deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-23261
Published: 2021-12-02
Description: Authenticated administrators may override the system configuration file and cause a denial of service.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-703
References: https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]; https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2021-23262
Published: 2021-12-02
Description: Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-913, CWE-913
References: https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]; https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2021-23263
Published: 2021-12-02
Description: Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-402, CWE-668
References: https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]; https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2021-23264
Published: 2021-12-02
Description: Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
CVSS Score: 8.1 (HIGH)
CWE: CWE-402, CWE-668, CWE-668
References: https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]; https://docs.craftercms.org/en/3.1/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2021-3944
Published: 2021-12-02
Description: bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/bookstackapp/bookstack/commit/88e6f93abf54192a69cc8080e0dc6516ee68ccbb; https://huntr.dev/bounties/65551490-5ade-49aa-8b8d-274c2ca9fdc9; https://github.com/bookstackapp/bookstack/commit/88e6f93abf54192a69cc8080e0dc6516ee68ccbb
CVE: CVE-2021-44518
Published: 2021-12-02
Description: An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing code before each operation (lock or unlock) activated via the companion app. The code is sent unencrypted, allowing any attacker with the same app (either Android or iOS) to add the lock and take complete control. For successful exploitation, the attacker must be able to touch the lock's power button, and must be able to capture BLE network communication.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-319
References: https://ashallen.net/the-egeetouch-tsa-smart-lock-is-anything-but; https://ashallen.net/the-egeetouch-tsa-smart-lock-is-anything-but
CVE: CVE-2015-20105
Published: 2021-12-02
Description: The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-352
References: https://packetstormsecurity.com/files/131814/; https://seclists.org/bugtraq/2015/May/45; https://wpscan.com/vulnerability/2bc3af7e-5542-40c4-8141-7c49e8df68f0
CVE: CVE-2015-20106
Published: 2021-12-02
Description: The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/907792c4-3384-4351-bb75-0ad10f65fbe1; https://wpscan.com/vulnerability/907792c4-3384-4351-bb75-0ad10f65fbe1
CVE: CVE-2021-43795
Published: 2021-12-02
Description: Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284; https://github.com/line/armeria/pull/3855; https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv
CVE: CVE-2021-40333
Published: 2021-12-02
Description: Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000062&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000069&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000062&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-40334
Published: 2021-12-02
Description: Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker that exploits the vulnerability by activating SSH on port TCP 5558 to cause disruption to the NMS and NE communication. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A.
CVSS Score: 8.6 (HIGH)
CWE: CWE-431
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000062&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000069&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000062&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-44050
Published: 2021-12-02
Description: CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that could potentially allow an authenticated user to access sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2021/Dec/0; https://support.broadcom.com/external/content/security-advisories/CA20211201-01-Security-Notice-for-CA-Network-Flow-Analysis/19689; http://seclists.org/fulldisclosure/2021/Dec/0
CVE: CVE-2021-43327
Published: 2021-12-02
Description: An issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can extract the security ID key from the device. Then, the protected firmware can be extracted.
CVSS Score: 4.6 (MEDIUM)
References: https://www.collshade.fr/articles/reneshack/rx_glitch_article.html; https://www.collshade.fr/articles/reneshack/rx_glitch_article.html
CVE: CVE-2020-36129
Published: 2021-12-02
Description: AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/aomedia/issues/detail?id=2912&q=&can=1; https://security.gentoo.org/glsa/202401-32; https://bugs.chromium.org/p/aomedia/issues/detail?id=2912&q=&can=1
CVE: CVE-2020-36130
Published: 2021-12-02
Description: AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugs.chromium.org/p/aomedia/issues/detail?id=2905&q=&can=1; https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html; https://security.gentoo.org/glsa/202401-32
CVE: CVE-2020-36131
Published: 2021-12-02
Description: AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/aomedia/issues/detail?id=2911&q=&can=1; https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html; https://security.gentoo.org/glsa/202401-32
CVE: CVE-2020-36133
Published: 2021-12-02
Description: AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://bugs.chromium.org/p/aomedia/issues/detail?id=2913&q=&can=1; https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html; https://security.gentoo.org/glsa/202401-32
CVE: CVE-2020-36134
Published: 2021-12-02
Description: AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugs.chromium.org/p/aomedia/issues/detail?id=2914; https://security.gentoo.org/glsa/202401-32; https://bugs.chromium.org/p/aomedia/issues/detail?id=2914
CVE: CVE-2020-36135
Published: 2021-12-02
Description: AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugs.chromium.org/p/aomedia/issues/detail?id=2910&q=&can=1; https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html; https://security.gentoo.org/glsa/202401-32
CVE: CVE-2021-28236
Published: 2021-12-02
Description: LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/LibreDWG/libredwg/issues/324; https://github.com/LibreDWG/libredwg/issues/324
CVE: CVE-2021-28237
Published: 2021-12-02
Description: LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/LibreDWG/libredwg/issues/325; https://github.com/LibreDWG/libredwg/issues/325
CVE: CVE-2020-29176
Published: 2021-12-02
Description: An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://github.com/H9dawn/cve; https://github.com/H9dawn/cve
CVE: CVE-2020-29177
Published: 2021-12-02
Description: Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/H9dawn/cve; https://github.com/H9dawn/cve
CVE: CVE-2021-25783
Published: 2021-12-02
Description: Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/taogogo/taocms/issues/5; https://github.com/taogogo/taocms/issues/5
CVE: CVE-2021-25784
Published: 2021-12-02
Description: Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/taogogo/taocms/issues/4; https://github.com/taogogo/taocms/issues/4
CVE: CVE-2021-25785
Published: 2021-12-02
Description: Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/taogogo/taocms/issues/3; https://github.com/taogogo/taocms/issues/3
CVE: CVE-2021-43772
Published: 2021-12-03
Description: Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be modified without any detection.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-552
References: https://helpcenter.trendmicro.com/en-us/article/tmka-10855; https://helpcenter.trendmicro.com/en-us/article/tmka-10855
CVE: CVE-2021-44019
Published: 2021-12-03
Description: An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44020 and 44021.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/solution/000289230; https://www.zerodayinitiative.com/advisories/ZDI-21-1364/; https://success.trendmicro.com/solution/000289230
CVE: CVE-2021-44020
Published: 2021-12-03
Description: An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44019 and 44021.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/solution/000289230; https://www.zerodayinitiative.com/advisories/ZDI-21-1365/; https://success.trendmicro.com/solution/000289230
CVE: CVE-2021-44021
Published: 2021-12-03
Description: An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44019 and 44020.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/solution/000289230; https://www.zerodayinitiative.com/advisories/ZDI-21-1366/; https://success.trendmicro.com/solution/000289230
CVE: CVE-2021-44022
Published: 2021-12-03
Description: A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading to a denial-of-service (DoS). Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://success.trendmicro.com/solution/000289229; https://success.trendmicro.com/solution/000289229
CVE: CVE-2021-4000
Published: 2021-12-03
Description: showdoc is vulnerable to URL Redirection to Untrusted Site
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/star7th/showdoc/commit/c7f10033eba5f2b5a537f9af9ba2379138e67138; https://huntr.dev/bounties/e4d803e0-3104-432c-80b3-34bc453c8962; https://github.com/star7th/showdoc/commit/c7f10033eba5f2b5a537f9af9ba2379138e67138
CVE: CVE-2021-43673
Published: 2021-12-03
Description: dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of the exit function is printed for the user via exit(json_encode($return)).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zyx0814/dzzoffice/issues/188; https://github.com/zyx0814/dzzoffice/issues/188
CVE: CVE-2021-43674
Published: 2021-12-03
Description: ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/ThinkUpLLC/ThinkUp/issues/2289; https://github.com/ThinkUpLLC/ThinkUp/issues/2289
CVE: CVE-2021-44278
Published: 2021-12-03
Description: Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/librenms/librenms/pull/13554; https://github.com/librenms/librenms/pull/13554
CVE: CVE-2021-43676
Published: 2021-12-03
Description: matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/matyhtf/framework/issues/206; https://github.com/matyhtf/framework/issues/206
CVE: CVE-2021-3980
Published: 2021-12-03
Description: elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://github.com/elgg/elgg/commit/572d210e2392f1fdf47ff2f38665372a6535c126; https://huntr.dev/bounties/1f43f11e-4bd8-451f-a244-dc9541cdc0ac; https://github.com/elgg/elgg/commit/572d210e2392f1fdf47ff2f38665372a6535c126
CVE: CVE-2021-43991
Published: 2021-12-03
Description: The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://appcheck-ng.com/persistent-xss-kentico-cms/; https://appcheck-ng.com/persistent-xss-kentico-cms/
CVE: CVE-2021-20470
Published: 2021-12-03
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196939; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6520510
CVE: CVE-2021-20493
Published: 2021-12-03
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197794.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197794; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6520510
CVE: CVE-2021-29716
Published: 2021-12-03
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user should only be allowed to view. IBM X-Force ID: 201087.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201087; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6520510
CVE: CVE-2021-29719
Published: 2021-12-03
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 could be vulnerable to client side vulnerabilties due to a web response specifying an incorrect content type. IBM X-Force ID: 201091
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201091; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6520510
CVE: CVE-2021-29756
Published: 2021-12-03
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 202167.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202167; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6520510
CVE: CVE-2021-29867
Published: 2021-12-03
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID: 206212.
CVSS Score: 5.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/206212; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6520510
CVE: CVE-2021-38909
Published: 2021-12-03
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209706.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209706; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6520510
CVE: CVE-2021-44347
Published: 2021-12-03
Description: SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/yeyinshi/tuzicms/issues/7; https://github.com/yeyinshi/tuzicms/issues/7
CVE: CVE-2021-44352
Published: 2021-12-03
Description: A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18_multi device via the list parameter in a post request in goform/SetIpMacBind.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/zhlu32/cve/blob/main/tenda/Tenda-ac15-buffer-overflow.md; https://github.com/zhlu32/cve/blob/main/tenda/Tenda-ac15-buffer-overflow.md
CVE: CVE-2021-23562
Published: 2021-12-03
Description: This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-434
References: https://github.com/moxiecode/plupload/blob/master/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226; https://github.com/moxiecode/plupload/commit/d12175d4b5fa799b994ee1bb17bfbeec55b386fb; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2306665
CVE: CVE-2021-23758
Published: 2021-12-03
Description: All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html; https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57; https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971
CVE: CVE-2021-35344
Published: 2021-12-03
Description: tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/justdan96/tsMuxer/issues/432; https://github.com/justdan96/tsMuxer/pull/439/commits/3a889a37b5b74a45025aca13ebda394b8f706ef3; https://github.com/justdan96/tsMuxer/issues/432
CVE: CVE-2021-35346
Published: 2021-12-03
Description: tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::short_term_ref_pic_set(int) in hevc.cpp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/justdan96/tsMuxer/issues/436; https://github.com/justdan96/tsMuxer/pull/422/files; https://github.com/justdan96/tsMuxer/issues/436
CVE: CVE-2021-44348
Published: 2021-12-03
Description: SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/yeyinshi/tuzicms/issues/9; https://github.com/yeyinshi/tuzicms/issues/9
CVE: CVE-2021-44349
Published: 2021-12-03
Description: SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/yeyinshi/tuzicms/issues/8; https://github.com/yeyinshi/tuzicms/issues/8