Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
omplete access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pwndoc/pwndoc/security/advisories - https://github.com/pwndoc/pwndoc/pull/128 - https://github.com/pwndoc/pwndoc/pull/74 - https://www.dgc.org/responsible_disclosure_pwndoc_jwt - https://github.com/pwndoc/pwndoc/blob/59519735b0d831d8fd96d7c3387f66d28407e583/CHANGELOG.md#040-2021-08-23 - https://github.com/pwndoc/pwndoc/commit/15f3dc0e212eda465e05fda0feb002d1bce2939d - https://github.com/pwndoc/pwndoc/commit/ff1b868cec55f5b6c7a91e15a2b0b1f4324121ab
CVE ID: CVE-2021-31597 State: PUBLISHED Published: 2021-04-22T23:52:48 Last Updated: 2024-08-03T23:03:33.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected. Additional Analyst Notes: - CVE Program Container: References: - https://people.kingsds.network/wesgarland/xmlhttprequest-ssl-vuln.txt - https://github.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1 - https://github.com/mjwwit/n
equest-ssl-vuln.txt - https://github.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1 - https://github.com/mjwwit/node-XMLHttpRequest/commit/bf53329b61ca6afc5d28f6b8d2dc2e3ca740a9b2 - https://security.netapp.com/advisory/ntap-20210618-0004/
CVE ID: CVE-2021-31598 State: PUBLISHED Published: 2021-04-24T16:32:53 Last Updated: 2024-08-03T23:03:33.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files, leading to a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/ezxml/bugs/28/ - https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html
CVE ID: CVE-2021-31599 State: PUBLISHED Published: 2021-11-08T03:24:49 Last Updated: 2024-08-03T23:03:33.521Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the production of complex reports. An authenticated user can run arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.hitachi.com/hirt/security/index.html - http://packetstormsecurity.com/files/164772/Pentaho-Business-Analytics-Pe
s://www.hitachi.com/hirt/security/index.html - http://packetstormsecurity.com/files/164772/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Remote-Code-Execution.html
CVE ID: CVE-2021-31600 State: PUBLISHED Published: 2021-11-08T03:26:24 Last Updated: 2024-08-03T23:03:33.522Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all valid usernames. Additional Analyst Notes: - CVE Program Container: References: - https://www.hitachi.com/hirt/security/index.html - http://packetstormsecurity
es: - CVE Program Container: References: - https://www.hitachi.com/hirt/security/index.html - http://packetstormsecurity.com/files/164787/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-User-Enumeration.html
CVE ID: CVE-2021-31601 State: PUBLISHED Published: 2021-11-08T03:27:58 Last Updated: 2024-08-03T23:03:33.669Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all databases connection details and credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.hitachi.com/hirt/security/index.html -
als. Additional Analyst Notes: - CVE Program Container: References: - https://www.hitachi.com/hirt/security/index.html - http://packetstormsecurity.com/files/164779/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Insufficient-Access-Control.html
CVE ID: CVE-2021-31602 State: PUBLISHED Published: 2021-11-08T03:30:32 Last Updated: 2024-08-03T23:03:33.521Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possess
nauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.hitachi.com/hirt/security/index.html - http://packetstormsecurity.com/files/164784/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Authentication-Bypass.html
CVE ID: CVE-2021-31604 State: PUBLISHED Published: 2021-09-27T05:32:34 Last Updated: 2024-08-03T23:03:33.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/furlongm/openvpn-monitor/releases - http://packetstormsecurity.com/files/164281/OpenVPN-Monitor-1.1.3-Cross-Site-Request-Forgery.html
CVE ID: CVE-2021-31605 State: PUBLISHED Published: 2021-09-27T05:35:24 Last Updated: 2024-08-03T23:03:33.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the server via signal%20SIGTERM. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/furlongm/openvpn-monitor/releases - http://packetstormsecurity.com/files/164278/OpenVPN-Monitor-1.1.3-Command-Injection.html
CVE ID: CVE-2021-31606 State: PUBLISHED Published: 2021-09-27T00:00:00 Last Updated: 2024-08-03T23:03:33.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/furlongm/openvpn-monitor/releases - http://packetstormsecurity.com/files/164274/OpenVPN-Monitor-1.1.3-Authorization-Bypass-Denial-Of-Service.html - https://github.com/furlongm/openvpn-monitor/commit/ddb9d31ef0ec56f578bdacf99ebe9d68455ed8ca
CVE ID: CVE-2021-31607 State: PUBLISHED Published: 2021-04-23T00:00:00 Last Updated: 2024-08-03T23:03:33.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely). Additional Analyst Notes: - CVE Program Container: References: - https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/ - https://lists.fedoraproject.org/archives/list/package-
stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html - https://www.debian.org/security/2
VFKPSUHLKLUBD5/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html - https://www.debian.org/security/2021/dsa-5011 - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2021-31608 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-30T15:20:40.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0011
CVE ID: CVE-2021-31609 State: PUBLISHED Published: 2021-09-07T06:30:26 Last Updated: 2024-08-03T23:03:33.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range to trigger a crash in WT32i via a crafted LMP packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.silabs.com/wireless/bluetooth/bluegiga-classic-legacy-modules/device.wt32i-a - https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE ID: CVE-2021-31610 State: PUBLISHED Published: 2021-09-07T06:14:08 Last Updated: 2024-08-03T23:03:33.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (either restart or deadlock the device) by flooding a device with LMP_AU_rand data. Additional Analyst Notes: - CVE Program Container: References: - http://www.bluetrum.com/product/bt8896a.html - http://www.bluetrum.com/product/ab5376t.html - https://www.mi.com/global/mi-true-wireless-earbuds-basic-2/ - https://dl.packetstormsec
etrum.com/product/ab5376t.html - https://www.mi.com/global/mi-true-wireless-earbuds-basic-2/ - https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE ID: CVE-2021-31611 State: PUBLISHED Published: 2021-09-07T06:03:47 Last Updated: 2024-08-03T23:03:33.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by a malformed LMP packet, allowing attackers in radio range to deadlock a device via a crafted LMP packet. The user needs to manually reboot the device to restore communication. Additional Analyst Notes: - CVE Program Container: References: - http://www.zh-jieli.com/product/68-cn.html - https://launchstudio.bluetooth.com/ListingDetails/58628 - https://launchstudio.blueto
.zh-jieli.com/product/68-cn.html - https://launchstudio.bluetooth.com/ListingDetails/58628 - https://launchstudio.bluetooth.com/ListingDetails/19746 - https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE ID: CVE-2021-31612 State: PUBLISHED Published: 2021-09-07T06:32:06 Last Updated: 2024-08-03T23:03:33.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greater than 17 bytes during the LMP auto rate procedure, allowing attackers in radio range to trigger a deadlock via a crafted LMP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.zh-jieli.com/product/68-cn.html - https://launchstudio.bluetooth.com/ListingDetails/19746 - https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE ID: CVE-2021-31613 State: PUBLISHED Published: 2021-09-07T06:00:56 Last Updated: 2024-08-03T23:03:33.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP auto rate procedure, allowing attackers in radio range to immediately crash (and restart) a device via a crafted LMP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.zh-jieli.com/product/68-cn.html - https://launchstudio.bluetooth.com/ListingDetails/58628 - https://launchstudio.bluetooth.com/ListingDetails/19746 - https://dl.packetstor
dio.bluetooth.com/ListingDetails/58628 - https://launchstudio.bluetooth.com/ListingDetails/19746 - https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE ID: CVE-2021-31615 State: PUBLISHED Published: 2021-06-25T11:59:42 Last Updated: 2024-08-03T23:03:33.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent device to inject a crafted packet during the receive window of the listening device before the transmitting device initiates its packet transmission to achieve full MITM status without terminating the link. When applied against devices establishing or using encrypted links, crafted packets may be used to terminate an existing link, but will not compromise the confidentiality or integrity of the link. Additio
may be used to terminate an existing link, but will not compromise the confidentiality or integrity of the link. Additional Analyst Notes: - CVE Program Container: References: - https://bluetooth.com - https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/injectable/
CVE ID: CVE-2021-31616 State: PUBLISHED Published: 2021-05-06T11:01:42 Last Updated: 2024-08-03T23:03:33.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/keepkey/keepkey-firmware/releases/tag/v7.1.0 - https://github.com/keepkey/keepkey-firmware/commit/e49d45594002d4d3fbc
om/keepkey/keepkey-firmware/releases/tag/v7.1.0 - https://github.com/keepkey/keepkey-firmware/commit/e49d45594002d4d3fbc1f03488e6dfc0a0a65836 - https://blog.inhq.net/posts/keepkey-CVE-2021-31616/ - https://shapeshift.com/library/keepkey-important-update-issued-april-4-required
CVE ID: CVE-2021-31617 State: PUBLISHED Published: 2022-01-31T15:16:46 Last Updated: 2024-08-03T23:03:33.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0 through 3.7.20, 3.8.0 through 3.11.8, and 4.0.1 through 4.2.2, mishandling of memory management can lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu/ - https://advisories.stormshield.eu/2021-020/
CVE ID: CVE-2021-31618 State: PUBLISHED Published: 2021-06-15T00:00:00 Last Updated: 2024-08-03T23:03:33.651Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-476 Description: Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer
ialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2021/06/10/9 - https://seclists.org/oss-sec/2021/q
/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2021/06/10/9 - https://seclists.org/oss-sec/2021/q2/206 - https://lists.apache.org/thread.html/r14b66ef0f4f569fd515a3f96cd4eb58bd9a8ff525cc326bb0359664f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r783b6558abf3305b17ea462bed4bd66d82866438999bf38cef6d11d1%40%3Ccvs.httpd.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NKJ3ZA3FTSZ2QBBPKS6BYGAWYRABNQQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A73QJ4HPUMU26I6EULG6SCK67TUEXZYR/ - https://lists.debian.org/debian-lts-announce/2021/07/m
sts.fedoraproject.org/message/A73QJ4HPUMU26I6EULG6SCK67TUEXZYR/ - https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html - https://www.debian.org/security/2021/dsa-4937 - https://security.gentoo.org/glsa/202107-38 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210727-0008/ - http://www.openwall.com/lists/oss-security/2024/03/13/2
CVE ID: CVE-2021-31624 State: PUBLISHED Published: 2021-10-29T10:25:47 Last Updated: 2024-08-03T23:03:33.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the urls parameter. Additional Analyst Notes: - CVE Program Container: References: - http://tenda.com - https://github.com/Lyc-heng/routers/blob/main/routers/stack2.md
CVE ID: CVE-2021-31627 State: PUBLISHED Published: 2021-10-29T10:32:17 Last Updated: 2024-08-03T23:03:33.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the index parameter. Additional Analyst Notes: - CVE Program Container: References: - http://tenda.com - https://github.com/Lyc-heng/routers/blob/main/routers/stack3.md
CVE ID: CVE-2021-31630 State: PUBLISHED Published: 2021-08-03T14:50:46 Last Updated: 2024-08-03T23:03:33.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on the "/hardware" page of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=l08DHB08Gow - https://packetstormsecurity.com/files/162563/OpenPLC-WebServer-3-Remote-Code-Execution.html
CVE ID: CVE-2021-31631 State: PUBLISHED Published: 2021-12-06T21:03:22 Last Updated: 2024-08-03T23:03:33.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulnerability allows attackers to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/stacksmasher007/76514ab2b782fb4383f1121e6fc19241
CVE ID: CVE-2021-31632 State: PUBLISHED Published: 2021-12-06T21:03:25 Last Updated: 2024-08-03T23:03:33.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Stacksmashers101/c6b9ea92f42c23473170bb3acc8fc5fe
CVE ID: CVE-2021-31635 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-05T15:32:17.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jfinal/jfinal/issues/187
CVE ID: CVE-2021-31637 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T20:16:32.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.1, 3.0.0, 3.0.1, 3.0.2 allows a remote attacker to execute arbitrary code via a crafted DLL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/purabparihar/d1401e59f9e699e71e3d700cc99e02a6
CVE ID: CVE-2021-31641 State: PUBLISHED Published: 2021-06-01T14:11:39 Last Updated: 2024-08-03T23:03:33.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated. Additional Analyst Notes: - CVE Program Container: References: - https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31641 - https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLY_lXmSlPY - https:
- https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLY_lXmSlPY - https://www.chiyu-tech.com/msg/message-Firmware-update-87.html - http://packetstormsecurity.com/files/162887/CHIYU-IoT-Cross-Site-Scripting.html
CVE ID: CVE-2021-31642 State: PUBLISHED Published: 2021-06-01T14:13:54 Last Updated: 2024-08-03T23:03:33.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device. Additional Analyst Notes: - CVE Program Container: References: - https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642 - https://seg
erences: - https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642 - https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/ - https://www.chiyu-tech.com/msg/message-Firmware-update-87.html - http://packetstormsecurity.com/files/162934/CHIYU-IoT-Denial-Of-Service.html