last Updated: 2024-08-03T23:42:20.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SerenityOS/serenity/issues/7073
CVE ID: CVE-2021-33186 State: PUBLISHED Published: 2021-06-18T21:49:04 Last Updated: 2024-08-03T23:42:20.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SerenityOS/serenity/issues/7072
CVE ID: CVE-2021-33190 State: PUBLISHED Published: 2021-06-08T15:05:11 Last Updated: 2024-08-03T23:42:20.273Z Vendors: Apache Software Foundation Products: Apache APISIX Dashboard Problem Types: CWE-307 Description: In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limit. At the same time, the default account and password are fixed.Ultimately these factors lead to the issue of security risks. This issue is fixed in APISIX Dashboard 2.6.1 Additional Anal
imately these factors lead to the issue of security risks. This issue is fixed in APISIX Dashboard 2.6.1 Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/re736aea55e8fd2478f0739c0c38a9375c4204fc1f0bd1ea687f57049%40%3Cdev.apisix.apache.org%3E - https://lists.apache.org/thread.html/re736aea55e8fd2478f0739c0c38a9375c4204fc1f0bd1ea687f57049%40%3Cdev.apisix.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/06/08/4
CVE ID: CVE-2021-33191 State: PUBLISHED Published: 2021-08-24T11:20:09 Last Updated: 2024-08-03T23:42:20.264Z Vendors: Apache Software Foundation Products: Apache NiFi - MiNiFi C++ Problem Types: CWE-78 Description: From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command is then executed using the same privileges as the application binary. This was addressed in version 0.10.0 Additional Analyst Notes: - CVE Program Container: References: - https://www.ope
y. This was addressed in version 0.10.0 Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/08/24/1 - http://www.openwall.com/lists/oss-security/2021/08/24/1 - https://lists.apache.org/thread.html/r6f27a2454f5f67dbe4e21c8eb1db537b01863a0bc3758f28aa60f032%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-33192 State: PUBLISHED Published: 2021-07-05T09:15:11 Last Updated: 2024-08-03T23:42:20.271Z Vendors: Apache Software Foundation Products: Apache Jena Fuseki Problem Types: CWE-79 Description: A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 (inclusive). Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r684d8943d755a96fe90f8cd8df196737b6bde3f2b74e15a9bd479975%40%3Cusers.jena.apache.org%3E
CVE ID: CVE-2021-33193 State: PUBLISHED Published: 2021-08-16T00:00:00 Last Updated: 2024-08-03T23:42:20.253Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: Request Splitting Description: A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48. Additional Analyst Notes: - CVE Program Container: References: - https://portswigger.net/research/http2 - https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch - https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff
d8d0e2984fe41420d9e944f456b3c.patch - https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/ - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ - https://www.oracle.com/security-al
security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210917-0004/ - https://www.tenable.com/security/tns-2021-17 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.gentoo.org/glsa/202208-20 - https://lists.debian.org/debian-lts-announce/2023/03/msg00002.html
CVE ID: CVE-2021-33194 State: PUBLISHED Published: 2021-05-26T14:49:46 Last Updated: 2024-08-03T23:42:20.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce/c/wPunbCPkWUg - https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/
CVE ID: CVE-2021-33195 State: PUBLISHED Published: 2021-08-02T18:51:34 Last Updated: 2024-08-03T23:42:20.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce - https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI - https://security.netapp.com/advisory/ntap-20210902-0005/ - https://security.gentoo.org/glsa/202208-02
CVE ID: CVE-2021-33196 State: PUBLISHED Published: 2021-08-02T00:00:00 Last Updated: 2024-08-03T23:42:20.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce - https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI - https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html - https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html - https://security.gentoo.org/glsa/202208-02 - https://lists.debian.org/d
.org/debian-lts-announce/2022/01/msg00017.html - https://security.gentoo.org/glsa/202208-02 - https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
CVE ID: CVE-2021-33197 State: PUBLISHED Published: 2021-08-02T18:54:45 Last Updated: 2024-08-03T23:42:20.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce - https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI - https://security.gentoo.org/glsa/202208-02
CVE ID: CVE-2021-33198 State: PUBLISHED Published: 2021-08-02T18:55:53 Last Updated: 2024-08-03T23:42:20.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce - https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI - https://security.gentoo.org/glsa/202208-02
CVE ID: CVE-2021-33199 State: PUBLISHED Published: 2021-08-12T20:46:06 Last Updated: 2024-08-03T23:42:20.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file names of icon.png and icon.svg. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ExpressionEngine/ExpressionEngine/releases/tag/6.0.3 - https://github.com/ExpressionEngine/ExpressionEngine/compare/6.0.1...6.0.3#diff-17bcb23e5666fc2dccb79c7133e9eeb701847f67ae84fbde0a673c3fd3d109e0R508
CVE ID: CVE-2021-33200 State: PUBLISHED Published: 2021-05-27T00:00:00 Last Updated: 2024-08-03T23:42:20.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/05/
t. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/05/27/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJCABL43FT3FKRX5DBPZG25FNKR6CEK4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LR3OKKPHIBGOMHN476CMLW2T7UG53QX/ - https://security.netapp.com/advisory/ntap-20210706-0004/ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3d0220f6861d713213b015b582e9f21e5b28d2e0 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bb01a1bba579b4b1c5566af24d95f1767859771e - https://git.
t.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bb01a1bba579b4b1c5566af24d95f1767859771e - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a7036191277f9fa68d92f2071ddc38c09b1e5ee5
CVE ID: CVE-2021-33203 State: PUBLISHED Published: 2021-06-08T17:52:20 Last Updated: 2024-08-03T23:42:20.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. A
ntents would have been exposed. In other words, there is directory traversal outside of the template root directories. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/3.2/releases/security/ - https://www.djangoproject.com/weblog/2021/jun/02/security-releases/ - https://security.netapp.com/advisory/ntap-20210727-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
CVE ID: CVE-2021-33204 State: PUBLISHED Published: 2021-05-19T16:23:30 Last Updated: 2024-08-03T23:42:20.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit search_path is not set. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pgpartman/pg_partman/commit/0b6565ad378c358f8a6cd1d48ddc482eb7f854d3 - https://github.com/pgpartman/pg_partman/compare/v4.5.0...v4.5.1 - https://security.netapp.com/advisory/ntap-20210625-0006/
CVE ID: CVE-2021-33205 State: PUBLISHED Published: 2021-06-11T11:31:08 Last Updated: 2024-08-03T23:42:20.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories with higher privileges, because of how Node.js is used. An attacker can gain admin privileges and carry out malicious activities such as creating a fake library and stealing user credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/productsecurity/wdc-21007-edgerover-windows-app-ver-0-25
CVE ID: CVE-2021-33207 State: PUBLISHED Published: 2022-04-05T02:01:54 Last Updated: 2024-08-03T23:42:20.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code. Additional Analyst Notes: - CVE Program Container: References: - https://www.softwareag.com/corporate/products/az/mashzone_nextgen/default - https://github.com/blackarrowsec/advisories/tree/master/2021/CVE-2021-33207
CVE ID: CVE-2021-33208 State: PUBLISHED Published: 2022-03-30T21:52:08 Last Updated: 2024-08-03T23:42:20.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.softwareag.com/corporate/products/az/mashzone_nextgen/default - https://github.com/blackarrowsec/advisories/tree/master/2021/CVE-2021-33208
CVE ID: CVE-2021-33209 State: PUBLISHED Published: 2021-11-03T10:02:07 Last Updated: 2024-08-03T23:42:20.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login attempt discloses whether the username or password is wrong, helping an attacker to enumerate usernames. This can make a brute-force attack easier. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/FIMERspa - https://fimeronline.sharepoint.com/:b:/s/GLB-publicsp/EeKCnV76jG5Pn9Ud30fTlesBlk-SZS3uFU80Gt8IEWiE4Q?e=Tdmabs
CVE ID: CVE-2021-33210 State: PUBLISHED Published: 2021-11-03T09:56:43 Last Updated: 2024-08-03T23:42:20.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can (in the WebUI) obtain plant information without authentication by reading the response of APIs from a kiosk view of a plant. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/FIMERspa - https://fimeronline.sharepoint.com/:b:/s/GLB-publicsp/EZGyNsndR-hNgtWtDsxoRAoBchaLX4o7RWdTiX1qgD19WQ?e=I9uW0p
CVE ID: CVE-2021-33211 State: PUBLISHED Published: 2021-07-14T13:48:26 Last Updated: 2024-08-03T23:42:20.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/pentest-blog/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-021.txt
CVE ID: CVE-2021-33212 State: PUBLISHED Published: 2021-07-14T13:44:08 Last Updated: 2024-08-03T23:42:20.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in the "View in Browser" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SVG image. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/pentest-blog/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-020.txt
CVE ID: CVE-2021-33213 State: PUBLISHED Published: 2021-07-14T13:40:09 Last Updated: 2024-08-03T23:42:20.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/pentest-blog/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-027.txt
CVE ID: CVE-2021-33214 State: PUBLISHED Published: 2021-07-09T18:03:44 Last Updated: 2024-08-03T23:42:20.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation. Additional Analyst Notes: - CVE Program Container: References: - https://labs.bishopfox.com/advisories - https://www.ewon.biz/about-us/security - https://www.ewon.biz/technical-support/pages/talk2m/talk2m-tools/talk2m-ecatcher - https://cdn.hms-networks.com/docs/librariesprovider6/cybersecu
nical-support/pages/talk2m/talk2m-tools/talk2m-ecatcher - https://cdn.hms-networks.com/docs/librariesprovider6/cybersecurity/hms-security-advisory-2021-07-09-001---ewon-ecatcher.pdf?sfvrsn=b37418d7_4 - https://labs.bishopfox.com/advisories/ecatcher-desktop-version-6.6.4
CVE ID: CVE-2021-33215 State: PUBLISHED Published: 2021-07-07T14:04:16 Last Updated: 2024-08-03T23:42:20.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://korelogic.com/advisories.html - http://seclists.org/fulldisclosure/2021/May/76
CVE ID: CVE-2021-33216 State: PUBLISHED Published: 2021-07-07T14:06:04 Last Updated: 2024-08-03T23:42:20.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account. Additional Analyst Notes: - CVE Program Container: References: - https://korelogic.com/advisories.html - http://seclists.org/fulldisclosure/2021/May/78
CVE ID: CVE-2021-33217 State: PUBLISHED Published: 2021-07-07T14:07:25 Last Updated: 2024-08-03T23:42:20.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root. Additional Analyst Notes: - CVE Program Container: References: - https://korelogic.com/advisories.html - http://seclists.org/fulldisclosure/2021/May/77
CVE ID: CVE-2021-33218 State: PUBLISHED Published: 2021-07-07T14:11:54 Last Updated: 2024-08-03T23:42:20.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access. Additional Analyst Notes: - CVE Program Container: References: - https://korelogic.com/advisories.html - https://seclists.org/fulldisclosure/2021/May/74
CVE ID: CVE-2021-33219 State: PUBLISHED Published: 2021-07-07T14:23:06 Last Updated: 2024-08-03T23:42:20.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and nplus1user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://korelogic.com/advisories.html - https://seclists.org/fulldisclosure/2021/May/75
CVE ID: CVE-2021-33220 State: PUBLISHED Published: 2021-07-07T14:24:11 Last Updated: 2024-08-03T23:42:20.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist. Additional Analyst Notes: - CVE Program Container: References: - https://korelogic.com/advisories.html - http://seclists.org/fulldisclosure/2021/May/73
CVE ID: CVE-2021-33221 State: PUBLISHED Published: 2021-07-07T14:24:58 Last Updated: 2024-08-03T23:42:20.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://korelogic.com/advisories.html - http://seclists.org/fulldisclosure/2021/May/72
CVE ID: CVE-2021-33223 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-07T16:21:59.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.notion.so/SeedDMS-6-0-15-Incorrect-Access-Control-ff504354656b47b2b0cee0b7a82ad08c - https://sunil-singh.notion.site/SeedDMS-6-0-15-Insecure-Direct-Object-Reference-IDOR-ff504354656b47b2b0cee0b7a82ad08c
CVE ID: CVE-2021-33224 State: PUBLISHED Published: 2023-02-24T00:00:00.000Z Last Updated: 2025-03-12T13:55:53.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://umbraco.com - https://our.umbraco.com/packages/developer-tools/umbraco-forms