alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-29966 (published 2021-06-24)
Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 89.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mozilla
Affected products: firefox
CVE-2021-29967 (published 2021-06-24)
Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2021-29968 (published 2021-06-24)
When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.0.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: microsoft, mozilla
Affected products: firefox, windows
CVE-2021-29969 (published 2021-08-05)
If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-552
Affected vendors: mozilla
Affected products: thunderbird
CVE-2021-29970 (published 2021-08-05)
A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2021-29971 (published 2021-08-05)
If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted that permission. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 90.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: mozilla
Affected products: firefox
CVE-2021-29972 (published 2021-08-05)
A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, and may have remediated other, unknown security vulnerabilities as well. This vulnerability affects Firefox < 90.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: mozilla
Affected products: firefox
CVE-2021-29973 (published 2021-08-05)
Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be entered by the browser's autofill functionality *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 90.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: mozilla
Affected products: firefox
CVE-2021-29974 (published 2021-08-05)
When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically. This vulnerability affects Firefox < 90.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: mozilla
Affected products: firefox
CVE-2021-29975 (published 2021-08-05)
Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlaid on top of another domain (with the new domain correctly shown in the address bar) resulting in possible user confusion. This vulnerability affects Firefox < 90.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: mozilla
Affected products: firefox
CVE-2021-29976 (published 2021-08-05)
Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2021-29977 (published 2021-08-05)
Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 90.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mozilla
Affected products: firefox
CVE-2021-29978 (published 2021-08-05)
Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability affects Mozilla VPN < 2.3.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: mozilla
Affected products: mozilla_vpn
CVE-2021-29979 (published 2021-08-02)
Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instance’s primary hosting domain.*. This vulnerability affects Hubs Cloud < mozillareality/reticulum/1.0.1/20210618012634.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mozilla
Affected products: hubs_cloud
CVE-2021-29980 (published 2021-08-17)
Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-909
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2021-29981 (published 2021-08-17)
An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash. This vulnerability affects Firefox < 91 and Thunderbird < 91.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: mozilla
Affected products: firefox, thunderbird
CVE-2021-29982 (published 2021-08-17)
Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. This vulnerability affects Firefox < 91 and Thunderbird < 91.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-772
Affected vendors: mozilla
Affected products: firefox, thunderbird
CVE-2021-29983 (published 2021-08-17)
Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: google, mozilla
Affected products: android, firefox
CVE-2021-29984 (published 2021-08-17)
Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2021-29985 (published 2021-08-17)
A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2021-29986 (published 2021-08-17)
A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.* This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: linux, mozilla
Affected products: firefox, firefox_esr, linux_kernel, thunderbird
CVE-2021-29987 (published 2021-08-17)
After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. *This bug only affects Firefox on Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91 and Thunderbird < 91.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-307
Affected vendors: linux, mozilla
Affected products: firefox, linux_kernel, thunderbird
CVE-2021-29988 (published 2021-08-17)
Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2021-29989 (published 2021-08-17)
Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13, and Firefox < 91.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2021-29990 (published 2021-08-17)
Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 91.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mozilla
Affected products: firefox
CVE-2021-29991 (published 2021-11-03)
Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers using HTTP/3. This vulnerability affects Firefox < 91.0.1 and Thunderbird < 91.0.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Weakness: CWE-444
Affected vendors: mozilla
Affected products: firefox, thunderbird
CVE-2021-29993 (published 2021-11-03)
Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 92.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Affected vendors: mozilla
Affected products: firefox
CVE-2021-29994 (published 2021-11-08)
Cloudera Hue 4.6.0 allows XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cloudera
Affected products: hue
CVE-2021-29995 (published 2021-06-09)
A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (including script execution). The issue is resolved in CloverDX 5.10, CloverDX 5.9.1, CloverDX 5.8.2, and CloverDX 5.7.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: cloverdx
Affected products: cloverdx
CVE-2021-29996 (published 2021-04-05)
Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution (RCE) by opening .md files containing a mutation Cross Site Scripting (XSS) payload.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: marktext
Affected products: marktext
CVE-2021-29997 (published 2021-04-13)
An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-125
Affected vendors: windriver
Affected products: vxworks
CVE-2021-29998 (published 2021-04-13)
An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: siemens, windriver
Affected products: ruggedcom_win_subscriber_station, ruggedcom_win_subscriber_station_firmware, scalance_x200-4_p_irt, scalance_x200-4_p_irt_firmware, scalance_x201-3p_irt, scalance_x201-3p_irt_firmware, scalance_x201-3p_irt_pro, scalance_x201-3p_irt_pro_firmware, scalance_x202-2_irt, scalance_x202-2_irt_firmware, scalance_x202-2p_irt, scalance_x202-2p_irt_firmware, scalance_x202-2p_irt_pro, scalance_x202-2p_irt_pro_firmware, scalance_x204-2, scalance_x204-2_firmware, scalance_x204-2fm, scalance_x204-2fm_firmware, scalance_x204-2ld, scalance_x204-2ld_firmware, scalance_x204-2ld_ts, scalance_x204-2ld_ts_firmware, scalance_x204-2ts, scalance_x204-2ts_firmware, scalance_x204_irt
CVE-2021-29999 (published 2021-04-13)
An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: windriver
Affected products: vxworks
CVE-2021-30000 (published 2021-04-02)
An issue was discovered in LATRIX 0.6.0. SQL injection in the txtaccesscode parameter of inandout.php leads to information disclosure and code execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: latrix_project
Affected products: latrix
CVE-2021-30002 (published 2021-04-02)
An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: debian, linux
Affected products: debian_linux, linux_kernel
CVE-2021-30003 (published 2021-04-02)
An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface via urlfilter.cgi?add url_address.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: nokia
Affected products: g-120w-f, g-120w-f_firmware
CVE-2021-30004 (published 2021-04-02)
In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: w1.fi
Affected products: hostapd, wpa_supplicant
CVE-2021-30005 (published 2021-05-11)
In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-345
Affected vendors: jetbrains
Affected products: pycharm
CVE-2021-30006 (published 2021-05-11)
In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-611
Affected vendors: jetbrains
Affected products: intellij_idea
CVE-2021-30014 (published 2021-04-19)
There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC from v0.9.0-preview to 1.0.1 which results in a crash.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: gpac
Affected products: gpac
CVE-2021-30015 (published 2021-04-19)
There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1. The pid comes from function av1dmx_parse_flush_sample, the ctx.opid maybe NULL. The result is a crash in gf_filter_pck_new_alloc_internal.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: gpac
Affected products: gpac
CVE-2021-30019 (published 2021-04-19)
In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a heap overflow in the memcpy.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: gpac
Affected products: gpac
CVE-2021-3002 (published 2021-01-01)
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: seopanel
Affected products: seo_panel
CVE-2021-30020 (published 2021-04-19)
In the function gf_hevc_read_pps_bs_internal function in media_tools/av_parsers.c in GPAC 1.0.1 there is a loop, which with crafted file, pps->num_tile_columns may be larger than sizeof(pps->column_width), which results in a heap overflow in the loop.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: gpac
Affected products: gpac
CVE-2021-30022 (published 2021-04-19)
There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC from 0.5.2 to 1.0.1. pps_id may be a negative number, so it will not return. However, avc->pps only has 255 unit, so there is an overflow, which results a crash.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: gpac
Affected products: gpac
CVE-2021-30027 (published 2021-04-29)
md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown document.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-908
Affected vendors: md4c_project
Affected products: md4c
CVE-2021-30028 (published 2022-05-20)
SOOTEWAY Wi-Fi Range Extender v1.5 was discovered to use default credentials (the admin password for the admin account) to access the TELNET service, allowing attackers to erase/read/write the firmware remotely.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: sooteway_wi-fi_range_extender_project
Affected products: sooteway_wi-fi_range_extender
CVE-2021-3003 (published 2021-05-10)
Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof product updates.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-319
Affected vendors: agenziaentrate
Affected products: desktop_telematico
CVE-2021-30030 (published 2021-04-13)
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: remoteclinic
Affected products: remote_clinic
CVE-2021-30034 (published 2021-04-13)
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: remoteclinic
Affected products: remote_clinic
CVE-2021-30039 (published 2021-04-13)
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: remoteclinic
Affected products: remote_clinic
CVE-2021-3004 (published 2021-01-03)
The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-682
Affected vendors: stableyieldcredit_project
Affected products: stableyieldcredit
CVE-2021-30042 (published 2021-04-13)
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register.php
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: remoteclinic
Affected products: remote_clinic
CVE-2021-30044 (published 2021-04-13)
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: remoteclinic
Affected products: remote_clinic
CVE-2021-30045 (published 2021-04-06)
SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-120
Affected vendors: serenityos
Affected products: serenityos
CVE-2021-30046 (published 2021-04-06)
VIGRA Computer Vision Library Version-1-11-1 contains a segmentation fault vulnerability in the impex.hxx read_image_band() function, in which a crafted file can cause a denial of service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-755
Affected vendors: vigra_computer_vision_library_project
Affected products: vigra_computer_vision_library
CVE-2021-30047 (published 2023-08-22)
VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: vsftpd_project
Affected products: vsftpd
CVE-2021-30048 (published 2021-04-29)
Directory Traversal in the fileDownload function in com/java2nb/common/controller/FileController.java in Novel-plus (小说精品屋-plus) 3.5.1 allows attackers to read arbitrary files via the filePath parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
Affected vendors: novel_boutique_house-plus_project
Affected products: novel_boutique_house-plus
CVE-2021-30049 (published 2021-07-22)
SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: sysaid
Affected products: sysaid
CVE-2021-3005 (published 2021-01-03)
MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice number) value to the central/recibo.php URI.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: mk-auth
Affected products: mk-auth
CVE-2021-30055 (published 2021-04-05)
A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: eng
Affected products: knowage
CVE-2021-30056 (published 2021-04-05)
Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eng
Affected products: knowage
CVE-2021-30057 (published 2021-04-05)
A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-74
Affected vendors: eng
Affected products: knowage
CVE-2021-30058 (published 2021-04-05)
Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBI_HOST' parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eng
Affected products: knowage
CVE-2021-3006 (published 2021-01-03)
The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: seal_finance_project
Affected products: seal_finance
CVE-2021-30061 (published 2022-04-03)
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, physically proximate attackers can execute code via a crafted file on a USB stick.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: belden, schneider-electric
Affected products: eagle_20_tofino_943_987-501-tx\/tx, eagle_20_tofino_943_987-501-tx\/tx_firmware, eagle_20_tofino_943_987-502_-tx\/mm, eagle_20_tofino_943_987-502_-tx\/mm_firmware, eagle_20_tofino_943_987-504-mm\/tx, eagle_20_tofino_943_987-504-mm\/tx_firmware, eagle_20_tofino_943_987-505-mm\/mm, eagle_20_tofino_943_987-505-mm\/mm_firmware, tcsefea23f3f20, tcsefea23f3f20_firmware, tcsefea23f3f21, tcsefea23f3f21_firmware, tcsefea23f3f22, tcsefea23f3f22_firmware, tofino_argon_fa-tsa-100-tx\/tx, tofino_argon_fa-tsa-100-tx\/tx_firmware, tofino_argon_fa-tsa-220-mm\/mm, tofino_argon_fa-tsa-220-mm\/mm_firmware, tofino_argon_fa-tsa-220-mm\/tx, tofino_argon_fa-tsa-220-mm\/tx_firmware, tofino_argon_fa-tsa-220-tx\/mm, tofino_argon_fa-tsa-220-tx\/mm_firmware, tofino_argon_fa-tsa-220-tx\/tx, tofino_argon_fa-tsa-220-tx\/tx_firmware, tofino_xenon_security_appliance
CVE-2021-30062 (published 2022-04-03)
On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can bypass the OPC enforcer.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: belden, schneider-electric
Affected products: eagle_20_tofino_943_987-501-tx\/tx, eagle_20_tofino_943_987-501-tx\/tx_firmware, eagle_20_tofino_943_987-502_-tx\/mm, eagle_20_tofino_943_987-502_-tx\/mm_firmware, eagle_20_tofino_943_987-504-mm\/tx, eagle_20_tofino_943_987-504-mm\/tx_firmware, eagle_20_tofino_943_987-505-mm\/mm, eagle_20_tofino_943_987-505-mm\/mm_firmware, tcsefm0000, tcsefm0000_firmware, tofino_argon_fa-tsa-100-tx\/tx, tofino_argon_fa-tsa-100-tx\/tx_firmware, tofino_argon_fa-tsa-220-mm\/mm, tofino_argon_fa-tsa-220-mm\/mm_firmware, tofino_argon_fa-tsa-220-mm\/tx, tofino_argon_fa-tsa-220-mm\/tx_firmware, tofino_argon_fa-tsa-220-tx\/mm, tofino_argon_fa-tsa-220-tx\/mm_firmware, tofino_argon_fa-tsa-220-tx\/tx, tofino_argon_fa-tsa-220-tx\/tx_firmware, tofino_xenon_security_appliance, tofino_xenon_security_appliance_firmware
CVE-2021-30063 (published 2022-04-03)
On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can cause an OPC enforcer denial of service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: belden, schneider-electric
Affected products: eagle_20_tofino_943_987-501-tx\/tx, eagle_20_tofino_943_987-501-tx\/tx_firmware, eagle_20_tofino_943_987-502_-tx\/mm, eagle_20_tofino_943_987-502_-tx\/mm_firmware, eagle_20_tofino_943_987-504-mm\/tx, eagle_20_tofino_943_987-504-mm\/tx_firmware, eagle_20_tofino_943_987-505-mm\/mm, eagle_20_tofino_943_987-505-mm\/mm_firmware, tcsefm0000, tcsefm0000_firmware, tofino_argon_fa-tsa-100-tx\/tx, tofino_argon_fa-tsa-100-tx\/tx_firmware, tofino_argon_fa-tsa-220-mm\/mm, tofino_argon_fa-tsa-220-mm\/mm_firmware, tofino_argon_fa-tsa-220-mm\/tx, tofino_argon_fa-tsa-220-mm\/tx_firmware, tofino_argon_fa-tsa-220-tx\/mm, tofino_argon_fa-tsa-220-tx\/mm_firmware, tofino_argon_fa-tsa-220-tx\/tx, tofino_argon_fa-tsa-220-tx\/tx_firmware, tofino_xenon_security_appliance, tofino_xenon_security_appliance_firmware
CVE-2021-30064 (published 2022-04-03)
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can succeed with hardcoded default credentials (if the device is in the uncommissioned state).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: belden, schneider-electric
Affected products: eagle_20_tofino_943_987-501-tx\/tx, eagle_20_tofino_943_987-501-tx\/tx_firmware, eagle_20_tofino_943_987-502_-tx\/mm, eagle_20_tofino_943_987-502_-tx\/mm_firmware, eagle_20_tofino_943_987-504-mm\/tx, eagle_20_tofino_943_987-504-mm\/tx_firmware, eagle_20_tofino_943_987-505-mm\/mm, eagle_20_tofino_943_987-505-mm\/mm_firmware, tcsefea23f3f20, tcsefea23f3f20_firmware, tcsefea23f3f21, tcsefea23f3f21_firmware, tcsefea23f3f22, tcsefea23f3f22_firmware, tofino_argon_fa-tsa-100-tx\/tx, tofino_argon_fa-tsa-100-tx\/tx_firmware, tofino_argon_fa-tsa-220-mm\/mm, tofino_argon_fa-tsa-220-mm\/mm_firmware, tofino_argon_fa-tsa-220-mm\/tx, tofino_argon_fa-tsa-220-mm\/tx_firmware, tofino_argon_fa-tsa-220-tx\/mm, tofino_argon_fa-tsa-220-tx\/mm_firmware, tofino_argon_fa-tsa-220-tx\/tx, tofino_argon_fa-tsa-220-tx\/tx_firmware, tofino_xenon_security_appliance
CVE-2021-30065 (published 2022-04-03)
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus packets can bypass the ModBus enforcer. NOTE: this issue exists because of an incomplete fix of CVE-2017-11401.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: belden, schneider-electric
Affected products: eagle_20_tofino_943_987-501-tx\/tx, eagle_20_tofino_943_987-501-tx\/tx_firmware, eagle_20_tofino_943_987-502_-tx\/mm, eagle_20_tofino_943_987-502_-tx\/mm_firmware, eagle_20_tofino_943_987-504-mm\/tx, eagle_20_tofino_943_987-504-mm\/tx_firmware, eagle_20_tofino_943_987-505-mm\/mm, eagle_20_tofino_943_987-505-mm\/mm_firmware, tcsefea23f3f20, tcsefea23f3f20_firmware, tcsefea23f3f21, tcsefea23f3f21_firmware, tcsefea23f3f22, tcsefea23f3f22_firmware, tofino_argon_fa-tsa-100-tx\/tx, tofino_argon_fa-tsa-100-tx\/tx_firmware, tofino_argon_fa-tsa-220-mm\/mm, tofino_argon_fa-tsa-220-mm\/mm_firmware, tofino_argon_fa-tsa-220-mm\/tx, tofino_argon_fa-tsa-220-mm\/tx_firmware, tofino_argon_fa-tsa-220-tx\/mm, tofino_argon_fa-tsa-220-tx\/mm_firmware, tofino_argon_fa-tsa-220-tx\/tx, tofino_argon_fa-tsa-220-tx\/tx_firmware, tofino_xenon_security_appliance
CVE-2021-30066 (published 2022-04-03)
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification (for a USB stick) can be bypassed. NOTE: this issue exists because of an incomplete fix of CVE-2017-11400.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-347
Affected vendors: belden, schneider-electric
Affected products: eagle_20_tofino_943_987-501-tx\/tx, eagle_20_tofino_943_987-501-tx\/tx_firmware, eagle_20_tofino_943_987-502_-tx\/mm, eagle_20_tofino_943_987-502_-tx\/mm_firmware, eagle_20_tofino_943_987-504-mm\/tx, eagle_20_tofino_943_987-504-mm\/tx_firmware, eagle_20_tofino_943_987-505-mm\/mm, eagle_20_tofino_943_987-505-mm\/mm_firmware, tcsefea23f3f20, tcsefea23f3f20_firmware, tcsefea23f3f21, tcsefea23f3f21_firmware, tcsefea23f3f22, tcsefea23f3f22_firmware, tofino_argon_fa-tsa-100-tx\/tx, tofino_argon_fa-tsa-100-tx\/tx_firmware, tofino_argon_fa-tsa-220-mm\/mm, tofino_argon_fa-tsa-220-mm\/mm_firmware, tofino_argon_fa-tsa-220-mm\/tx, tofino_argon_fa-tsa-220-mm\/tx_firmware, tofino_argon_fa-tsa-220-tx\/mm, tofino_argon_fa-tsa-220-tx\/mm_firmware, tofino_argon_fa-tsa-220-tx\/tx, tofino_argon_fa-tsa-220-tx\/tx_firmware, tofino_xenon_security_appliance
CVE-2021-3007 (published 2021-01-04)
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: getlaminas, zend
Affected products: laminas-http, zend_framework
CVE-2021-30070 (published 2022-08-18)
An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: hestiacp
Affected products: hestiacp
CVE-2021-30071 (published 2022-08-18)
A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hestiacp
Affected products: control_panel
CVE-2021-30072 (published 2021-04-02)
An issue was discovered in prog.cgi on D-Link DIR-878 1.30B08 devices. Because strcat is misused, there is a stack-based buffer overflow that does not require authentication.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: dlink
Affected products: dir-878, dir-878_firmware
CVE-2021-30074 (published 2021-04-02)
docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: docsifyjs
Affected products: docsify
CVE-2021-30080 (published 2022-04-05)
An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: beego
Affected products: beego
CVE-2021-30081 (published 2021-05-24)
An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via admin/navbar.php?action=add_page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: emlog
Affected products: emlog
CVE-2021-30082 (published 2021-05-24)
An issue was discovered in Gris CMS v0.1. There is a Persistent XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via admin/dashboard.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: gris_cms_project
Affected products: gris_cms
CVE-2021-30083 (published 2021-05-24)
An issue was discovered in Mediat 1.4.1. There is a Reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML without authentication via the 'return' parameter in login.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: webfairy
Affected products: mediat
CVE-2021-30086 (published 2021-09-28)
Cross Site Scripting (XSS) vulnerability exists in KindEditor (Chinese versions) 4.1.12, which can be exploited by an attacker to obtain user cookie information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: kindsoft
Affected products: kindeditor
CVE-2021-3010 (published 2021-02-26)
There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server Version 20.3. The application allows a remote attacker to introduce arbitrary JavaScript by crafting malicious form values that are later not sanitized.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: opentext
Affected products: content_server
CVE-2021-30108 (published 2021-05-24)
Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-918
Affected vendors: feehi
Affected products: feehi_cms
CVE-2021-30109 (published 2021-04-05)
Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: froala
Affected products: froala_editor
CVE-2021-3011 (published 2021-01-07)
An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-670
Affected vendors: ftsafe, google, nxp, yubico
Affected products: 3a081, a7005a, j2a081, j2d081_m59, j2d081_m61, j2d082_m60, j2d120_m60, j2d145_m59, j2e081_m64, j2e082_m65, j2e120_m65, j2e145_m64, j3a041, j3d081_m59, j3d081_m59_df, j3d081_m61, j3d081_m61_df, j3d082_m60, j3d120_m60, j3d145_m59, j3e016_m64, j3e016_m64_df, j3e016_m66, j3e016_m66_df, j3e041_m64
CVE-2021-30110 (published 2021-07-22)
dttray.exe in Greyware Automation Products Inc Domain Time II before 5.2.b.20210331 allows remote attackers to execute arbitrary code via a URL to a malicious update in a spoofed response to the UDP query used to check for updates.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: greyware
Affected products: domain_time_ii
CVE-2021-30111 (published 2021-04-08)
A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields. An attack can inject a JavaScript code that will be stored in the page. If any visitor sees the events, then the payload will be executed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: web-school
Affected products: enterprise_resource_planning
CVE-2021-30112 (published 2021-04-08)
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student_leave_application request through module/core/studentleaveapplication/create. The application fails to validate the CSRF token for a POST request using Guardian privilege.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: web-school
Affected products: enterprise_resource_planning
CVE-2021-30113 (published 2021-04-08)
A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attacker website.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: web-school
Affected products: enterprise_resource_planning
CVE-2021-30114 (published 2021-04-08)
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment request through module/accounting/voucher/create. The application fails to validate the CSRF token for a POST request using admin privilege.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: web-school
Affected products: enterprise_resource_planning
CVE-2021-30116 (published 2021-07-09)
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: kaseya
Affected products: vsa_agent, vsa_server
Added to CISA KEV catalog: 2021-11-03
KEV required action: Apply updates per vendor instructions.
CVE-2021-30117 (published 2021-07-09)
The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: ``` GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Where the sessionId cookie value has been obtained via CVE-2021-30116. The result should be a failure. Response: ``` HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/html; Charset=Utf-8 Date: Thu, 01 Apr 2021 19:12:11 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 881 <!DOCTYPE html> <HTML> <HEAD> <title>Whoops.</title> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <link id="favIcon" rel="shortcut icon" href="/themes/default/images/favicon.ico?307447361"></link> ----SNIP---- ``` However when fldrId is set to ‘(SELECT (CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END))’ the request is allowed. Request: ``` GET /InstallTab/exportFldr.asp?fldrId=%28SELECT%20%28CASE%20WHEN%20%281%3D1%29%20THEN%201%20ELSE%20%28SELECT%201%20UNION%20SELECT%202%29%20END%29%29 HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Response: ``` HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; Charset=Utf-8 Date: Thu, 01 Apr 2021 17:33:53 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 7960 <html> <head> <title>Export Folder</title> <style> ------ SNIP ----- ```
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: kaseya
Affected products: vsa