Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-44718 State: PUBLISHED Published: 2022-09-02T11:11:14 Last Updated: 2024-08-04T04:32:12.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle (MITM) position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers. Additional Analyst Notes: - CVE Program Container: References: - https://www.wolfssl.com/docs/security-vulnerabilities/ - https://github.com/wolfSSL/wolfssl/releases
CVE ID: CVE-2021-44719 State: PUBLISHED Published: 2022-05-25T15:31:52 Last Updated: 2024-08-04T04:32:12.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Desktop 4.3.0 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://docs.docker.com/desktop/mac/release-notes/ - https://docs.docker.com/desktop/windows/release-notes/ - https://docs.docker.com/desktop/release-notes/#security-2
CVE ID: CVE-2021-44720 State: PUBLISHED Published: 2022-08-11T15:49:27 Last Updated: 2024-08-04T04:32:12.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/?atype=sa - https://gist.github.com/JGarciaSec/2060ec1c8efc1d573a1ddb754c6b4f84
CVE ID: CVE-2021-44725 State: PUBLISHED Published: 2021-12-08T00:00:00 Last Updated: 2024-08-04T04:32:12.214Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: KNIME Server before 4.13.4 allows directory traversal in a request for a client profile. Additional Analyst Notes: - CVE Program Container: References: - https://docs.knime.com/2021-06/server_update_guide/index.html#_bugfixes - https://zigrin.com/advisories/knime-server-directory-path-traversal-in-the-profiles-section/
CVE ID: CVE-2021-44726 State: PUBLISHED Published: 2021-12-08T00:00:00 Last Updated: 2024-08-04T04:32:12.303Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. Additional Analyst Notes: - CVE Program Container: References: - https://docs.knime.com/2021-06/server_update_guide/index.html#_bugfixes - https://zigrin.com/advisories/knime-server-dom-based-xss-in-a-login-panel/
CVE ID: CVE-2021-44730 State: PUBLISHED Published: 2022-02-17T22:15:18 Last Updated: 2024-08-04T04:32:12.268Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Canonical Ltd. Products: snapd Problem Types: CWE-59 Description: snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap-confine to execute other arbitrary binaries and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1 Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5292-1 - http://www.openwall
alyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5292-1 - http://www.openwall.com/lists/oss-security/2022/02/18/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTBN7LLZISXIA4KU4UKDR27Q5PXDS2U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGHG6LJAVJJ72TMART6A7N4Z6MSTGI7/ - https://www.debian.org/security/2022/dsa-5080 - http://www.openwall.com/lists/oss-security/2022/02/23/1
CVE ID: CVE-2021-44731 State: PUBLISHED Published: 2022-02-17T00:00:00 Last Updated: 2024-08-04T04:32:12.887Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Canonical Ltd. Products: snapd Problem Types: CWE-362 Description: A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1 Additional Analyst Notes: - CVE
vilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1 Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5292-1 - http://www.openwall.com/lists/oss-security/2022/02/18/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTBN7LLZISXIA4KU4UKDR27Q5PXDS2U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGHG6LJAVJJ72TMART6A7N4Z6MSTGI7/ - https://www.debian.org/security/2022/dsa-5080 - http://www.openwall.com/lists/oss-security/2022/02/23/1 - http://www.openwall.com/lists/oss-security/2022/02/23/2 - http://ww
//www.openwall.com/lists/oss-security/2022/02/23/1 - http://www.openwall.com/lists/oss-security/2022/02/23/2 - http://www.openwall.com/lists/oss-security/2022/11/30/2 - http://seclists.org/fulldisclosure/2022/Dec/4 - http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html
CVE ID: CVE-2021-44732 State: PUBLISHED Published: 2021-12-20T00:00:00.000Z Last Updated: 2025-11-03T19:26:32.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12 - https://bugs.gentoo.org/829660 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.12 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0 - https://github.com/ARMmbed/mbedtls/releas
eases/tag/v2.16.12 - https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0 - https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0 - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2021-44733 State: PUBLISHED Published: 2021-12-22T00:00:00 Last Updated: 2024-08-04T04:32:12.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/tee/tee_shm.c - https://lore.kernel.org/lkml/20211215092501.1861229-1-jens.wiklander%40linaro.org/ - https://github.com/pjlantz/optee-qemu/blob/main/README.md - https:
211215092501.1861229-1-jens.wiklander%40linaro.org/ - https://github.com/pjlantz/optee-qemu/blob/main/README.md - https://security.netapp.com/advisory/ntap-20220114-0003/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dfd0743f1d9ea76931510ed150334d571fbab49d
CVE ID: CVE-2021-44734 State: PUBLISHED Published: 2022-01-20T16:11:21 Last Updated: 2024-08-04T04:32:12.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device. Additional Analyst Notes: - CVE Program Container: References: - https://support.lexmark.com/alerts/ - https://www.zerodayinitiative.com/advisories/ZDI-22-332/
CVE ID: CVE-2021-44735 State: PUBLISHED Published: 2022-01-20T16:07:16 Last Updated: 2024-08-04T04:32:12.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07. Additional Analyst Notes: - CVE Program Container: References: - https://support.lexmark.com/alerts/ - https://www.zerodayinitiative.com/advisories/ZDI-22-330/ - https://www.zerodayinitiative.com/advisories/ZDI-22-326/ - https://www.zerodayinitiative.com/advisories/ZDI-22-329/
CVE ID: CVE-2021-44736 State: PUBLISHED Published: 2022-01-20T16:09:15 Last Updated: 2024-08-04T04:32:12.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature. Additional Analyst Notes: - CVE Program Container: References: - https://support.lexmark.com/alerts/ - https://www.zerodayinitiative.com/advisories/ZDI-22-331/
CVE ID: CVE-2021-44737 State: PUBLISHED Published: 2022-01-20T16:04:39 Last Updated: 2024-08-04T04:32:12.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal configuration files. Additional Analyst Notes: - CVE Program Container: References: - https://support.lexmark.com/alerts/ - https://www.zerodayinitiative.com/advisories/ZDI-22-333/
CVE ID: CVE-2021-44738 State: PUBLISHED Published: 2022-01-20T15:59:46 Last Updated: 2024-08-04T04:32:12.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter. Additional Analyst Notes: - CVE Program Container: References: - https://support.lexmark.com/alerts/ - https://www.zerodayinitiative.com/advisories/ZDI-22-327/ - https://www.zerodayinitiative.com/advisories/ZDI-22-328/ - https://www.zerodayinitiative.com/advisories/ZDI-22-382/
CVE ID: CVE-2021-44739 State: PUBLISHED Published: 2022-01-14T19:05:27.580964Z Last Updated: 2024-09-16T20:02:34.318Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-200 Description: Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit an attacker controlled w
er interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit an attacker controlled web page. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE ID: CVE-2021-44740 State: PUBLISHED Published: 2022-01-14T19:05:07.378348Z Last Updated: 2024-09-16T17:03:35.259Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-476 Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a mali
the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE ID: CVE-2021-44741 State: PUBLISHED Published: 2022-01-14T19:05:13.480639Z Last Updated: 2024-09-16T17:59:06.884Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-476 Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a mali
CVE ID: CVE-2021-44742 State: PUBLISHED Published: 2022-01-14T19:05:31.971317Z Last Updated: 2024-09-16T22:09:43.690Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-125 Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim
o execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE ID: CVE-2021-44743 State: PUBLISHED Published: 2022-01-14T19:04:52.677Z Last Updated: 2025-04-23T19:11:53.106Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Bridge Problem Types: CWE-787 Description: Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/bridge/a
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/bridge/apsb22-03.html
CVE ID: CVE-2021-44746 State: PUBLISHED Published: 2022-02-01T14:28:49 Last Updated: 2024-08-04T04:32:13.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: UNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0 and prior, UNIVERGE DT 930 V2.4.0.0 and prior, IP Phone Manager V8.9.1 and prior, Data Maintenance Tool for DT900 Series V5.3.0.0 and prior, Data Maintenance Tool for DT800 Series V4.2.0.0 and prior allows a remote attacker who can access to the internal network, the configuration information may be obtained. Additional Analyst Notes: - CVE Program Container: References: - https://www.necplatforms.co.jp/en/product/security_adv/211217.html
CVE ID: CVE-2021-44747 State: PUBLISHED Published: 2022-03-01T11:55:26 Last Updated: 2024-08-04T04:32:13.027Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: F-Secure Products: F-Secure endpoint protection products on Mac, F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, F-Secure Internet Gatekeeper & F-Secure Security Cloud Problem Types: Denial of Service Vulnerability Description: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the Fmlib component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful
ecure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/support-and-downloads/security-advisories
CVE ID: CVE-2021-44748 State: PUBLISHED Published: 2022-03-06T19:05:38 Last Updated: 2024-08-04T04:32:12.308Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: F-Secure Products: F-Secure SAFE Browser for Android Version 18.5 Problem Types: Universal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser for Android Description: A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an attacker to execute the JavaScript can be used to trigger universal cross-site scripting through the browser. User interaction is required prior to exploitation, such as ente
ger universal cross-site scripting through the browser. User interaction is required prior to exploitation, such as entering a malicious website to trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-44748
CVE ID: CVE-2021-44749 State: PUBLISHED Published: 2022-03-06T19:05:46 Last Updated: 2024-08-04T04:32:12.908Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: F-Secure Products: F-Secure SAFE Browser for Android Version 18.5 Problem Types: Universal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser Protection for Android Description: A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to cause universal cross-site scripting through browsing protection in a SAFE web browser. User interaction is required prior to exploitation. A successful exploitation may lead to arbitrary code execution. A
r. User interaction is required prior to exploitation. A successful exploitation may lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-44749
CVE ID: CVE-2021-44750 State: PUBLISHED Published: 2022-03-09T11:38:29 Last Updated: 2024-08-04T04:32:13.070Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: F-Secure Products: F-Secure Elements Agent, F-Secure MDR, F-Secure Client Security, F-Secure Server Security, F-Secure Email and Server Security, F-Secure Freedome VPN, F-Secure SAFE, F-Secure KEY, and F-Secure Internet Security / Anti-Virus Problem Types: Arbitrary Code Execution Description: An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by administrator can execute any commands. Additional Analys
user can craft a special configuration file, which when run by administrator can execute any commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/support-and-downloads/security-advisories - https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-44750
CVE ID: CVE-2021-44751 State: PUBLISHED Published: 2022-03-25T10:32:11 Last Updated: 2024-08-04T04:32:13.125Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: F-Secure Products: F-Secure SAFE Browser for Android Version 18.5 & below Problem Types: F-Secure SAFE Browser vulnerable to USSD attacks Description: A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger dialer application from F-Secure browser which can be exploited by an attacker to send unwanted USSD messages or perform unwanted calls. In most modern Android OS, dialer application will require user in
end unwanted USSD messages or perform unwanted calls. In most modern Android OS, dialer application will require user interaction, however, some older Android OS may not need user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
CVE ID: CVE-2021-44757 State: PUBLISHED Published: 2022-01-18T09:21:07 Last Updated: 2024-08-04T04:32:13.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/en/community/topic/a-critical-security-patch-released-in-desktop-central-and-desktop-central-msp-for-cve-2021-44757-17-1-2022
CVE ID: CVE-2021-44758 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T15:57:20.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/heimdal/heimdal/security/advisories/GHSA-69h9-669w-88xv - https://github.com/heimdal/heimdal/commit/f9ec7002cdd526ae84fbacbf153162e118f22580 - https://security.gentoo.org/glsa/202310-06
CVE ID: CVE-2021-44759 State: PUBLISHED Published: 2022-03-23T14:05:20 Last Updated: 2024-08-04T04:32:12.307Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-287 Description: Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue affects Apache Traffic Server 8.0.0 to 8.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6 - https://www.debian.org/security/2022/dsa-5153
CVE ID: CVE-2021-44760 State: PUBLISHED Published: 2022-03-18T18:00:23.573Z Last Updated: 2025-04-23T18:45:55.812Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Lester 'GaMerZ' Chan Products: WP-DownloadManager (WordPress plugin) Problem Types: CWE-79 Description: Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability discovered in WP-DownloadManager plugin <= 1.68.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-downloadmanager/wordpress-wp-downloadmanager-plugin-1-68-6-authenticated-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2021-44768 State: PUBLISHED Published: 2022-03-25T18:02:31.628Z Last Updated: 2025-04-16T16:37:58.270Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) Vendors: Delta Electronics Products: CNCSoft Problem Types: CWE-125 Description: Delta Electronics CNCSoft (Version 1.01.30) and prior) is vulnerable to an out-of-bounds read while processing a specific project file, which may allow an attacker to disclose information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-350-02
CVE ID: CVE-2021-44769 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-05-07T15:49:39.098Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Lanner Inc Products: IAC-AST2500A Problem Types: CWE-20 Description: An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cause a Denial-of-Service (DoS) condition which can only be reverted via a factory reset. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-