Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43958 State: PUBLISHED Published: 2022-03-16T00:55:19.574907Z Last Updated: 2024-10-04T18:55:11.181Z Vendors: Atlassian Products: Fisheye, Crucible Problem Types: Improper Restriction of Excessive Authentication Attempts Description: Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA
r restriction of excess authentication attempts vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/FE-7387 - https://jira.atlassian.com/browse/CRUC-8523
CVE ID: CVE-2021-43959 State: PUBLISHED Published: 2022-07-26T08:00:14.034351Z Last Updated: 2024-10-03T18:37:02.582Z Vendors: Atlassian Products: Jira Service Management Server, Jira Service Management Data Center Problem Types: Server-Side Request Forgery Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially conf
EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JSDSERVER-11898
CVE ID: CVE-2021-43960 State: PUBLISHED Published: 2022-01-12T18:11:55 Last Updated: 2024-08-04T04:10:17.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title, Page Instructions, Text before, Text after, or Text on side box. Once this has been done, the administrator must click save and finally wait until any user of the application performs a booking for rental items in the booking area of
click save and finally wait until any user of the application performs a booking for rental items in the booking area of the application, where the XSS triggers. NOTE: another perspective is that the administrator may require JavaScript to customize any aspect of the page rendering. There is no effective way for the product to defend users in the face of a malicious administrator Additional Analyst Notes: - CVE Program Container: References: - https://www.lorensbergs.co.uk/products/connect2-academic/ - https://www.surecloud.com/resources/blog/lorensbergs-connect2-cross-site-scripting
CVE ID: CVE-2021-43961 State: PUBLISHED Published: 2022-03-17T21:13:13 Last Updated: 2024-08-04T04:10:17.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection. Additional Analyst Notes: - CVE Program Container: References: - https://issues.sonatype.org/secure/ReleaseNote.jspa - https://support.sonatype.com/hc/en-us/articles/4412183372307
CVE ID: CVE-2021-43963 State: PUBLISHED Published: 2021-12-07T21:05:13 Last Updated: 2024-08-04T04:10:17.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain write access. (This issue does not affect clusters where Sync Gateway is authenticated with X.509 client certificates. This issue also does not affect clusters where shared bucket access is not enabled on Sync Gateway.) Additional Analyst
This issue also does not affect clusters where shared bucket access is not enabled on Sync Gateway.) Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/alerts
CVE ID: CVE-2021-43969 State: PUBLISHED Published: 2022-03-07T20:58:08 Last Updated: 2024-08-04T04:10:17.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database (up to and including the administrative accounts' login IDs and passwords) via the login.jsp uname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://quicklert.com - https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digi
ttps://quicklert.com - https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digium-switchvox/amp-on/
CVE ID: CVE-2021-43970 State: PUBLISHED Published: 2022-03-07T20:58:14 Last Updated: 2024-08-04T04:10:17.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 (1043) via a .mp3;.jsp filename for a file that begins with audio data bytes. It allows an authenticated (low privileged) attacker to execute remote code on the target server within the context of application's permissions (SYSTEM). Additional Analyst Notes: - CVE Program Container: References: - https://quicklert.com - https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digium-switchvox/amp
.com - https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digium-switchvox/amp-on/
CVE ID: CVE-2021-43971 State: PUBLISHED Published: 2022-01-11T19:17:47 Last Updated: 2024-08-04T04:10:17.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.sysaid.com/it-service-management-software/incident-management - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md
CVE ID: CVE-2021-43972 State: PUBLISHED Published: 2022-01-11T19:19:23 Last Updated: 2024-08-04T04:10:17.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root (with an arbitrary filename) via the tempFile and fileName parameters in the HTTP POST body. Additional Analyst Notes: - CVE Program Container: References: - https://www.sysaid.com/it-service-management-software/incident-management - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md - https://githu
are/incident-management - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md
CVE ID: CVE-2021-43973 State: PUBLISHED Published: 2022-01-11T19:20:43 Last Updated: 2024-08-04T04:10:17.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file. Additional Analyst Notes: - CVE Program Container: References: - https://www.sysaid.com/it-service-management-software/incident-management - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md - https://githu
CVE ID: CVE-2021-43974 State: PUBLISHED Published: 2022-01-11T19:21:52 Last Updated: 2024-08-04T04:10:17.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous user registration only hides the client-side registration form. An attacker can still post registration data to create new accounts without prior authentication. Additional Analyst Notes: - CVE Program Container: References: - https://w
te new accounts without prior authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.sysaid.com/it-service-management-software/incident-management - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md
CVE ID: CVE-2021-43975 State: PUBLISHED Published: 2021-11-17T16:32:30 Last Updated: 2024-08-04T04:10:17.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify%40kernel.org/T/ - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a349
g/T/ - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/ - https://security.netapp.com/advisory/ntap-20211210-0001/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096
CVE ID: CVE-2021-43976 State: PUBLISHED Published: 2021-11-17T00:00:00 Last Updated: 2024-08-04T04:10:17.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic). Additional Analyst Notes: - CVE Program Container: References: - https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+%40Zekuns-MBP-16.fios-router.home/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/ - https://lists.fedo
/archives/list/package-announce%40lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/ - https://www.debian.org/security/2022/dsa-5092 - https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20211210-0001/ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=04d80663f67ccef893061b49ec8a42ff7045ae84
CVE ID: CVE-2021-43977 State: PUBLISHED Published: 2021-11-17T16:54:13 Last Updated: 2024-08-04T04:10:16.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.smartertools.com/smartermail/release-notes/current - https://csirt.divd.nl/cases/DIVD-2021-00006/
CVE ID: CVE-2021-43978 State: PUBLISHED Published: 2021-12-08T18:30:11.000Z Last Updated: 2025-05-30T16:01:58.432Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AC:L/AV:A/A:N/C:H/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.allegro.be/ - https://excellium-services.com/cert-xlm-advisory/CVE-2021-43978 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-43978
CVE ID: CVE-2021-43979 State: PUBLISHED Published: 2021-11-17T18:26:13 Last Updated: 2024-08-04T04:10:16.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication to finish before processing a request, which might cause inconsistencies between the replicated resources in OPA/Gatekeeper and the resources actually present in the cluster. Inconsistency can later be reflected in a policy bypass. NOTE: the
r and the resources actually present in the cluster. Inconsistency can later be reflected in a policy bypass. NOTE: the vendor disagrees that this is a vulnerability, because Kubernetes states are only eventually consistent Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hkerma/opa-gatekeeper-concurrency-issue - https://github.com/open-policy-agent/gatekeeper/releases
CVE ID: CVE-2021-43980 State: PUBLISHED Published: 2022-09-28T00:00:00.000Z Last Updated: 2025-05-21T15:00:10.097Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-362 Description: The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client. Additional Analyst Notes: - CVE Program C
resulting in responses, or part responses, to be received by the wrong client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3 - http://www.openwall.com/lists/oss-security/2022/09/28/1 - https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html - https://www.debian.org/security/2022/dsa-5265
CVE ID: CVE-2021-43981 State: PUBLISHED Published: 2021-12-23T19:48:39.215460Z Last Updated: 2024-09-16T20:12:37.498Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: mySCADA Products: myPRO Problem Types: CWE-78 Description: mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary operating system commands through a specific parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01
CVE ID: CVE-2021-43982 State: PUBLISHED Published: 2021-12-09T21:36:14.437461Z Last Updated: 2024-09-16T17:08:35.130Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: CNCSoft Problem Types: CWE-121 Description: Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-334-03
CVE ID: CVE-2021-43983 State: PUBLISHED Published: 2021-12-13T15:48:06.183569Z Last Updated: 2024-09-17T01:26:17.068Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: WECON Products: LeviStudioU Problem Types: CWE-121 Description: WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-343-02 - https://www.zerodayinitiative.com/advisories/ZDI-22-046/ - https://www.zerodayinitiative.com/advisories/ZDI-22-040/
2 - https://www.zerodayinitiative.com/advisories/ZDI-22-046/ - https://www.zerodayinitiative.com/advisories/ZDI-22-040/ - https://www.zerodayinitiative.com/advisories/ZDI-22-043/ - https://www.zerodayinitiative.com/advisories/ZDI-22-036/ - https://www.zerodayinitiative.com/advisories/ZDI-22-037/ - https://www.zerodayinitiative.com/advisories/ZDI-22-039/ - https://www.zerodayinitiative.com/advisories/ZDI-22-044/ - https://www.zerodayinitiative.com/advisories/ZDI-22-042/ - https://www.zerodayinitiative.com/advisories/ZDI-22-035/ - https://www.zerodayinitiative.com/advisories/ZDI-22-034/ - https://www.zerodayinitiative.com/advisories/ZDI-22-047/ - https://www.zerodayinitiative.com/advisories/ZD
ZDI-22-034/ - https://www.zerodayinitiative.com/advisories/ZDI-22-047/ - https://www.zerodayinitiative.com/advisories/ZDI-22-041/ - https://www.zerodayinitiative.com/advisories/ZDI-22-038/ - https://www.zerodayinitiative.com/advisories/ZDI-22-045/
CVE ID: CVE-2021-43984 State: PUBLISHED Published: 2021-12-23T19:48:37.725013Z Last Updated: 2024-09-16T23:30:31.442Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: mySCADA Products: myPRO Problem Types: CWE-78 Description: mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to inject arbitrary operating system commands through a specific parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01
CVE ID: CVE-2021-43985 State: PUBLISHED Published: 2021-12-23T19:48:40.631051Z Last Updated: 2024-09-16T17:14:15.304Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: mySCADA Products: myPRO Problem Types: CWE-288 Description: An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication or authorization. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01
CVE ID: CVE-2021-43986 State: PUBLISHED Published: 2022-04-20T15:30:29.227Z Last Updated: 2025-04-16T16:29:00.294Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: FANUC Products: ROBOGUIDE Problem Types: CWE-284 Description: The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original binaries and achieve privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-03
CVE ID: CVE-2021-43987 State: PUBLISHED Published: 2021-12-23T19:48:36.147646Z Last Updated: 2024-09-16T23:35:29.605Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mySCADA Products: myPRO Problem Types: CWE-912 Description: An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01
CVE ID: CVE-2021-43988 State: PUBLISHED Published: 2022-04-20T15:30:31.734Z Last Updated: 2025-04-16T16:28:37.927Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: FANUC Products: ROBOGUIDE Problem Types: CWE-22 Description: The affected product is vulnerable to a network-based attack by threat actors utilizing crafted naming conventions of files to gain unauthorized access rights. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-03
CVE ID: CVE-2021-43989 State: PUBLISHED Published: 2021-12-23T19:48:39.913930Z Last Updated: 2024-09-16T19:56:02.446Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mySCADA Products: myPRO Problem Types: CWE-916 Description: mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password hashes. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01
CVE ID: CVE-2021-43990 State: PUBLISHED Published: 2022-04-20T15:30:28.424Z Last Updated: 2025-04-16T16:29:08.202Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: FANUC Products: ROBOGUIDE Problem Types: CWE-611 Description: The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity reference call. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-03
CVE ID: CVE-2021-43991 State: PUBLISHED Published: 2021-12-03T14:42:31 Last Updated: 2024-08-04T04:10:17.117Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Kentico Products: Kentico Xperience XMS Problem Types: CWE-79 Description: The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retriev
s type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://appcheck-ng.com/persistent-xss-kentico-cms/
CVE ID: CVE-2021-43996 State: PUBLISHED Published: 2021-11-17T19:17:55 Last Updated: 2024-08-04T04:10:16.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facade/ignition/compare/1.16.14...1.16.15 - https://github.com/facade/ignition/compare/2.0.5...2.0.6 - https://github.com/facade/ignition/pull/285