rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-21680 
Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins project
product: Jenkins Nested View Plugin
Published: 2021-08-31T13:50:18.000Z
CVE-2021-21681 
Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Nomad Plugin
Published: 2021-08-31T13:50:20.000Z
CVE-2021-21682 
Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-10-06T22:10:11.000Z
CVE-2021-21683 
The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-10-06T22:10:13.000Z
CVE-2021-21684 
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
Affected products: vendor: Jenkins project
product: Jenkins Git Plugin
Published: 2021-10-06T22:10:14.000Z
CVE-2021-21685 
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:24.000Z
CVE-2021-21686 
File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:25.000Z
CVE-2021-21687 
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:27.000Z
CVE-2021-21688 
The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo).
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:28.000Z
CVE-2021-21689 
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:30.000Z
CVE-2021-21690 
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:32.000Z
CVE-2021-21691 
Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:33.000Z
CVE-2021-21692 
FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:35.000Z
CVE-2021-21693 
When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T00:00:00.000Z
CVE-2021-21694 
FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:38.000Z
CVE-2021-21695 
FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:40.000Z
CVE-2021-21696 
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:41.000Z
CVE-2021-21697 
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2021-11-04T16:30:43.000Z
CVE-2021-21698 
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
Affected products: vendor: Jenkins project
product: Jenkins Subversion Plugin
Published: 2021-11-04T16:30:44.000Z
CVE-2021-21699 
Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Active Choices Plugin
Published: 2021-11-12T10:35:15.000Z
CVE-2021-21700 
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by exploitable by attackers able to create Scriptler scripts.
Affected products: vendor: Jenkins project
product: Jenkins Scriptler Plugin
Published: 2021-11-12T10:35:17.000Z
CVE-2021-21701 
Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins project
product: Jenkins Performance Plugin
Published: 2021-11-12T10:35:18.000Z
CVE-2021-21702 Null Dereference in SoapClient
In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Reported by jgalindo at datto dot com
Published: 2021-02-15T04:10:16.837Z
CVE-2021-21703 PHP-FPM memory access in root process leading to privilege escalation
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Reported by Charles Fol
Published: 2021-10-25T05:40:08.576Z
CVE-2021-21704 Multiple vulnerabilities in Firebird client extension
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: reported by trichimtrich at gmail dot com
Published: 2021-10-04T04:00:13.838Z
CVE-2021-21705 Incorrect URL validation in FILTER_VALIDATE_URL
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: reported by vi at hackberry dot xyz
Published: 2021-10-04T04:00:15.654Z
CVE-2021-21706 ZipArchive::extractTo may extract outside of destination dir
In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: reported by vi at hackberry dot xyz
Published: 2021-10-04T04:00:17.182Z
CVE-2021-21707 Special characters break path parsing in XML functions
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
Problem types: cwe_id: CWE-159
description: CWE-159 Failure to Sanitize Special Element
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Reported by rawataman6525 at gmail dot com
Published: 2021-11-29T06:25:08.814Z
CVE-2021-21708 UAF due to php_filter_float() failing
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: dukk at softdev dot online
Published: 2022-02-27T08:00:12.018Z
CVE-2021-21722 
A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulnerability to obtain sensitive user information for further information detection and attacks. This affects: ZXV10 B860A V2.1-T_V0032.1.1.04_jiangsuTelecom.
Problem types: description: information leak
Affected products: vendor: n/a
product: ZXV10 B860A
Published: 2021-01-14T15:57:48.000Z
CVE-2021-21723 
Some ZTE products have a DoS vulnerability. Due to the improper handling of memory release in some specific scenarios, a remote attacker can trigger the vulnerability by performing a series of operations, resulting in memory leak, which may eventually lead to device denial of service. This affects: ZXR10 9904, ZXR10 9908, ZXR10 9916, ZXR10 9904-S, ZXR10 9908-S; all versions up to V1.01.10.B12.
Problem types: description: DoS
Affected products: vendor: n/a
product: <ZXR10 9904, ZXR10 9908, ZXR10 9916, ZXR10 9904-S, ZXR10 9908-S>
Published: 2021-01-21T19:05:49.000Z
CVE-2021-21724 
A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scenarios, a local attacker with device permissions repeatedly attenuated the optical signal to cause memory leak and abnormal service. This affects: ZXR10 8900E, all versions up to V3.03.20R2B30P1.
Problem types: description: Memory Leak
Affected products: vendor: n/a
product: ZXR10 8900E
Published: 2021-02-26T02:37:07.000Z
CVE-2021-21725 
A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in other directories by performing specific operations, resulting in information leak. This affects: ZXHN H196Q V9.1.0C2.
Problem types: description: Information Leak
Affected products: vendor: n/a
product: ZXHN H196Q
Published: 2021-03-05T16:53:08.000Z
CVE-2021-21726 
Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some parameters input by users, an attacker with high privileges can cause process exception by repeatedly inputting illegal parameters. This affects:<ZXONE 9700 , ZXONE 8700, ZXONE 19700><V1.40.021.021CP049, V1.0P02B219_@NCPM-RELEASE_2.40R1-20200914.set>
Problem types: description: input verification
Affected products: vendor: n/a
product: <ZXONE 9700 , ZXONE 8700, ZXONE 19700>
Published: 2021-03-12T18:05:34.000Z
CVE-2021-21727 
A ZTE product has a DoS vulnerability. A remote attacker can amplify traffic by sending carefully constructed IPv6 packets to the affected devices, which eventually leads to device denial of service. This affects:<ZXHN F623><All versions up to V6.0.0P3T33>
Problem types: description: DoS
Affected products: vendor: n/a
product: <ZXHN F623>
Published: 2021-03-29T15:41:42.000Z
CVE-2021-21728 
A ZTE product has a configuration error vulnerability. Because a certain port is open by default, an attacker can consume system processing resources by flushing a large number of packets to the port, and successfully exploiting this vulnerability could reduce system processing capabilities. This affects: ZXA10 C300M all versions up to V4.3P8.
Problem types: description: configuration error
Affected products: vendor: n/a
product: ZXA10 C300M
Published: 2021-04-09T17:23:32.000Z
CVE-2021-21729 
Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H108N V2.5.5_BTMT1
Problem types: description: CSRF
Affected products: vendor: n/a
product: ZXHN H168N,ZXHN H108N
Published: 2021-04-13T15:13:26.000Z
CVE-2021-21730 
A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This affects: ZXHN H168N V3.5.0_TY.T6
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: ZXHN H168N
Published: 2021-04-13T15:08:08.000Z
CVE-2021-21731 
A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the request comes from a trusted user. The attacker could submit a malicious request to the affected device to delete the data. This affects: ZXCLOUD iRAI All versions up to KVM-ProductV6.03.04
Problem types: description: CSRF
Affected products: vendor: n/a
product: ZXCLOUD iRAI
Published: 2021-04-13T15:05:19.000Z
CVE-2021-21732 
A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications can read some files in the proc file system without authorization. Attackers could exploit this vulnerability to obtain sensitive information. This affects Axon 11 5G ZTE/CN_P725A12/P725A12:10/QKQ1.200816.002/20201116.175317:user/release-keys.
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: <Axon 11 5G>
Published: 2021-05-19T10:48:50.000Z
CVE-2021-21733 
The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the information returned by the program, and then obtain some sensitive information. This affects ZXCDN V7.01 all versions up to IAMV7.01.01.02.
Problem types: description: Information Leak
Affected products: vendor: n/a
product: <ZXCDN V7.01>
Published: 2021-05-19T11:00:58.000Z
CVE-2021-21734 
Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON MDU device ZXA10 F821 V1.7.0P3T22, ZXA10 F822 V1.4.3T6, ZXA10 F819 V1.2.1T5, ZXA10 F832 V1.1.1T7, ZXA10 F839 V1.1.0T8, ZXA10 F809 V3.2.1T1, ZXA10 F822P V1.1.1T7, ZXA10 F832 V2.00.00.01
Problem types: description: cryptographic issues
Affected products: vendor: n/a
product: ZTE PON MDU devices
Published: 2021-05-28T11:45:42.000Z
CVE-2021-21735 
A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.
Problem types: description: information leak
Affected products: vendor: n/a
product: ZXHN H168N
Published: 2021-06-10T11:18:23.000Z
CVE-2021-21736 
A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E
Problem types: description: information leak
Affected products: vendor: n/a
product: ZXHN HS562
Published: 2021-06-10T11:28:57.000Z
CVE-2021-21737 
A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system application, attackers could use this vulnerability to tamper with the system desktop and affect system customization functions. This affects: ZXV10 B860H V5.0, V83011303.0010, V83011303.0016
Problem types: description: permission and access control
Affected products: vendor: n/a
product: ZXV10 B860H V5.0
Published: 2021-06-24T10:39:42.000Z
CVE-2021-21738 
ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the attacker could implement XSS attacks by tampering with the parameters, to affect the operations of valid users. This affects: <ZXIPTV><ZXIPTV-EAS_PV5.06.04.09>
Problem types: description: XSS
Affected products: vendor: n/a
product: <ZXIPTV>
Published: 2021-08-05T19:49:37.000Z
CVE-2021-21739 
A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data reliability, attackers could replace an authenticated optical module on the equipment with an unauthenticated one, bypassing system authentication and detection, thus affecting signal transmission. This affects: <ZXCTN 6120H><V5.10.00B24>
Problem types: description: Insufficient Verification of Data reliability
Affected products: vendor: n/a
product: <ZXCTN 6120H>
Published: 2021-08-05T19:48:41.000Z
CVE-2021-21740 
There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert the USB disk with the symbolic link into the residential gateway, and access unauthorized directory information through the symbolic link, causing information leak.
Problem types: description: information leak
Affected products: vendor: n/a
product: ZXHN H2640
Published: 2021-08-09T15:30:12.000Z
CVE-2021-21741 
There is a command execution vulnerability in a ZTE conference management system. As some services are enabled by default, the attacker could exploit this vulnerability to execute arbitrary commands by sending specific serialization command.
Problem types: description: command execution
Affected products: vendor: n/a
product: ZXV10 M910
Published: 2021-08-30T00:00:00.000Z
CVE-2021-21742 
There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages.
Problem types: description: Information Leak
Affected products: vendor: n/a
product: ZTE Axon 30 Pro Message Service App
Published: 2021-09-24T23:16:33.000Z
CVE-2021-21743 
ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP response header information through a specially crafted HTTP request.
Problem types: description: CRLF injection
Affected products: vendor: n/a
product: MF971R
Published: 2021-10-20T15:19:32.000Z