Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-44520 State: PUBLISHED Published: 2022-04-12T23:21:37 Last Updated: 2024-08-04T04:25:16.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://docs.citrix.com/en-us/xenmobile/server/document-history.html - https://gist.github.com/tree-chtsec/766f81e22ae383987d75eedb3b23b709 - https://support.citrix.com/article/CTX370551 - https://www.chtsecurity.com/news/09be10ae-b50e-46c9-8ce7-2e995fd988fe
CVE ID: CVE-2021-44521 State: PUBLISHED Published: 2022-02-11T12:20:12 Last Updated: 2024-08-04T04:25:16.640Z Vendors: Apache Software Foundation Products: Apache Cassandra Problem Types: CWE-94 Description: When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after thi
exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356 - http://www.openwall.com/lists/oss-security/2022/02/11/4 - https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ - https://security.netapp.com/advisory/ntap-20220225-0001/
CVE ID: CVE-2021-44522 State: PUBLISHED Published: 2021-12-14T12:07:09 Last Updated: 2024-08-04T04:25:16.836Z Vendors: Siemens Products: SiPass integrated V2.76, SiPass integrated V2.80, SiPass integrated V2.85, Siveillance Identity V1.5, Siveillance Identity V1.6 Problem Types: CWE-668 Description: A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal message broker system. This could allow an unauthenticated remote attacke
nsufficiently limit the access to the internal message broker system. This could allow an unauthenticated remote attacker to subscribe to arbitrary message queues. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf
CVE ID: CVE-2021-44523 State: PUBLISHED Published: 2021-12-14T12:07:10 Last Updated: 2024-08-04T04:25:16.828Z Vendors: Siemens Products: SiPass integrated V2.76, SiPass integrated V2.80, SiPass integrated V2.85, Siveillance Identity V1.5, Siveillance Identity V1.6 Problem Types: CWE-668 Description: A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal activity feed database. This could allow an unauthenticated remote attack
nsufficiently limit the access to the internal activity feed database. This could allow an unauthenticated remote attacker to read, modify or delete activity feed entries. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf
CVE ID: CVE-2021-44524 State: PUBLISHED Published: 2021-12-14T12:07:11 Last Updated: 2024-08-04T04:25:16.779Z Vendors: Siemens Products: SiPass integrated V2.76, SiPass integrated V2.80, SiPass integrated V2.85, Siveillance Identity V1.5, Siveillance Identity V1.6 Problem Types: CWE-668 Description: A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal user authentication service. This could allow an unauthenticated remote a
nsufficiently limit the access to the internal user authentication service. This could allow an unauthenticated remote attacker to trigger several actions on behalf of valid user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf
CVE ID: CVE-2021-44525 State: PUBLISHED Published: 2021-12-20T15:06:18 Last Updated: 2024-08-04T04:25:16.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/en/community/topic/title-security-advisory-for-cve-2021-44525-authentication-bypass-vulnerability-in-manageengine-pam360
CVE ID: CVE-2021-44526 State: PUBLISHED Published: 2021-12-23T14:57:02 Last Updated: 2024-08-04T04:25:16.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/on-premises/readme.html#12003
CVE ID: CVE-2021-44527 State: PUBLISHED Published: 2021-12-07T13:12:26 Last Updated: 2024-08-04T04:25:16.471Z Vendors: n/a Products: UniFi Switches Problem Types: CWE-400 Description: A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the network to perform a Deny of Service (DoS) attack on the affected switch.This vulnerability is fixed in UniFi Switch firmware 5.76.6 and later. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-022-022/cd83c01b-33e4-454a-b3b9-1c3ccebea7cb
CVE ID: CVE-2021-44528 State: PUBLISHED Published: 2022-01-07T00:00:00 Last Updated: 2024-08-04T04:25:16.854Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-601 Description: A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815 - https://www.debian.org/security/2023/dsa-5372 - https://security.netapp.co
it/0fccfb9a3097a9c4260c791f1a40b128517e7815 - https://www.debian.org/security/2023/dsa-5372 - https://security.netapp.com/advisory/ntap-20240208-0003/
CVE ID: CVE-2021-44529 State: PUBLISHED Published: 2021-12-08T00:00:00.000Z Last Updated: 2025-10-21T23:25:23.846Z Vendors: n/a Products: Ivanti EPM Problem Types: CWE-94 Description: A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/SA-2021-12-02 - http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html - http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injec
mote-Code-Execution.html - http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html
CVE ID: CVE-2021-44530 State: PUBLISHED Published: 2022-01-14T19:15:37 Last Updated: 2024-08-04T04:25:16.862Z Vendors: n/a Products: UniFi Network application Problem Types: CWE-20 Description: An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to control the application. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-023-023/808a1db0-5f8e-4b91-9097-9822f3f90207
CVE ID: CVE-2021-44531 State: PUBLISHED Published: 2022-02-24T18:27:00 Last Updated: 2025-04-30T22:24:39.015Z Vendors: NodeJS Products: Node Problem Types: CWE-295 Description: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior ca
Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1429694 - https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220325-0007/ - https://www.debian.org/security/2022/dsa-5170 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-44532 State: PUBLISHED Published: 2022-02-24T18:27:01 Last Updated: 2025-04-30T22:24:39.850Z Vendors: NodeJS Products: Node Problem Types: CWE-296 Description: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be
e fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1429694 - https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220325-0007/ - https://www.debian.org/security/2022/dsa-5170 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-44533 State: PUBLISHED Published: 2022-02-24T18:27:02 Last Updated: 2025-04-30T22:24:40.708Z Vendors: NodeJS Products: Node Problem Types: CWE-295 Description: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to suc
ected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1429694 - https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220325-0007/ - https://www.debian.org/security/2022/dsa-5170 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-44534 State: PUBLISHED Published: 2024-05-31T17:40:31.559Z Last Updated: 2024-08-04T04:25:16.819Z Vendors: ExpressionEngine Products: ExpressionEngine Description: Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/1096043
CVE ID: CVE-2021-44537 State: PUBLISHED Published: 2022-01-15T20:51:25 Last Updated: 2024-08-04T04:25:16.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.com/security-advisories/cve-2021-44537/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSZNJFGM66LJONBQFYYQL4GD5XI5QO2Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STKTSNYBZPXBGJOCDAMCZPRXJLAYGDMO
ists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STKTSNYBZPXBGJOCDAMCZPRXJLAYGDMO/
CVE ID: CVE-2021-44538 State: PUBLISHED Published: 2021-12-14T13:26:32 Last Updated: 2024-08-04T04:25:16.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overfl
buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.matrix.org/matrix-org/olm/-/tags - https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk - https://www.debian.org/security/2022/dsa-5034 - https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
CVE ID: CVE-2021-44540 State: PUBLISHED Published: 2021-12-23T19:48:42 Last Updated: 2024-08-04T04:25:16.799Z Vendors: n/a Products: Privoxy Problem Types: CWE-401 Description: A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing. Additional Analyst Notes: - CVE Program Container: References: - https://www.privoxy.org/3.0.33/user-manual/whatsnew.html%2C - https://www.privoxy.org/gitweb/?p=privoxy.git%3Ba=commit%3Bh=652b4b7cb0
CVE ID: CVE-2021-44541 State: PUBLISHED Published: 2021-12-23T19:48:42 Last Updated: 2024-08-04T04:25:16.504Z Vendors: n/a Products: Privoxy Problem Types: CWE-401 Description: A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination. Additional Analyst Notes: - CVE Program Container: References: - https://www.privoxy.org/3.0.33/user-manual/whatsnew.html%2C - https://www.privoxy.org/gitweb/?p=privoxy.git%3Ba=commit%3Bh=652b4b7cb0
CVE ID: CVE-2021-44542 State: PUBLISHED Published: 2021-12-23T19:48:43 Last Updated: 2024-08-04T04:25:16.827Z Vendors: n/a Products: Privoxy Problem Types: CWE-401 Description: A memory leak vulnerability was found in Privoxy when handling errors. Additional Analyst Notes: - CVE Program Container: References: - https://www.privoxy.org/3.0.33/user-manual/whatsnew.html%2C - https://www.privoxy.org/gitweb/?p=privoxy.git%3Ba=commit%3Bh=c48d1d6d08
CVE ID: CVE-2021-44543 State: PUBLISHED Published: 2021-12-23T19:48:44 Last Updated: 2024-08-04T04:25:16.806Z Vendors: n/a Products: privoxy Problem Types: CWE-79 Description: An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Privoxy is configured to servce the user-manual itself. Additional Analyst Notes: - CVE Program Container: References: - https://www.privoxy.org/3.0.33/user-manual/whatsnew.html%2C - https://www.privoxy.org/gitweb/?p=privoxy.git%3Ba=commit%3Bh=0e668e9409c
CVE ID: CVE-2021-44544 State: PUBLISHED Published: 2021-12-22T18:06:50.589935Z Last Updated: 2024-09-17T01:41:11.354Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: DIAEnergie Version 1.7.5 and prior is vulnerable to multiple cross-site scripting vulnerabilities when arbitrary code is injected into the parameter “name” of the script “HandlerEnergyType.ashx”. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03
CVE ID: CVE-2021-44545 State: PUBLISHED Published: 2022-08-18T00:00:00.000Z Last Updated: 2025-05-05T16:45:25.490Z Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products Problem Types: denial of service Description: Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00002.html
CVE ID: CVE-2021-44547 State: PUBLISHED Published: 2023-04-25T18:33:42.884Z Last Updated: 2024-08-04T04:25:16.862Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-267 Description: A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/107696
CVE ID: CVE-2021-44548 State: PUBLISHED Published: 2021-12-23T08:55:09 Last Updated: 2024-08-04T04:25:16.937Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: CWE-40, CWE-20 Description: An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonati
S user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows. Additional Analyst Notes: - CVE Program Container: References: - https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandler - https://security.netapp.com/advisory/ntap-20220114-0005/
CVE ID: CVE-2021-44549 State: PUBLISHED Published: 2021-12-14T15:15:10 Last Updated: 2024-08-04T04:25:16.815Z Vendors: Apache Software Foundation Products: Apache Sling Commons Messaging Mail Problem Types: CWE-295 Description: Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the sha
ail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429 Additional Analyst Notes: - CVE Program Container: Refer
-summary.html - https://github.com/eclipse-ee4j/mail/issues/429 Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7f
CVE ID: CVE-2021-44550 State: PUBLISHED Published: 2022-02-23T20:19:17 Last Updated: 2024-08-04T04:25:16.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stanfordnlp/CoreNLP/issues/1222
CVE ID: CVE-2021-44554 State: PUBLISHED Published: 2021-12-20T08:31:42 Last Updated: 2024-08-04T04:25:16.743Z Vendors: n/a Products: n/a Problem Types: n/a Description: Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest and krgtbt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cybelesoft/virtualui/issues/1
CVE ID: CVE-2021-44556 State: PUBLISHED Published: 2021-12-08T11:16:57 Last Updated: 2024-08-04T04:25:16.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/KBNLresearch/digger - https://github.com/KBNLresearch/digger/pull/1
CVE ID: CVE-2021-44557 State: PUBLISHED Published: 2021-12-08T11:21:10 Last Updated: 2024-08-04T04:25:16.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: National Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/ner.py. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/KBNLresearch/multiNER - https://github.com/KBNLresearch/multiNER/pull/3