Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
re viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse-ee4j/jersey/security/advisories/GHSA-c43q-5hpj-4crv - https://github.com/eclipse-ee4j/jersey/pull/4712 - https://lists.apache.org/thread.html/rd54b42edccc1b993853a9c4943a9b16db763f5e2febf6e64b7d0fe3c%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/rc6221670de35b819fe191e7d8f2d17bc000549bd554020cec644b71e%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/ra3d7cd37fc794981a885332af2f8df0d873753380ea19935d6d847fc%40
.kafka.apache.org%3E - https://lists.apache.org/thread.html/ra3d7cd37fc794981a885332af2f8df0d873753380ea19935d6d847fc%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/rc288874c330b3af9e29a1a114c5e0d24fff7a79eaa341f551535c8c0%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r4066176a7352e021d7a81af460044bde8d57f40e98f8e4a31923af3a%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r42fef440487a04cf5e487a9707ef5119d2dd5b809919f25ef4296fc4%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/rafc3c4cee534f478cbf8acf91e48373e291a21151f030e8132662a7b%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r454f3
f478cbf8acf91e48373e291a21151f030e8132662a7b%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r454f38e85db149869c5a92c993c402260a4f8599bf283f6cfaada972%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r96658b899fcdbf04947257d201dc5a0abdbb5fb0a8f4ec0a6c15e70f%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r6dadc8fe82071aba841d673ffadf34728bff4357796b1990a66e3af1%40%3Ccommits.kafka.apache.org%3E - https://lists.apache.org/thread.html/r280438f7cb4b3b1c9dfda9d7b05fa2a5cfab68618c6afee8169ecdaa%40%3Ccommits.kafka.apache.org%3E - https://lists.apache.org/thread.html/rdff6939e6c8dd620e20b013d9a35f57d42b3cd19e1d0483d85dfa2fd%40%3Cjira.kafk
e.org%3E - https://lists.apache.org/thread.html/rdff6939e6c8dd620e20b013d9a35f57d42b3cd19e1d0483d85dfa2fd%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r305fb82e5c005143c1e2ec986a19c0a44f42189ab2580344dc955359%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/ra2722171d569370a9e15147d9f3f6138ad9a188ee879c0156aa2d73a%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/ra3290fe51b4546fac195724c4187c4cb7fc5809bc596c2f7e97606f4%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2021-28169 State: PUBLISHED Published: 2021-06-09T01:55:09 Last Updated: 2024-08-03T21:40:12.267Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-200 Description: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Additional Analyst Notes: - CVE Program Container: Re
ive information regarding the implementation of a web application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq - https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html - https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r29678972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.htm
78972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/rd5b52362f5edf98e0dcab6541a381f571cccc05ad9188e793af688f3%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c%40%3Cjira.kaf
he.org%3E - https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/rb1292d30462b9baedea7c5d9594fc75990d9aa0ec223b48054ca9c25%40%3Cjira.kafka.apache.org%3E - https://www.debian.org/security/2021/dsa-4949 - https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apa
https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5%40%3Cdev.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.
tml - https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E - https://security.netapp.com/advisory/ntap-20210727-0009/ - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2021-28170 State: PUBLISHED Published: 2021-05-26T21:55:09 Last Updated: 2024-08-03T21:40:12.240Z Vendors: The Eclipse Foundation Products: Jakarta Expression Language Implementation Problem Types: CWE-20 Description: In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse-ee4j/el-ri/issues/155 - https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/ - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2021-28171 State: PUBLISHED Published: 2021-04-06T11:20:27.171745Z Last Updated: 2024-09-16T23:41:41.900Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Vangene Products: deltaFlow E-platform Problem Types: CWE-522 Description: The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data in the Cookie. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4618-4dcc2-1.html - https://www.chtsecurity.com/news/7f0874b5-516b-4637-842d-b6fb6c335c66
CVE ID: CVE-2021-28172 State: PUBLISHED Published: 2021-04-06T11:20:27.924240Z Last Updated: 2024-09-17T03:54:53.595Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Vangene Products: deltaFlow E-platform Problem Types: CWE-22 Description: There is a Path Traversal vulnerability in the file download function of Vangene deltaFlow E-platform. Remote attackers can access credential data with this leakage. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/7f0874b5-516b-4637-842d-b6fb6c335c66 - https://www.twcert.org.tw/tw/cp-132-4619-fd2b9-1.html
CVE ID: CVE-2021-28173 State: PUBLISHED Published: 2021-04-06T11:20:28.608132Z Last Updated: 2024-09-16T22:55:37.530Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Vangene Products: deltaFlow E-platform Problem Types: CWE-434 Description: The file upload function of Vangene deltaFlow E-platform does not perform access controlled properly. Remote attackers can upload and execute arbitrary files without login. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/7f0874b5-516b-4637-842d-b6fb6c335c66 - https://www.twcert.org.tw/tw/cp-132-4620-58f9c-1.html
CVE ID: CVE-2021-28174 State: PUBLISHED Published: 2021-04-08T03:50:39.989975Z Last Updated: 2024-09-16T16:53:43.810Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Mitake Products: Mitake Smart Stock Selection System Problem Types: CWE-287 Description: Mitake smart stock selection system contains a broken authentication vulnerability. By manipulating the parameters in the URL, remote attackers can gain the privileged permissions to access transaction record, and fraudulent trading without login. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4625-4ccc6-1.html
CVE ID: CVE-2021-28175 State: PUBLISHED Published: 2021-04-06T05:01:59.154978Z Last Updated: 2024-09-16T23:31:25.753Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://
akage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-4543-98220-1.html - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/
CVE ID: CVE-2021-28176 State: PUBLISHED Published: 2021-04-06T05:01:59.929256Z Last Updated: 2024-09-17T01:41:07.100Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www
ge to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4544-0a409-1.html
CVE ID: CVE-2021-28177 State: PUBLISHED Published: 2021-04-06T05:02:00.622742Z Last Updated: 2024-09-16T19:10:49.934Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://ww
age to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4547-88e43-1.html
CVE ID: CVE-2021-28178 State: PUBLISHED Published: 2021-04-06T05:02:01.322935Z Last Updated: 2024-09-16T17:38:58.664Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://ww
age to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4548-7a2c6-1.html
CVE ID: CVE-2021-28179 State: PUBLISHED Published: 2021-04-06T05:02:02.122734Z Last Updated: 2024-09-17T01:05:48.147Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Contain
emote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4549-c97ba-1.html
CVE ID: CVE-2021-28180 State: PUBLISHED Published: 2021-04-06T05:02:02.815119Z Last Updated: 2024-09-16T23:16:47.551Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container:
e attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4550-5ee8c-1.html
CVE ID: CVE-2021-28181 State: PUBLISHED Published: 2021-04-06T05:02:03.499261Z Last Updated: 2024-09-17T00:31:42.608Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Containe
mote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4551-5dd2f-1.html
CVE ID: CVE-2021-28182 State: PUBLISHED Published: 2021-04-06T05:02:04.186378Z Last Updated: 2024-09-16T21:07:24.302Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - htt
he leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4552-5b2c4-1.html
CVE ID: CVE-2021-28183 State: PUBLISHED Published: 2021-04-06T05:02:04.922971Z Last Updated: 2024-09-17T03:48:00.979Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The specific function in ASUS BMC’s firmware Web management page (Web License configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container
ote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4553-06ae2-1.html
CVE ID: CVE-2021-28184 State: PUBLISHED Published: 2021-04-06T05:02:05.742701Z Last Updated: 2024-09-16T20:31:30.262Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References:
use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4554-10a74-1.html
CVE ID: CVE-2021-28185 State: PUBLISHED Published: 2021-04-06T05:02:06.544964Z Last Updated: 2024-09-16T22:08:33.875Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Contain
emote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4555-3c7c3-1.html
CVE ID: CVE-2021-28186 State: PUBLISHED Published: 2021-04-06T05:02:07.331002Z Last Updated: 2024-09-16T23:55:35.086Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Contain
emote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4556-ece3d-1.html
CVE ID: CVE-2021-28187 State: PUBLISHED Published: 2021-04-06T05:02:08.095961Z Last Updated: 2024-09-16T17:03:45.222Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: Ref
ttackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4557-1019f-1.html
CVE ID: CVE-2021-28188 State: PUBLISHED Published: 2021-04-06T05:02:08.812420Z Last Updated: 2024-09-16T16:22:42.826Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: BMC firmware for Z10PR-D16, BMC firmware for ASMB8-iKVM, BMC firmware for Z10PE-D16 WS Problem Types: CWE-120 Description: The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Containe
mote attackers use the leakage to abnormally terminate the Web service. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/content/ASUS-Product-Security-Advisory/ - https://www.asus.com/tw/support/callus/ - https://www.twcert.org.tw/tw/cp-132-4558-ad16e-1.html