Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-4068 State: PUBLISHED Published: 2021-12-23T00:45:56 Last Updated: 2024-08-03T17:16:03.719Z Vendors: Google Products: Chrome Problem Types: Insufficient validation of untrusted input Description: Insufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html - https://crbug.com/1265197 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/ - https://www.d
t.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/ - https://www.debian.org/security/2022/dsa-5046 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2021-4069 State: PUBLISHED Published: 2021-12-06T00:00:00 Last Updated: 2024-08-03T17:16:03.614Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: vim is vulnerable to Use After Free Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0efd6d23-2259-4081-9ff1-3ade26907d74 - https://github.com/vim/vim/commit/e031fe90cf2e375ce861ff5e5e281e4ad229ebb9 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYB2LLNUFJUKJJ5HYCZ6MV3Z6YX3U5BN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor
message/WYB2LLNUFJUKJJ5HYCZ6MV3Z6YX3U5BN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2021-4070 State: PUBLISHED Published: 2022-02-23T19:50:10 Last Updated: 2024-08-03T17:16:03.674Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: v2fly Products: v2fly/v2ray-core Problem Types: CWE-193 Description: Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8da19456-4d89-41ef-9781-a41efd6a1877 - https://github.com/v2fly/v2ray-core/commit/c1af2bfd7aa59a4482aa7f6ec4b9208c1d350b5c
CVE ID: CVE-2021-4072 State: PUBLISHED Published: 2021-12-24T13:25:09 Last Updated: 2024-08-03T17:16:03.730Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: elgg Products: elgg/elgg Problem Types: CWE-79 Description: elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/74034253-732a-4251-a0f9-eca5f576c955 - https://github.com/elgg/elgg/commit/c30b17bf75256ed3fcc84e2083147cc3951423d0
CVE ID: CVE-2021-4073 State: PUBLISHED Published: 2021-12-14T15:50:15.519Z Last Updated: 2025-02-14T17:48:49.176Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RegistrationMagic Products: RegistrationMagic Problem Types: CWE-287 Description: The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
sions equal to, and less than, 5.0.1.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4073 - https://plugins.trac.wordpress.org/changeset/2635173/custom-registration-form-builder-with-submission-manager/trunk/services/class_rm_user_services.php - https://www.wordfence.com/blog/2021/12/authentication-bypass-vulnerability-patched-in-user-registration-plugin/
CVE ID: CVE-2021-4074 State: PUBLISHED Published: 2022-01-18T16:52:27.000Z Last Updated: 2025-02-14T17:47:58.874Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: WHMCS Bridge Products: WHMCS Bridge Problem Types: CWE-79, CWE-862 Description: The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the cc_whmcs_bridge_add_admin function, low-level authenticated users such as subscribers can exploit this vulnerability. Additi
hmcs_bridge_add_admin function, low-level authenticated users such as subscribers can exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4074 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2653041%40whmcs-bridge&new=2653041%40whmcs-bridge&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4075 State: PUBLISHED Published: 2021-12-06T20:20:10 Last Updated: 2024-08-03T17:16:03.841Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-918 Description: snipe-it is vulnerable to Server-Side Request Forgery (SSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4386fd8b-8c80-42bb-87b8-b506c46597de - https://github.com/snipe/snipe-it/commit/4612b9e711b3ff5d2bcddbec5b18866d25f8e34e
CVE ID: CVE-2021-4076 State: PUBLISHED Published: 2022-03-02T22:23:33 Last Updated: 2024-08-03T17:16:03.537Z Vendors: n/a Products: tang Problem Types: CWE-200 Description: A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2029814 - https://github.com/latchset/tang/pull/81 - https://github.com/latchset/tang/commit/e82459fda10f0630c3414ed2afbc6320bb9ea7c9
CVE ID: CVE-2021-4078 State: PUBLISHED Published: 2021-12-23T00:45:57 Last Updated: 2024-08-03T17:16:04.155Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html - https://crbug.com/1268738 - https://www.debian.org/security/2022/dsa-5046 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2021-4079 State: PUBLISHED Published: 2021-12-23T00:45:58 Last Updated: 2024-08-03T17:16:03.778Z Vendors: Google Products: Chrome Problem Types: Out of bounds write Description: Out of bounds write in WebRTC in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via crafted WebRTC packets. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html - https://crbug.com/1265806 - https://www.debian.org/security/2022/dsa-5046 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2021-4080 State: PUBLISHED Published: 2022-01-12T14:05:10 Last Updated: 2024-08-03T17:16:03.708Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: crater-invoice Products: crater-invoice/crater Problem Types: CWE-434 Description: crater is vulnerable to Unrestricted Upload of File with Dangerous Type Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d7453360-baca-4e56-985f-481275fa38db - https://github.com/crater-invoice/crater/commit/cdc913d16cf624aee852bc9163a7c6ffc8d1da9d
CVE ID: CVE-2021-4081 State: PUBLISHED Published: 2021-12-10T10:20:15 Last Updated: 2024-08-03T17:16:04.248Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/da173e66-76ba-4f98-b8fb-429aabf222d3 - https://github.com/pimcore/pimcore/commit/34ed0e050ff679b4b38414aef48ea1ff956f907a
CVE ID: CVE-2021-4082 State: PUBLISHED Published: 2021-12-10T10:20:10 Last Updated: 2024-08-03T17:16:03.508Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-352 Description: pimcore is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/81838575-e170-41fb-b451-92c1c8aab092 - https://github.com/pimcore/pimcore/commit/3088cec7dc3cbc5a8b26f1269e398e799ee7ee28
CVE ID: CVE-2021-4083 State: PUBLISHED Published: 2022-01-18T16:51:46 Last Updated: 2024-08-03T17:16:03.848Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2029923 - https://git.kernel.org/pub/scm/li
Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2029923 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9 - https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220217-0005/
CVE ID: CVE-2021-4084 State: PUBLISHED Published: 2021-12-10T11:15:11 Last Updated: 2024-08-03T17:16:03.346Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/dcb37f19-ba53-4498-b953-d21999279266 - https://github.com/pimcore/pimcore/commit/3c2a14e676a57e5d77a16255965988eef48f9065
CVE ID: CVE-2021-4088 State: PUBLISHED Published: 2022-01-24T16:00:14 Last Updated: 2024-08-03T17:16:03.698Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Data Loss Prevention (DLP) ePO Extension Problem Types: CWE-89 Description: SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafe
ePO server with privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10376
CVE ID: CVE-2021-4089 State: PUBLISHED Published: 2021-12-10T19:15:11 Last Updated: 2024-08-03T17:16:03.902Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-284 Description: snipe-it is vulnerable to Improper Access Control Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/19453ef1-4d77-4cff-b7e8-1bc8f3af0862 - https://github.com/snipe/snipe-it/commit/1699c09758e56f740437674a8d6ba36443399f24
CVE ID: CVE-2021-4090 State: PUBLISHED Published: 2022-02-18T00:00:00 Last Updated: 2024-08-03T17:16:03.753Z Vendors: n/a Products: kernel Problem Types: CWE-787 Description: An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2025101 - https://lore.kernel.org/linux-nfs/163692036074.16710.5678362976688977
ps://bugzilla.redhat.com/show_bug.cgi?id=2025101 - https://lore.kernel.org/linux-nfs/163692036074.16710.5678362976688977923.stgit%40klimt.1015granger.net/ - https://security.netapp.com/advisory/ntap-20220318-0010/
CVE ID: CVE-2021-4091 State: PUBLISHED Published: 2022-02-18T00:00:00.000Z Last Updated: 2025-11-03T20:33:52.611Z Vendors: n/a Products: 389-ds-base Problem Types: CWE-415 Description: A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2030307 - https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
CVE ID: CVE-2021-4092 State: PUBLISHED Published: 2021-12-11T13:35:12 Last Updated: 2024-08-03T17:16:04.241Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-352 Description: yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7b58c160-bb62-45fe-ad1f-38354378b89e - https://github.com/yetiforcecompany/yetiforcecrm/commit/585da04bb72d36a894f6ea5939ab909e53fd8c23
CVE ID: CVE-2021-4093 State: PUBLISHED Published: 2022-02-18T17:50:37 Last Updated: 2024-08-03T17:16:03.525Z Vendors: n/a Products: kernel Problem Types: CWE-125 Description: A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id
e scenario. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2028584 - https://bugs.chromium.org/p/project-zero/issues/detail?id=2222
CVE ID: CVE-2021-4095 State: PUBLISHED Published: 2022-03-08T14:05:00 Last Updated: 2024-08-03T17:16:03.545Z Vendors: n/a Products: kernel Problem Types: CWE-476 Description: A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVM_XEN_HVM_SET_ATTR ioctl. This flaw affects Linux kernel versions prior to 5.17-rc1. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2022/01/17/1 - https://bugzilla.redhat.com/show_bug.cgi?id=20311
eferences: - http://www.openwall.com/lists/oss-security/2022/01/17/1 - https://bugzilla.redhat.com/show_bug.cgi?id=2031194 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIOQN7JJNN6ABIDGRSTVZA65MHRLMH2Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT6573CGKVK3DU2632VVO5BVM4IU7SBV/
CVE ID: CVE-2021-4096 State: PUBLISHED Published: 2022-04-19T20:26:38.000Z Last Updated: 2025-02-07T20:48:36.980Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: fancy-product-designer Products: Fancy Product Designer Problem Types: CWE-352, CWE-434 Description: The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnera
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096 - https://support.fancyproductdesigner.com/support/discussions/topics/13000031615
CVE ID: CVE-2021-4097 State: PUBLISHED Published: 2021-12-11T23:30:10 Last Updated: 2024-08-03T17:16:04.220Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: phpservermon Products: phpservermon/phpservermon Problem Types: CWE-93 Description: phpservermon is vulnerable to Improper Neutralization of CRLF Sequences Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d617ced7-be06-4e34-9db0-63d45c003a43 - https://github.com/phpservermon/phpservermon/commit/162bba0046fcda1580f4fbc7b9ababe3c7c13ce4
CVE ID: CVE-2021-4098 State: PUBLISHED Published: 2022-02-11T22:55:16 Last Updated: 2024-08-03T17:16:03.707Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Mojo in Google Chrome prior to 96.0.4664.110 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1263457 - https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html
CVE ID: CVE-2021-4099 State: PUBLISHED Published: 2022-02-11T22:55:17 Last Updated: 2024-08-03T17:16:03.737Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html - https://crbug.com/1270658
CVE ID: CVE-2021-4100 State: PUBLISHED Published: 2022-02-11T22:55:19 Last Updated: 2024-08-03T17:16:03.759Z Vendors: Google Products: Chrome Problem Types: Object lifecycle issue Description: Object lifecycle issue in ANGLE in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html - https://crbug.com/1272068
CVE ID: CVE-2021-4101 State: PUBLISHED Published: 2022-02-11T22:55:20 Last Updated: 2024-08-03T17:16:03.760Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html - https://crbug.com/1262080
CVE ID: CVE-2021-4102 State: PUBLISHED Published: 2022-02-11T22:55:22.000Z Last Updated: 2025-10-21T23:15:46.405Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html - https://crbug.com/1278387
CVE ID: CVE-2021-4103 State: PUBLISHED Published: 2022-01-23T01:45:11 Last Updated: 2024-08-03T17:16:04.162Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) Vendors: vanessa219 Products: vanessa219/vditor Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 1.0.34. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/67b980af-7357-4879-9448-a926c6474225 - https://github.com/vanessa219/vditor/commit/8d4d0889dd72b2f839e93a49db3da3a370416c7d
CVE ID: CVE-2021-4104 State: PUBLISHED Published: 2021-12-14T00:00:00 Last Updated: 2024-08-03T17:16:04.172Z Vendors: Apache Software Foundation Products: Apache Log4j 1.x Problem Types: CWE-502 Description: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reach
only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.cve.org/CVERecord?id=CVE-2021-44228 - https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126 - https://access.redhat.com/security/cve/CVE-2021-4104 - https://www.kb.cert.org/vuls/id/930724 - http://www.openwall.com/lists/oss-security/2022/01/18/3 - https://www.oracle.com/security-alerts/cpujan2022.html - https://psirt.global.sonicwall.com/vuln-detail/SNW
22/01/18/3 - https://www.oracle.com/security-alerts/cpujan2022.html - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033 - https://security.netapp.com/advisory/ntap-20211223-0007/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.gentoo.org/glsa/202209-02 - https://security.gentoo.org/glsa/202310-16 - https://security.gentoo.org/glsa/202312-02 - https://security.gentoo.org/glsa/202312-04
CVE ID: CVE-2021-4105 State: PUBLISHED Published: 2023-02-24T11:09:46.710Z Last Updated: 2025-03-11T15:46:27.196Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BG-TEK Products: COSLAT Firewall Problem Types: CWE-755 Description: Improper Handling of Parameters vulnerability in BG-TEK COSLAT Firewall allows Remote Code Inclusion.This issue affects COSLAT Firewall: from 5.24.0.R.20180630 before 5.24.0.R.20210727. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://blog.coslat.com/2021/07/onemli-kritik-guncelleme-2021-07-27.html - https://www.usom.gov.tr/bildirim/tr-23-0108