Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-36609 State: PUBLISHED Published: 2022-06-16T20:36:23 Last Updated: 2024-08-04T01:01:58.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/webtareas/tickets/43/
CVE ID: CVE-2021-36613 State: PUBLISHED Published: 2022-05-11T17:34:34 Last Updated: 2024-08-04T01:01:58.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2021/Jul/0 - http://seclists.org/fulldisclosure/2022/Jun/2
CVE ID: CVE-2021-36614 State: PUBLISHED Published: 2022-05-11T17:34:27 Last Updated: 2024-08-04T01:01:57.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2021/Jul/0 - http://seclists.org/fulldisclosure/2022/Jun/2
CVE ID: CVE-2021-36621 State: PUBLISHED Published: 2021-07-29T17:11:30 Last Updated: 2024-08-04T01:01:58.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50109 - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-18-09-2821
b.com/exploits/50109 - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-18-09-2821 - http://packetstormsecurity.com/files/164324/Covid-Vaccination-Scheduler-System-1.0-SQL-Injection-Cross-Site-Scripting.html
CVE ID: CVE-2021-36622 State: PUBLISHED Published: 2021-08-03T17:42:11 Last Updated: 2024-08-04T01:01:58.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload. The admin panel has an upload function of profile photo accessible at http://localhost/scheduler/admin/?page=user. An attacker could upload a malicious file such as shell.php with the Content-Type: image/png. Then, the attacker have to visit the uploaded profile photo to access the shell. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50114
CVE ID: CVE-2021-36623 State: PUBLISHED Published: 2021-08-03T17:51:12 Last Updated: 2024-08-04T01:01:57.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary File Upload in Sourcecodester Phone Shop Sales Management System 1.0 enables RCE. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50106
CVE ID: CVE-2021-36624 State: PUBLISHED Published: 2021-07-29T17:21:42 Last Updated: 2024-08-04T01:01:58.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Phone Shop Sales Managements System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50105 - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-36624
CVE ID: CVE-2021-36625 State: PUBLISHED Published: 2022-03-31T17:50:36 Last Updated: 2024-08-04T01:01:58.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/commit/abb1ad6bf0469eccd2b58beb20bdabc18fc36e22
CVE ID: CVE-2021-36628 State: REJECTED Published: 2022-04-25T06:02:28 Last Updated: 2022-04-25T06:02:28 Description: No description available.
CVE ID: CVE-2021-36630 State: PUBLISHED Published: 2023-01-18T00:00:00.000Z Last Updated: 2025-04-04T15:50:52.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DOS attacks via crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://ruckus.com - https://www.freebuf.com/articles/web/260338.html - http://smartzone-100.com - https://anquan.baidu.com/article/1434 - https://github.com/lixiang957/CVE-2021-36630 - https://www.commscope.com/globalassets/digizuite/921070-faq-security-advisory-i
//github.com/lixiang957/CVE-2021-36630 - https://www.commscope.com/globalassets/digizuite/921070-faq-security-advisory-id-20210719-v1-0.pdf
CVE ID: CVE-2021-36631 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T14:39:24.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shigophilo/CVE/blob/main/Baidunetdisk%20Version%207.4.3%20dll%20hijack.md
CVE ID: CVE-2021-36646 State: PUBLISHED Published: 2023-09-06T00:00:00 Last Updated: 2024-09-26T20:48:42.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kalcaddle/KodExplorer/issues/482
CVE ID: CVE-2021-36647 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-11-03T19:26:11.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kouzili.com/Load-Step.pdf -
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kouzili.com/Load-Step.pdf - https://github.com/ARMmbed/mbedtls/releases/ - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-07-1
CVE ID: CVE-2021-36654 State: PUBLISHED Published: 2021-08-03T17:47:35 Last Updated: 2024-08-04T01:01:58.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while updating the theme. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/boiteasite/cmsuno/issues/17 - http://packetstormsecurity.com/files/163737/CMSuno-1.7-Cross-Site-Scripting.html
CVE ID: CVE-2021-36665 State: PUBLISHED Published: 2022-07-11T15:06:35 Last Updated: 2024-08-04T01:01:57.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon. Additional Analyst Notes: - CVE Program Container: References: - http://druva.com - https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before - https://imhotepisinvisible.com/druva-lpe/
CVE ID: CVE-2021-36666 State: PUBLISHED Published: 2022-07-11T15:06:44 Last Updated: 2024-08-04T01:01:58.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission. Additional Analyst Notes: - CVE Program Container: References: - http://druva.com - https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before - https://imhotepisinvisible.com/druva-lpe/
CVE ID: CVE-2021-36667 State: PUBLISHED Published: 2022-07-11T15:06:50 Last Updated: 2024-08-04T01:01:58.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library. Additional Analyst Notes: - CVE Program Container: References: - http://druva.com - https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before - https://imhotepisinvisible.com/druva-lpe/
CVE ID: CVE-2021-36668 State: PUBLISHED Published: 2022-07-11T15:06:57 Last Updated: 2024-08-04T01:01:58.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App. Additional Analyst Notes: - CVE Program Container: References: - http://druva.com - https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before - https://imhotepisinvisible.com/druva-lpe/
CVE ID: CVE-2021-36686 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-04-01T14:03:11.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/YMFE/yapi/issues/2190 - https://github.com/YMFE/yapi/issues/2240
CVE ID: CVE-2021-36689 State: PUBLISHED Published: 2023-03-03T00:00:00.000Z Last Updated: 2025-03-07T17:21:33.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decrypt data via a brute force attack that uses a recovered samourai.dat file. The PIN is 5 to 8 digits, which may be insufficient in this situation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://code.samourai.io/wallet/samourai-wallet-android/-/blob/develop/app/src/main/java/com/samourai/wallet/PinEntryActivity.java#
e.samourai.io/wallet/samourai-wallet-android/-/blob/develop/app/src/main/java/com/samourai/wallet/PinEntryActivity.java#L302 - https://vrls.ws/posts/2021/08/samourai-wallet-bitcoin-pin-authentication-bypass-crypto/
CVE ID: CVE-2021-36690 State: PUBLISHED Published: 2021-08-24T00:00:00.000Z Last Updated: 2025-11-03T21:45:01.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library. Additional Analyst Notes: - CVE Program Container: References: - https://www.sqlite.org/forum/forumpost/718c0a8d17 - https://support.apple.com
es: - CVE Program Container: References: - https://www.sqlite.org/forum/forumpost/718c0a8d17 - https://support.apple.com/kb/HT213446 - https://support.apple.com/kb/HT213488 - https://support.apple.com/kb/HT213486 - https://support.apple.com/kb/HT213487 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/39 - http://seclists.org/fulldisclosure/2022/Oct/49 - http://seclists.org/fulldisclosure/2022/Oct/47
CVE ID: CVE-2021-36691 State: PUBLISHED Published: 2021-08-30T19:53:47 Last Updated: 2024-08-04T01:01:57.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase(). When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjxl/libjxl/issues/422
CVE ID: CVE-2021-36692 State: PUBLISHED Published: 2021-08-30T20:14:39 Last Updated: 2024-08-04T01:01:58.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). When encoding a malicous APNG file using cjxl, an attacker can trigger a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjxl/libjxl/issues/308 - https://github.com/libjxl/libjxl/pull/313 - https://github.com/libjxl/libjxl/commit/7dfa400ded53919d986c5d3d23446a09e0cf481b
CVE ID: CVE-2021-36695 State: PUBLISHED Published: 2021-09-08T11:16:58 Last Updated: 2024-08-04T01:01:58.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in the download file feature on a manager profile due to lack of input validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.r29k.com/articles/bb/stored-xss-in-deskpro#anchor1
CVE ID: CVE-2021-36696 State: PUBLISHED Published: 2021-09-07T10:52:35 Last Updated: 2024-08-04T01:01:57.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user profile due to lack of input validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.r29k.com/articles/bb/stored-xss-in-deskpro#anchor2
CVE ID: CVE-2021-36697 State: PUBLISHED Published: 2021-11-03T11:33:57 Last Updated: 2024-08-04T01:01:59.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rewrite Rule with a type definition. A normal PHP file can be uploaded with this new "file type" and the code can be executed with an HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://artica.com - http://pandora.com - https://k4m1ll0.com/chained_exploit_htaccess.html
CVE ID: CVE-2021-36698 State: PUBLISHED Published: 2021-11-03T11:33:49 Last Updated: 2024-08-04T01:01:58.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name. Additional Analyst Notes: - CVE Program Container: References: - http://artica.com - http://pandora.com - https://k4m1ll0.com/chained_exploit_htaccess.html
CVE ID: CVE-2021-36701 State: PUBLISHED Published: 2021-08-03T18:02:31 Last Updated: 2024-08-04T01:01:59.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. The vulnerability may allow a remote attacker to delete arbitrary know files on the host. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/danpros/htmly/issues/481
CVE ID: CVE-2021-36702 State: PUBLISHED Published: 2021-08-03T18:03:21 Last Updated: 2024-08-04T01:01:58.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/danpros/htmly/issues/481
CVE ID: CVE-2021-36703 State: PUBLISHED Published: 2021-08-03T18:03:44 Last Updated: 2024-08-04T01:01:59.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/danpros/htmly/issues/481
CVE ID: CVE-2021-36705 State: PUBLISHED Published: 2021-08-06T13:19:17 Last Updated: 2024-08-04T01:01:58.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contains a trivial command injection where the value of the TR069_local_port parameter is passed directly to system. Additional Analyst Notes: - CVE Program Container: References: - https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#tr069-command-injection
CVE ID: CVE-2021-36706 State: PUBLISHED Published: 2021-08-06T13:19:24 Last Updated: 2024-08-04T01:01:58.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD contains a trivial command injection where the value of the command parameter is passed directly to system. Additional Analyst Notes: - CVE Program Container: References: - https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#syscmd-command-injection
CVE ID: CVE-2021-36707 State: PUBLISHED Published: 2021-08-06T13:19:30 Last Updated: 2024-08-04T01:01:59.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff contains a trivial command injection where the value of the led_cmd parameter is passed directly to do_system. Additional Analyst Notes: - CVE Program Container: References: - https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#ledonoff-command-injection
CVE ID: CVE-2021-36708 State: PUBLISHED Published: 2021-08-06T13:19:36 Last Updated: 2024-08-04T01:01:59.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset the password to the administrative interface of the router. Additional Analyst Notes: - CVE Program Container: References: - https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#sysinit-password-reset
CVE ID: CVE-2021-36710 State: PUBLISHED Published: 2022-06-08T14:43:46 Last Updated: 2024-08-04T01:01:58.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: ToaruOS 1.99.2 is affected by incorrect access control via the kernel. Improper MMU management and having a low GDT address allows it to be mapped in userland. A call gate can then be written to escalate to CPL 0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mehsauce/kowasuos/blob/master/exploits/kowasu-sysfunc-strikes-back.c
CVE ID: CVE-2021-36711 State: PUBLISHED Published: 2022-07-16T16:52:38 Last Updated: 2024-08-04T01:01:58.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.octobot.online/ - https://packetstormsecurity.com/files/167721/Sashimi-Evil-OctoBot-Tentacle.html - https://github.com/Nwqda/Sashimi-Evil-OctoBot-Tentacle - https://github.com/Drakkar-Software/OctoBot/issues/1966 - https://github.com/Drakkar-Software/OctoBot/blob/master/CHANGELOG.md - http://packetstormsecurity.com/files/167780/OctoBot-WebInterfa
b.com/Drakkar-Software/OctoBot/blob/master/CHANGELOG.md - http://packetstormsecurity.com/files/167780/OctoBot-WebInterface-0.4.3-Remote-Code-Execution.html
CVE ID: CVE-2021-36712 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:14:41.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://yzmcms.com - https://github.com/linuka-deception/yzmcms6.1.git
CVE ID: CVE-2021-36713 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T15:58:43.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in the DataTables plug-in 1.9.2 for jQuery allows attackers to run arbitrary code via the sBaseName parameter to function _fnCreateCookie. NOTE: 1.9.2 is a version from 2012. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cdn.datatables.net/1.9.2/js/jquery.dataTables.js - https://gist.github.com/walhajri/711af9b62f6fb25e66a5d9a490deab98 - https://security.netapp.com/advisory/ntap-20230406-0003/
CVE ID: CVE-2021-36716 State: PUBLISHED Published: 2021-07-14T15:37:18 Last Updated: 2024-08-04T01:01:59.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/segmentio/is-email/releases - https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716/
CVE ID: CVE-2021-36717 State: PUBLISHED Published: 2021-09-07T11:36:33 Last Updated: 2024-08-04T01:01:59.243Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Synerion Products: TimeNet version Problem Types: Directory Traversal Description: Synerion TimeNet version 9.21 contains a directory traversal vulnerability where, on the "Name" parameter, the attacker can return to the root directory and open the host file. This might give the attacker the ability to view restricted files, which could provide the attacker with more information required to further compromise the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il
ed to further compromise the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2021-36718 State: PUBLISHED Published: 2021-12-08T19:25:46 Last Updated: 2024-08-04T01:01:59.770Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SYNEL Products: Synel eharmonynew, Synel Reports Problem Types: Default credentials , Security miscommunication , Sensetive data exposure Description: SYNEL - eharmonynew / Synel Reports - The attacker can log in to the system with default credentials and export a report of eharmony system with sensetive data (Employee name, Employee ID number, Working hours etc') The vulnerabilety has been addressed and fixed on version 11. Default credentials , Security miscommunication , Sensetive data exposure vulne