rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-27643 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-06-09T13:31:46.000Z
CVE-2021-27644 DolphinScheduler mysql jdbc connector parameters deserialize remote code execution
In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: Apache Software Foundation
product: Apache DolphinScheduler
Credits: lang: en
value: This issue was discovered by Jinchen Sheng of Ant FG Security Lab
Published: 2021-11-01T09:15:10.000Z
CVE-2021-27645 
The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-24T00:00:00.000Z
CVE-2021-27646 
Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Synology
product: Synology DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-03-12T06:45:13.026Z
CVE-2021-27647 
Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Synology
product: Synology DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-03-12T06:35:11.865Z
CVE-2021-27648 
Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote authenticated users to obtain privilege via unspecified vectors.
Problem types: cwe_id: CWE-610
description: CWE-610: Externally Controlled Reference to a Resource in Another Sphere
Affected products: vendor: Synology
product: Synology Antivirus Essential
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-04-28T07:25:14.326Z
CVE-2021-27649 
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-06-23T09:50:17.135Z
CVE-2021-27651 
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Pegasystems
product: Pega Infinity
Credits: lang: en
value: Samuel Curry (@samwcyo), Brett Buerhaus (@bbuerhaus), Maik Robert (@xEHLE_), Justin Rhinehart (@sshell_)
Published: 2021-04-29T14:47:20.000Z
CVE-2021-27653 
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Pega Systems
product: Pega Infinity
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sakura Samurai Robert Willis, Aubrey Cottle, Jackson Henry, and John Jackson,  Collaborator Break3r
Published: 2021-04-01T18:38:57.721Z
CVE-2021-27654 
Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.
Problem types: cwe_id: CWE-640
description: CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Affected products: vendor: Pegasystems
product: Pega Infinity
Published: 2022-01-28T19:09:31.000Z
CVE-2021-27656 exacqVision Web Services - Information Exposure
A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system.
Problem types: description: CWE 200 : Information Exposure
Affected products: vendor: Johnson Controls
product: exacqVision Web Service version 20.12.2.0 and prior
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Milan Kyselica reported this vulnerability to Johnson Controls, Inc.
Published: 2021-03-18T17:58:41.745Z
CVE-2021-27657 Metasys Improper Privilege Management
Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Johnson Controls
product: Metasys
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jakub Palaczynski
Published: 2021-06-04T14:07:39.073Z
CVE-2021-27658 exacqVision Enterprise Manager CSS
exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Johnson Controls
product: exacqVision Enterprise Manager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Milan Kyselica, Roman Stevanak
Published: 2021-06-24T13:49:27.039Z
CVE-2021-27659 exacqVision Web Service CSS
exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Johnson Controls
product: exacqVision Web Service
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Milan Kyselica, Roman Stevanak
Published: 2021-06-24T13:59:12.883Z
CVE-2021-27660 C-CURE 9000
An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Johnson Controls
product: C-CURE 9000
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-07-01T13:36:44.607Z
CVE-2021-27661 Facility Explorer
Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Johnson Controls
product: Facility Explorer SNC Series Supervisory Controllers (F4-SNC)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-07-01T13:41:58.835Z
CVE-2021-27662 KT-1 Capture-replay
The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01
Problem types: cwe_id: CWE-294
description: CWE-294: Authentication Bypass by Capture-replay
Affected products: vendor: Johnson Controls
product: KT-1
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Credits: lang: en
value: Dr. Dave Burke
lang: en
value: Anthony Connor
lang: en
value: Harrison Spisak
Published: 2021-09-15T12:04:22.918Z
CVE-2021-27663 CEM Systems AC2000
A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Johnson Controls
product: CEM Systems AC2000
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2021-08-30T16:37:41.273Z
CVE-2021-27664 exacqVision Web Service
Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Johnson Controls
product: exacqVision Web Service
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tenable Research
Published: 2021-10-11T15:21:08.472Z
CVE-2021-27665 exacqVision Server 32-bit
An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: Johnson Controls
product: exacqVision Web Service
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Tenable Research
Published: 2021-10-11T15:26:09.316Z
CVE-2021-27668 
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T17:01:43.000Z
CVE-2021-27670 
Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-25T00:01:31.000Z
CVE-2021-27671 
An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-25T00:33:48.000Z
CVE-2021-27672 
SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-15T13:51:32.000Z
CVE-2021-27673 
Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-15T13:51:40.000Z
CVE-2021-27676 
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T10:20:38.000Z
CVE-2021-27677 
Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-11T16:22:57.000Z
CVE-2021-27678 
Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-11T16:23:07.000Z
CVE-2021-27679 
Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-11T16:23:14.000Z
CVE-2021-27691 
Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This occurs because the "formSetDebugCfg" function executes glibc's system function with untrusted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-15T23:14:46.000Z
CVE-2021-27692 
Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the "doSystemCmd" function with untrusted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-15T23:14:32.000Z
CVE-2021-27693 
Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-02T17:33:43.000Z
CVE-2021-27695 
Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-15T16:08:36.000Z
CVE-2021-27697 
RIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl/gnrc_rpl_validation.c through the gnrc_rpl_validation_options() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T12:07:53.000Z
CVE-2021-27698 
RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc_rpl_control_messages.c through the _parse_options() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T12:08:15.000Z
CVE-2021-27700 
SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dashboard and perform actions like modify user, delete user, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-12T00:00:00.000Z
CVE-2021-27701 
SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery (CSRF) via the Socifi wifi portal. The application does not contain a CSRF token and request validation. An attacker can Add/Modify any random user data by sending a crafted CSRF request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-12T00:00:00.000Z
CVE-2021-27702 
Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-12T00:00:00.000Z
CVE-2021-27703 
Sercomm Model Etisalat Model S3- AC2100 is affected by Cross Site Scripting (XSS) via the firmware update page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-12T00:00:00.000Z
CVE-2021-27704 
Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-12T00:00:00.000Z
CVE-2021-27705 
Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"qosIndex "request. This occurs because the "formQOSRuleDel" function directly passes the parameter "qosIndex" to strcpy without limit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T14:52:09.000Z
CVE-2021-27706 
Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"IPMacBindIndex "request. This occurs because the "formIPMacBindDel" function directly passes the parameter "IPMacBindIndex" to strcpy without limit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T14:55:39.000Z
CVE-2021-27707 
Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"portMappingIndex "request. This occurs because the "formDelPortMapping" function directly passes the parameter "portMappingIndex" to strcpy without limit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T15:00:05.000Z
CVE-2021-27708 
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "command" parameter is directly passed to the attacker, allowing them to control the "command" field to attack the OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T15:01:49.000Z
CVE-2021-27710 
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "ip" parameter is directly passed to the attacker, allowing them to control the "ip" field to attack the OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T17:07:11.000Z
CVE-2021-27715 
An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitrary code via crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-08T00:00:00.000Z
CVE-2021-27722 
An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5. The program can be crashed by entering 300 bytes char data into the "Key" or "Name" field while registering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-02T10:44:26.000Z
CVE-2021-27730 
Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA_9_12_444 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-02T01:03:03.000Z
CVE-2021-27731 
Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-02T01:00:48.000Z
CVE-2021-27733 
In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T11:35:36.000Z