rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-20799 
Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2021-10-13T08:30:53.000Z
CVE-2021-20800 
Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2021-10-13T08:30:55.000Z
CVE-2021-20801 
Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Firefox.
Problem types: description: XML external entities (XXE)
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2021-10-13T08:30:57.000Z
CVE-2021-20802 
HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product.
Problem types: description: HTTP header injection
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2021-10-13T08:30:58.000Z
CVE-2021-20803 
Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the management screen.
Problem types: description: Access controls issue
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2021-10-13T08:31:00.000Z
CVE-2021-20804 
Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to cause a denial of service (DoS) condition via unspecified vectors.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2021-10-13T08:31:01.000Z
CVE-2021-20805 
Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.7 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2021-10-13T08:31:03.000Z
CVE-2021-20806 
Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: Open Redirect
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2021-10-13T08:31:04.000Z
CVE-2021-20807 
Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.0.0 to 3.1.9 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2021-10-13T08:31:06.000Z
CVE-2021-20808 
Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-08-26T01:20:32.000Z
CVE-2021-20809 
Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-08-26T01:20:35.000Z
CVE-2021-20810 
Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-08-26T01:20:38.000Z
CVE-2021-20811 
Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-08-26T01:20:39.000Z
CVE-2021-20812 
Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-08-26T01:20:41.000Z
CVE-2021-20813 
Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) and Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series)) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-08-26T01:20:42.000Z
CVE-2021-20814 
Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), and Movable Type Premium 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-08-26T01:20:44.000Z
CVE-2021-20815 
Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-08-26T01:20:46.000Z
CVE-2021-20825 
Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: shiro8 Co., Ltd.
product: List (order management) item change plug-in (for EC-CUBE 3.0 series)
Published: 2021-09-17T01:40:26.000Z
CVE-2021-20826 
Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from the communication between the PLC and the software. As a result, the complete access privileges to the PLC Web server may be obtained, and manipulation of the PLC output and/or suspension of the PLC may be conducted.
Problem types: description: Unprotected transport of credentials
Affected products: vendor: IDEC Corporation
product: IDEC PLC
Published: 2021-12-24T06:30:26.000Z
CVE-2021-20827 
Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the attacker may access the PLC Web server and hijack the PLC, and manipulation of the PLC output and/or suspension of the PLC may be conducted.
Problem types: description: Plaintext storage of a password
Affected products: vendor: IDEC Corporation
product: IDEC PLC
Published: 2021-12-24T06:30:27.000Z
CVE-2021-20828 
Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a remote attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: ActiveFusions Co., Ltd.
product: Order Status Batch Change Plug-in (for EC-CUBE 3.0 series)
Published: 2021-09-17T01:40:28.000Z
CVE-2021-20829 
Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2021-09-21T09:25:10.000Z
CVE-2021-20831 
Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of administrators and unintended operation may be performed via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: Mario Valney
product: OG Tags
Published: 2021-10-13T08:31:07.000Z
CVE-2021-20832 
InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510) contain a vulnerability which may lead to information disclosure only when it works with the body composition analyzer InBody Dial. This may allow an attacker who can connect to the InBody Dial with InBody App may obtain a victim's measurement result measured by InBody Dial.
Problem types: description: Information Disclosure
Affected products: vendor: InBody Japan Inc.
product: InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510)
Published: 2021-10-13T08:31:09.000Z
CVE-2021-20833 
The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle attackers to eavesdrop on and/or alter encrypted communication via a crafted certificate.
Problem types: description: Improper server certificate verification
Affected products: vendor: SODA, Inc.
product: SNKRDUNK Market Place App for iOS
Published: 2021-10-13T08:31:11.000Z
CVE-2021-20834 
Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2.177.1 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.
Problem types: description: Improper Authorization in Handler for Custom URL Scheme
Affected products: vendor: Nike, Inc.
product: Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2.177.1
Published: 2021-10-13T08:31:12.000Z
CVE-2021-20835 
Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version) versions prior to 4.49.1 allows a remote attacker to lead a user to access an arbitrary website and the website launches an arbitrary Activity of the app via the vulnerable App, which may result in Mercari account's access token being obtained.
Problem types: description: Improper Authorization in Handler for Custom URL Scheme
Affected products: vendor: Mercari, Inc.
product: Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version)
Published: 2021-11-24T08:25:38.000Z
CVE-2021-20836 
Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16 allows an attacker with administrative privileges to cause information disclosure and/or arbitrary code execution by opening a specially crafted SCS project files.
Problem types: description: Out-of-bounds Read
Affected products: vendor: OMRON Corporation
product: OMRON CX-Supervisor
Published: 2021-10-19T02:00:22.000Z
CVE-2021-20837 
Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
Problem types: description: OS Command Injection
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-10-26T05:15:12.000Z
CVE-2021-20838 
Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition by processing a specially crafted XML document.
Problem types: description: XML external entities (XXE)
Affected products: vendor: Antenna House, Inc.
product: Office Server Document Converter
Published: 2021-11-01T01:50:14.000Z
CVE-2021-20839 
Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition to the other servers by processing a specially crafted XML document.
Problem types: description: XML external entities (XXE)
Affected products: vendor: Antenna House, Inc.
product: Office Server Document Converter
Published: 2021-11-01T01:50:16.000Z
CVE-2021-20840 
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Saasproject
product: Booking Package - Appointment Booking Calendar System
Published: 2021-11-24T08:25:40.000Z
CVE-2021-20841 
Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: EC-CUBE CO.,LTD.
product: EC-CUBE 2 series
Published: 2021-11-24T08:25:41.000Z
CVE-2021-20842 
Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page.
Problem types: description: Cross-site request forgery
Affected products: vendor: EC-CUBE CO.,LTD.
product: EC-CUBE 2 series
Published: 2021-11-24T08:25:42.000Z
CVE-2021-20843 
Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to alter the settings of the product via a specially crafted web page.
Problem types: description: Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: Yamaha Corporation
product: RTX830, NVR510, NVR700W, RTX1210
Published: 2021-11-24T08:25:44.000Z
CVE-2021-20844 
Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.
Problem types: description: Improper Neutralization of HTTP Headers for Scripting Syntax
Affected products: vendor: Yamaha Corporation
product: RTX830, NVR510, NVR700W, RTX1210
Published: 2021-11-24T08:25:45.000Z
CVE-2021-20845 
Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operation via a specially crafted web page.
Problem types: description: Cross-site request forgery
Affected products: vendor: XML-Sitemaps
product: Unlimited Sitemap Generator
Published: 2021-11-24T08:25:47.000Z
CVE-2021-20846 
Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker to hijack the authentication of an administrator and conduct an arbitrary operation via a specially crafted web page.
Problem types: description: Cross-site request forgery
Affected products: vendor: Delite Studio
product: Push Notifications for WordPress (Lite)
Published: 2021-11-24T08:25:48.000Z
CVE-2021-20847 
Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device.
Problem types: description: Cross-site scripting
Affected products: vendor: NTT DOCOMO, INC.
product: Wi-Fi STATION SH-52A
Published: 2021-12-01T02:15:37.000Z
CVE-2021-20848 
Cross-site scripting vulnerability in rwtxt versions prior to v1.8.6 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Zack Scholl
product: rwtxt
Published: 2021-11-24T08:25:50.000Z
CVE-2021-20850 
PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remote attacker to execute an arbitrary OS command via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: Alfasado Inc.
product: PowerCMS XMLRPC API
Published: 2021-11-24T08:25:51.000Z
CVE-2021-20851 
Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: Aftab Muni
product: Browser and Operating System Finder
Published: 2021-12-01T02:15:39.000Z
CVE-2021-20852 
Buffer overflow vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator privilege to execute an arbitrary OS command via unspecified vectors.
Problem types: description: Buffer Overflow
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN routers
Published: 2021-12-01T02:15:40.000Z
CVE-2021-20853 
ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator privilege to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN routers
Published: 2021-12-01T02:15:41.000Z
CVE-2021-20854 
ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator privilege to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN routers
Published: 2021-12-01T02:15:44.000Z
CVE-2021-20855 
Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN routers
Published: 2021-12-01T02:15:46.000Z
CVE-2021-20856 
Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN routers
Published: 2021-12-01T02:15:47.000Z
CVE-2021-20857 
Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN router
Published: 2021-12-01T02:15:49.000Z
CVE-2021-20858 
Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN router
Published: 2021-12-01T02:15:51.000Z
CVE-2021-20859 
ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent authenticated attacker to execute an arbitrary OS command via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN routers
Published: 2021-12-01T02:15:52.000Z