Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-26586 State: PUBLISHED Published: 2021-08-05T20:40:10 Last Updated: 2024-08-03T20:26:25.469Z Vendors: n/a Products: HPE Edgeline Infrastructure Management Software Problem Types: remote disclosure of sensitive information Description: A potential security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vulnerability could be remotely exploited to disclose sensitive information. HPE has made software updates available to resolve the vulnerability in the HPE Edgeline Infrastructure Manager (EIM). Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.c
ine Infrastructure Manager (EIM). Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04180en_us - https://www.tenable.com/security/research/tra-2021-33
CVE ID: CVE-2021-26587 State: PUBLISHED Published: 2021-09-27T14:01:37 Last Updated: 2024-08-03T20:26:25.479Z Vendors: n/a Products: HPE StoreOnce 3620; HPE StoreOnce 3640; HPE StoreOnce 5200; HPE StoreOnce 5250; HPE StoreOnce 5650; HPE StoreOnce VSA 4TB Problem Types: remote cross-site scripting (xss) Description: A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. The vulnerability could be remotely exploited to cause an elevation of privilege leading to partial impact to confidentiality, availability, and integrity. HPE has made the following software update - HPE StoreOnce 4.3.0, to resolve the vulnerability in HPE StoreOnce. Additional
has made the following software update - HPE StoreOnce 4.3.0, to resolve the vulnerability in HPE StoreOnce. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04176en_us
CVE ID: CVE-2021-26588 State: PUBLISHED Published: 2021-10-11T16:46:31 Last Updated: 2024-08-03T20:26:25.484Z Vendors: n/a Products: HP 3PAR StoreServ 10000 Storage; HP 3PAR StoreServ 7000 Storage; HPE 3PAR StoreServ 8000 Storage; HPE Primera 600 Storage; HPE 3PAR StoreServ 20000; HPE Alletra 9000; HPE 3PAR StoreServ 9000 Storage Problem Types: remote arbitrary code execution Description: A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the confidentiality,
t the low complexity issue to execute code as administrator. This vulnerability impacts completely the confidentiality, integrity, availability of the array. HPE has made the following software updates and mitigation information to resolve the vulnerability in 3PAR, Primera and Alletra 9000 firmware. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04191en_us
CVE ID: CVE-2021-26589 State: PUBLISHED Published: 2021-10-19T14:10:18 Last Updated: 2024-08-03T20:26:25.641Z Vendors: n/a Products: HPE Superdome Flex Server Problem Types: remote cross-site scripting (xss) Description: A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE Superdome Flex Servers. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04199e
gram Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04199en_us
CVE ID: CVE-2021-26593 State: PUBLISHED Published: 2021-02-23T18:57:26 Last Updated: 2024-08-03T20:26:25.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information about the user (such as email address, first name, and last name) but also the secret for 2FA if one exists. This secret can be regenerated. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sgranel/directusv8
CVE ID: CVE-2021-26594 State: PUBLISHED Published: 2021-02-23T18:59:27 Last Updated: 2024-08-03T20:26:25.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sgranel/directusv8
CVE ID: CVE-2021-26595 State: PUBLISHED Published: 2021-02-23T19:00:17 Last Updated: 2024-11-19T15:33:36.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sgranel/directusv8
CVE ID: CVE-2021-26596 State: PUBLISHED Published: 2021-03-25T18:56:51 Last Updated: 2024-08-03T20:26:25.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /netact/sct filename parameter is used. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/redteam - https://www.trusted-introducer.
Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/redteam - https://www.trusted-introducer.org/directory/teams/nokia-psirt.html
CVE ID: CVE-2021-26597 State: PUBLISHED Published: 2021-03-25T18:56:45 Last Updated: 2024-08-03T20:26:25.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nokia NetAct 18A. A remote user, authenticated to the NOKIA NetAct Web Page, can visit the Site Configuration Tool web site section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir parameter in conjunction with the operation=upload value. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/redteam - https://www.trusted-introducer.org/directory/teams/nokia-psirt.html
CVE ID: CVE-2021-26598 State: PUBLISHED Published: 2022-03-28T00:31:42 Last Updated: 2024-08-03T20:26:25.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token). Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1081137 - https://packetstormsecurity.com/files/166403/ImpressCMS-1.4.2-Incorrect-Access-Control.html - http://karmainsecurity.com/KIS-2022-03 - http://seclists.org/fulldisclosure/2022/Mar/45
CVE ID: CVE-2021-26599 State: PUBLISHED Published: 2022-03-28T00:41:23 Last Updated: 2024-08-03T20:26:25.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1081145 - http://packetstormsecurity.com/files/166404/ImpressCMS-1.4.2-SQL-Injection.html - http://seclists.org/fulldisclosure/2022/Mar/46 - http://karmainsecurity.com/KIS-2022-04
CVE ID: CVE-2021-26600 State: PUBLISHED Published: 2022-03-28T00:48:40 Last Updated: 2024-08-03T20:26:25.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==). Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1081986 - http://packetstormsecurity.com/files/166393/ImpressCMS-1.4.2-Authentication-Bypass.html - http://seclists.org/fulldisclosure/2022/Mar/43 - http://karmainsecurity.com/KIS-2022-01
CVE ID: CVE-2021-26601 State: PUBLISHED Published: 2022-03-28T00:51:13 Last Updated: 2024-08-03T20:26:25.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1081878 - http://packetstormsecurity.com/files/166402/ImpressCMS-1.4.2-Path-Traversal.html - http://seclists.org/fulldisclosure/2022/Mar/44 - http://karmainsecurity.com/KIS-2022-02
CVE ID: CVE-2021-26603 State: PUBLISHED Published: 2021-09-09T11:16:32 Last Updated: 2024-08-03T20:26:25.472Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: bandisoft Products: ARK Problem Types: CWE-122 Description: A heap overflow issue was found in ARK library of bandisoft Co., Ltd when the Ark_DigPathA function parsed a file path. This vulnerability is due to missing support for string length check. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36237
CVE ID: CVE-2021-26605 State: PUBLISHED Published: 2021-08-05T20:22:51 Last Updated: 2024-08-03T20:26:25.550Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: unidocs Products: ezPDFReader Problem Types: CWE-20 Description: An improper input validation vulnerability in the service of ezPDFReader allows attacker to execute arbitrary command. This issue occurred when the ezPDF launcher received and executed crafted input values through JSON-RPC communication. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36168
CVE ID: CVE-2021-26606 State: PUBLISHED Published: 2021-08-06T14:08:10.591796Z Last Updated: 2024-09-16T22:46:44.804Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dream Security Co.,Ltd Products: MagicLine4NX.exe Problem Types: CWE-20, CWE-120 Description: A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficient validation of the authorization certificate. An attacker could exploit this vulnerability by sending a crafted HTTP request an affected program. A successful exploit could allow the attacker to remotely execute arbitrary code on a target system. Additional Analy
m. A successful exploit could allow the attacker to remotely execute arbitrary code on a target system. Additional Analyst Notes: - CVE Program Container: References: - https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36174
CVE ID: CVE-2021-26607 State: PUBLISHED Published: 2021-10-26T12:06:00 Last Updated: 2024-08-03T20:26:25.575Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: TOBESOFT Products: NEXACRO17 Problem Types: CWE-20 Description: An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36289
CVE ID: CVE-2021-26608 State: PUBLISHED Published: 2021-09-09T12:54:23 Last Updated: 2024-08-03T20:26:25.562Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: handysoft Products: HShell.dll Problem Types: CWE-353 Description: An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36239
CVE ID: CVE-2021-26609 State: PUBLISHED Published: 2021-10-26T12:08:22 Last Updated: 2024-08-03T20:26:25.562Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Mangboard Products: WordPress Mangboard Problem Types: CWE-89 Description: A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type parameter makes a SQL query using unfiltered data. This vulnerability allows a remote attacker to steal user information. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36292
CVE ID: CVE-2021-26610 State: PUBLISHED Published: 2021-10-27T00:45:20 Last Updated: 2024-08-03T20:26:25.468Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: NHN COMMERCE Products: godomall5 Std, godomall5 Pro Problem Types: CWE-353 Description: The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36304
CVE ID: CVE-2021-26611 State: PUBLISHED Published: 2021-11-26T16:31:38 Last Updated: 2024-08-03T20:26:25.543Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Goqual Products: GKW-IC052 Problem Types: CWE-798 Description: HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..) Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36359
CVE ID: CVE-2021-26612 State: PUBLISHED Published: 2021-11-30T18:39:25 Last Updated: 2024-08-03T20:26:25.500Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: TOBESOFT Products: NEXACRO17 Problem Types: CWE-20 Description: An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36380
CVE ID: CVE-2021-26613 State: PUBLISHED Published: 2022-02-09T22:05:30 Last Updated: 2024-08-03T20:26:25.647Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: tobesoft co., ltd Products: Nexacro 17 Problem Types: CWE-20 Description: improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36437
CVE ID: CVE-2021-26614 State: PUBLISHED Published: 2021-11-22T14:38:24 Last Updated: 2024-08-03T20:26:25.515Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: EFM networks & multimedia Products: ipTIME C200 IP Camera Problem Types: CWE-749 Description: ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36346
CVE ID: CVE-2021-26615 State: PUBLISHED Published: 2021-11-26T16:33:59 Last Updated: 2024-08-03T20:26:25.531Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: bandisoft Products: ARK Problem Types: CWE-190 Description: ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36361
CVE ID: CVE-2021-26616 State: PUBLISHED Published: 2022-02-09T22:05:49 Last Updated: 2024-08-03T20:26:25.487Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: secuwiz co., ltd Products: SecuwaySSL U V2.0 client for MacOS Problem Types: CWE-78 Description: An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36438
CVE ID: CVE-2021-26617 State: PUBLISHED Published: 2022-02-25T18:10:57 Last Updated: 2024-08-03T20:26:25.638Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Gabia Co., Ltd Products: Firstmall Problem Types: CWE-20 Description: This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code in Firstmall via navercheckout_add function. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36469
CVE ID: CVE-2021-26618 State: PUBLISHED Published: 2022-02-18T17:50:21 Last Updated: 2024-08-03T20:26:25.509Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: TmaxSoft Co., Ltd Products: ToOffice Problem Types: CWE-20 Description: An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36456
CVE ID: CVE-2021-26619 State: PUBLISHED Published: 2022-02-18T17:50:59 Last Updated: 2024-08-03T20:26:25.562Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Bluetree Co., Ltd Products: BigFileAgent Problem Types: CWE-22 Description: An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerability to delete arbitrary files of unspecified number of users. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36457
CVE ID: CVE-2021-26620 State: PUBLISHED Published: 2022-03-25T18:02:37 Last Updated: 2024-08-03T20:26:25.555Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: EFM Networks Co., Ltd Products: ipTIME NAS product (NAS1, 2, 3, 4, 1dual, 2dual 4dual) Problem Types: CWE-287 Description: An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.kr
ed folder and changing user’s passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578
CVE ID: CVE-2021-26621 State: PUBLISHED Published: 2022-03-25T18:02:38 Last Updated: 2024-08-03T20:26:25.557Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NetU Corp. Products: MEX01 Problem Types: CWE-120 Description: An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by using the property that the target program copies parameter values to memory through the strcpy() function. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66579
CVE ID: CVE-2021-26622 State: PUBLISHED Published: 2022-03-25T18:02:39 Last Updated: 2024-08-03T20:26:25.560Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Genians Co., Ltd Products: Genian NAC Suite V4.0, Genian NAC V5.0 & Genian NAC Suite V5.0 Problem Types: CWE-20 Description: An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcer
ough this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66580
CVE ID: CVE-2021-26623 State: PUBLISHED Published: 2022-04-01T22:17:41 Last Updated: 2024-08-03T20:26:25.561Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bandisoft International Inc. Products: Bandizip Problem Types: CWE-125, CWE-787 Description: A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote attackers can induce exploit malicious code using this function. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66595
CVE ID: CVE-2021-26624 State: PUBLISHED Published: 2022-04-01T22:17:42 Last Updated: 2024-08-03T20:26:25.561Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MicroWorld Technologies Inc. Products: eScan Anti-Virus for Linux Problem Types: CWE-20 Description: An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments and insufficient execution conditions related to "runasroot" command. This vulnerability can induce remote attackers to exploit root privileges by manipulating parameter values. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/
anipulating parameter values. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66596
CVE ID: CVE-2021-26625 State: PUBLISHED Published: 2022-04-19T20:26:30 Last Updated: 2024-08-03T20:26:25.640Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: tobesoft Co.,Ltd Products: Nexacro 17 Problem Types: CWE-345 Description: Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation logic to download and execute arbitrary malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.
d execute arbitrary malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66661