Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
65e27fec6799292d9fb46d0b7e60 - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=e572ff80f05c33cd0cb4860f864f5c9c044280b6 - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b1a7288dedc6caf9023f2676b4f5ed34cf0d4029
CVE ID: CVE-2021-45406 State: PUBLISHED Published: 2022-01-14T19:25:16 Last Updated: 2024-08-04T04:39:20.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password. Additional Analyst Notes: - CVE Program Container: References: - https://salonerp.sourceforge.io/ - https://sourceforge.net/projects/salonerp/files/latest/download - https://www.exploit-db.com/exploits/50659
CVE ID: CVE-2021-45408 State: PUBLISHED Published: 2022-02-04T19:43:01 Last Updated: 2024-08-04T04:39:20.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://sunil-singh.notion.site/SeedDMS-6-0-15-Open-Redirect-85be8b681b2947a2a75e7416cb56670c
CVE ID: CVE-2021-45411 State: PUBLISHED Published: 2022-01-12T16:34:41 Last Updated: 2024-08-04T04:39:20.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload vulnerability to obtain remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/12802/php-staff-id-card-creation-and-printing-system.html - https://www.exploit-db.com/exploits/49877
CVE ID: CVE-2021-45414 State: PUBLISHED Published: 2022-02-28T20:14:20 Last Updated: 2024-08-04T04:39:20.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Docker environment or Java driver. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/166073/Datarobot-Remote-Code-Execution.html
CVE ID: CVE-2021-45416 State: PUBLISHED Published: 2022-02-01T12:44:53 Last Updated: 2024-08-04T04:39:20.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script. Additional Analyst Notes: - CVE Program Container: References: - http://rosariosis.com - https://github.com/86x/CVE-2021-45416
CVE ID: CVE-2021-45417 State: PUBLISHED Published: 2022-01-20T00:00:00 Last Updated: 2024-08-04T04:39:20.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/01/20/3 - http://www.openwall.com/lists/oss-security/2022/01/20/3 - https://www.debian.org/security/2022/dsa-5051 - https://lists.debian.org/debian-lts-announce/2022/01/msg00024.html - https://www.ipi.fi/pipermail/aide/2022-January/00171
ttps://lists.debian.org/debian-lts-announce/2022/01/msg00024.html - https://www.ipi.fi/pipermail/aide/2022-January/001713.html - https://security.gentoo.org/glsa/202311-07
CVE ID: CVE-2021-45418 State: PUBLISHED Published: 2021-12-22T15:56:14 Last Updated: 2024-08-04T04:39:20.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet <=1.3.0.0.6 - Fixed: 1.3.0.0.9 and Titan 180 Premium <=1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0. Additional Analyst Notes: - CVE Program Container: References: - http://starcharge.com - https://vincss.net - https://github.com/shortmore/trsh/blob/main/starcharge/CVE-2021-45418.md
CVE ID: CVE-2021-45419 State: PUBLISHED Published: 2021-12-22T16:22:04 Last Updated: 2024-08-04T04:39:20.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Starcharge products are affected by Improper Input Validation. The affected products include: Nova 360 Cabinet <= 1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0 and Titan 180 Premium <= 1.3.0.0.6 - Fixed: 1.3.0.0.9. Additional Analyst Notes: - CVE Program Container: References: - http://starcharge.com - https://vincss.net - https://github.com/shortmore/trsh/blob/main/starcharge/CVE-2021-45419.md
CVE ID: CVE-2021-45420 State: PUBLISHED Published: 2022-02-14T13:08:52 Last Updated: 2024-08-04T04:39:21.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced Additional Analyst Notes: - CVE Program Container: References: - http://emerson.com - ht
d should be removed or replaced Additional Analyst Notes: - CVE Program Container: References: - http://emerson.com - http://dixell.com - https://www.swascan.com/emerson
CVE ID: CVE-2021-45421 State: PUBLISHED Published: 2022-02-14T13:08:45 Last Updated: 2024-08-04T04:39:20.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported since 2018 and should be removed or replaced Additional Analyst Notes: - CVE Program Container: References: - http://emerson.com - http://dixell.com - https://www.swascan.com/emerson
CVE ID: CVE-2021-45422 State: PUBLISHED Published: 2022-01-13T18:15:03.000Z Last Updated: 2025-03-19T19:50:53.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process "count" parameter via GET. No authentication is required. Additional Analyst Notes: - CVE Program Container: References: - http://reprise.com - https://seclists.org/fulldisclosure/2022/Jan/31 - https://www.getinfosec.news/13202933/reprise-license-manager-142-reflected-cross-site-scripting#/ - https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2021-45422/RLM%2014.2%20Cross%20Site%20Scripting.txt
CVE ID: CVE-2021-45423 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T20:37:30.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c.. The array offsets_to_Names is dynamically allocated on the stack using exp->NumberOfFunctions as its size. However, the loop uses exp->NumberOfNames to iterate over it and set its components value. Therefore, the loop code assumes that exp->NumberOfFunctions is greater than ordinal at each iteration. This can lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/merces/libpe/issues/35
CVE ID: CVE-2021-45425 State: PUBLISHED Published: 2021-12-28T12:21:22 Last Updated: 2024-08-04T04:39:20.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1IgGyzU_ekMZf8yWq46DwtIaVsBf3gt2U/view?usp=sharing - https://drive.google.com/file/d/1yVuCfovUpqwp6KKZW1togf5PigxXQ3dh/view?usp=sharing - http://packetstormsecurity.com/files/165439/Safari-Montage-8.5-Cross-Site-Scripting.html
CVE ID: CVE-2021-45427 State: PUBLISHED Published: 2021-12-30T11:10:01 Last Updated: 2024-08-04T04:39:20.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1RegGlCrtyQwW9DUirAbPDiIHKBWgsBea/view?usp=sharing - https://drive.google.com/file/d/1IN7p9OKRgdszMVC1TKuZQDa4ySCPmQzO/view?usp=sharing - https://drive.google.com/file/d/1iusYdheb62dom0DnvAzEiNR-
om/file/d/1IN7p9OKRgdszMVC1TKuZQDa4ySCPmQzO/view?usp=sharing - https://drive.google.com/file/d/1iusYdheb62dom0DnvAzEiNR-e4EXSf2k/view?usp=sharing
CVE ID: CVE-2021-45428 State: PUBLISHED Published: 2022-01-03T13:25:27 Last Updated: 2024-08-04T04:39:20.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing - http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html
CVE ID: CVE-2021-45429 State: PUBLISHED Published: 2022-02-04T18:09:54 Last Updated: 2024-08-04T04:39:20.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr_set_configuration in yara/libyara/libyara.c, which could cause a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VirusTotal/yara/issues/1616
CVE ID: CVE-2021-45435 State: PUBLISHED Published: 2022-01-28T14:05:13 Last Updated: 2024-08-04T04:39:20.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the username field in login.php. Additional Analyst Notes: - CVE Program Container: References: - https://kuiilsec.github.io/blog/cve-2021-45436/
CVE ID: CVE-2021-45440 State: PUBLISHED Published: 2022-01-08T15:51:06 Last Updated: 2024-08-04T04:39:20.966Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Unnecessary Privileges Local Privilege Escalation Description: A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on-prem versions only) could allow a local attacker to abuse an impersonation privilege and elevate to a higher level of privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst No
bility to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289996 - https://www.zerodayinitiative.com/advisories/ZDI-22-016/
CVE ID: CVE-2021-45441 State: PUBLISHED Published: 2022-01-08T15:51:07 Last Updated: 2024-08-04T04:39:20.691Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Origin Validation Error Local Privilege Escalation Description: A origin validation error vulnerability in Trend Micro Apex One (on-prem and SaaS) could allow a local attacker drop and manipulate a specially crafted file to issue commands over a certain pipe and elevate to a higher level of privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https:/
system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289996 - https://www.zerodayinitiative.com/advisories/ZDI-22-017/
CVE ID: CVE-2021-45442 State: PUBLISHED Published: 2022-01-08T15:51:08 Last Updated: 2024-08-04T04:39:20.981Z Vendors: Trend Micro Products: Trend Micro Worry-Free Business Security Problem Types: Link Following Denial-of-Service Description: A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow a local attacker to overwrite arbitrary files in the context of SYSTEM. This is similar to, but not the same as CVE-2021-44024. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References:
the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289996 - https://www.zerodayinitiative.com/advisories/ZDI-22-015/
CVE ID: CVE-2021-45444 State: PUBLISHED Published: 2022-02-13T05:32:21 Last Updated: 2024-08-04T04:39:20.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion. Additional Analyst Notes: - CVE Program Container: References: - https://zsh.sourceforge.io/releases.html - https://vuln.ryotak.me/advisories/63 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2P3LPMGENEHKDWFO4MWMZSZL6G7Y4CV7/ - https://www.debian.org/security/2022/dsa-5078 -
e%40lists.fedoraproject.org/message/2P3LPMGENEHKDWFO4MWMZSZL6G7Y4CV7/ - https://www.debian.org/security/2022/dsa-5078 - https://lists.debian.org/debian-lts-announce/2022/02/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWF3EXNBX5SVFDBL4ZFOD4GJBWFUKWN4/ - https://support.apple.com/kb/HT213257 - https://support.apple.com/kb/HT213256 - https://support.apple.com/kb/HT213255 - http://seclists.org/fulldisclosure/2022/May/33 - http://seclists.org/fulldisclosure/2022/May/35 - http://seclists.org/fulldisclosure/2022/May/38
CVE ID: CVE-2021-45445 State: PUBLISHED Published: 2022-01-12T17:44:37 Last Updated: 2024-08-04T04:39:20.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop. Additional Analyst Notes: - CVE Program Container: References: - https://unisys.com - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=68
CVE ID: CVE-2021-45446 State: PUBLISHED Published: 2022-11-02T14:26:02.105Z Last Updated: 2025-05-02T15:52:28.178Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-548 Description: A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located inside the directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.penta
rectory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/6744813983501
CVE ID: CVE-2021-45447 State: PUBLISHED Published: 2022-11-02T14:56:01.585Z Last Updated: 2025-05-02T20:38:51.406Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-319 Description: Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text. The transmission of sensitive data in clear text allows unauthorized actors with access to the network to sniff and obtain sensitive information that can be later used to gain unauthorized access. Additional Analyst Notes: - CVE Pr
and obtain sensitive information that can be later used to gain unauthorized access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/6744504393101
CVE ID: CVE-2021-45448 State: PUBLISHED Published: 2022-11-02T15:12:25.164Z Last Updated: 2025-05-02T15:48:03.329Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-22 Description: Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of bounds. The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does
ntended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/6744743458701
CVE ID: CVE-2021-45449 State: PUBLISHED Published: 2022-01-12T19:29:49 Last Updated: 2024-08-04T04:39:21.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files. Additional Analyst Notes: - CVE Program Container: References: - https://docs.docker.com/desktop/windows/release-notes/
CVE ID: CVE-2021-45450 State: PUBLISHED Published: 2021-12-21T00:00:00 Last Updated: 2024-08-04T04:39:21.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0 - https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZ
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5/ - https://security.gentoo.org/glsa/202301-08
CVE ID: CVE-2021-45451 State: PUBLISHED Published: 2021-12-21T00:00:00 Last Updated: 2024-08-04T04:39:20.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
YSUJTLN6BYGLO4YJGNZUY74W/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5/
CVE ID: CVE-2021-45452 State: PUBLISHED Published: 2022-01-04T23:09:40 Last Updated: 2024-08-04T04:39:21.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.0/releases/security/ - https://www.djangoproject.com/weblog/2022/jan/04/security-releases/ - https://security.netapp.com/advisory/ntap-20220121-0005/ - https://lists.fedoraproject.org/archives/list/package-announc
https://security.netapp.com/advisory/ntap-20220121-0005/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
CVE ID: CVE-2021-45454 State: PUBLISHED Published: 2022-08-17T12:46:05 Last Updated: 2024-08-04T04:39:21.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ampere Altra before SRP 1.08b and Altra Max​ before SRP 2.05 allow information disclosure of power telemetry via HWmon. Additional Analyst Notes: - CVE Program Container: References: - https://amperecomputing.com/product-security/ - https://amperecomputing.com/products/security-bulletins/platypus.html
CVE ID: CVE-2021-45456 State: PUBLISHED Published: 2022-01-06T12:35:21 Last Updated: 2024-08-04T04:39:21.067Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: Command injection Description: Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0. Additional Analyst Notes: - CVE Program Container: Referen
jection vulnerability. This issue affects Apache Kylin 4.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/70fkf9w1swt2cqdcz13rwfjvblw1fcpf - http://www.openwall.com/lists/oss-security/2022/01/06/1
CVE ID: CVE-2021-45457 State: PUBLISHED Published: 2022-01-06T12:35:22 Last Updated: 2024-08-04T04:39:21.127Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: CORS Description: In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/rzv4mq58okwj1n88lry82ol2wwm57q1m - http://www.openwall.com/lists/oss-security/2022/01/06/2