rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-20646 
Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started.
Problem types: description: Cross-site request forgery
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-300FEBK-A
Published: 2021-02-12T06:15:48.000Z
CVE-2021-20647 
Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started.
Problem types: description: Cross-site request forgery
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-300FEBK-S
Published: 2021-02-12T06:15:49.000Z
CVE-2021-20648 
ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-300FEBK-S
Published: 2021-02-12T06:15:50.000Z
CVE-2021-20649 
ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication response. As a result, an arbitrary OS command may be executed on the affected device.
Problem types: description: Improper certificate validation
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-300FEBK-S
Published: 2021-02-12T06:15:50.000Z
CVE-2021-20650 
Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started.
Problem types: description: Cross-site request forgery
Affected products: vendor: ELECOM CO.,LTD.
product: NCC-EWF100RMWH2
Published: 2021-02-12T06:15:51.000Z
CVE-2021-20651 
Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an existing file in a directory which can be accessed with the application privileges via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM File Manager
Published: 2021-02-12T06:15:52.000Z
CVE-2021-20652 
Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: J. Peters
product: Name Directory
Published: 2021-02-05T09:35:23.000Z
CVE-2021-20653 
Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: NEC Platforms, Ltd.
product: Calsos CSDJ
Published: 2021-02-17T02:05:29.000Z
CVE-2021-20654 
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting. This is named 'Fieldbleed' in the vendor's site.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-Site Scripting
Affected products: vendor: Wekan Team
product: Wekan
Published: 2021-02-10T08:50:14.000Z
CVE-2021-20655 
FileZen (V3.0.0 to V4.2.7 and V5.0.0 to V5.0.2) allows a remote attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: Soliton Systems K.K.
product: FileZen
Published: 2021-02-17T02:05:30.000Z
CVE-2021-20656 
Exposure of information through directory listing in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain the information inside the system, such as directories and/or file configurations via unspecified vectors.
Problem types: description: Exposure of information through directory listing
Affected products: vendor: Contec Co., Ltd.
product: SolarView Compact
Published: 2021-02-24T03:51:44.000Z
CVE-2021-20657 
Improper access control vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain and/or alter the setting information without the access privilege via unspecified vectors.
Problem types: description: Improper Access Control
Affected products: vendor: Contec Co., Ltd.
product: SolarView Compact
Published: 2021-02-24T03:51:44.000Z
CVE-2021-20658 
SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: Contec Co., Ltd.
product: SolarView Compact
Published: 2021-02-24T03:51:45.000Z
CVE-2021-20659 
SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to upload arbitrary files via unspecified vectors. If the file is PHP script, an attacker may execute arbitrary code.
Problem types: description: Unrestricted upload of file with dangerous type
Affected products: vendor: Contec Co., Ltd.
product: SolarView Compact
Published: 2021-02-24T03:51:46.000Z
CVE-2021-20660 
Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Contec Co., Ltd.
product: SolarView Compact
Published: 2021-02-24T03:51:46.000Z
CVE-2021-20661 
Directory traversal vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: Contec Co., Ltd.
product: SolarView Compact
Published: 2021-02-24T03:51:47.000Z
CVE-2021-20662 
Missing authentication for critical function in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to alter the setting information without the access privileges via unspecified vectors.
Problem types: description: Missing authentication for critical function
Affected products: vendor: Contec Co., Ltd.
product: SolarView Compact
Published: 2021-02-24T03:51:48.000Z
CVE-2021-20663 
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-03-05T09:20:20.000Z
CVE-2021-20664 
Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-03-05T09:20:20.000Z
CVE-2021-20665 
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2021-03-05T09:20:21.000Z
CVE-2021-20667 
Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2021-03-10T09:20:31.000Z
CVE-2021-20668 
Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL.
Problem types: description: Path Traversal
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2021-03-10T09:20:31.000Z
CVE-2021-20669 
Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a specially crafted URL.
Problem types: description: Path Traversal
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2021-03-10T09:20:32.000Z
CVE-2021-20670 
Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's personal information and/or server's internal information via unspecified vectors.
Problem types: description: Improper Access Control
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2021-03-10T09:20:33.000Z
CVE-2021-20671 
Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the server, which may lead to arbitrary code execution.
Problem types: description: Improper Input Validation
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2021-03-10T09:20:34.000Z
CVE-2021-20672 
Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI (v4.2 Series)
Published: 2021-03-10T09:20:34.000Z
CVE-2021-20673 
Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI (v4.2 Series)
Published: 2021-03-10T09:20:35.000Z
CVE-2021-20674 
Untrusted search path vulnerability in Installer of MagicConnect Client program distributed before 2021 March 1 allows an attacker to gain privileges and via a Trojan horse DLL in an unspecified directory and to execute arbitrary code with the privilege of the user invoking the installer when a terminal is connected remotely using Remote desktop.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: NTT TechnoCross Corporation
product: Installer of MagicConnect Client program
Published: 2021-03-12T01:00:19.000Z
CVE-2021-20675 
M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D) versions prior to Ver3.0, and type E (DL8-E) versions prior to Ver3.0) allows remote authenticated attackers to cause a denial of service (DoS) condition via unspecified vectors.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: M-System Co., Ltd.
product: M-System DL8 series
Published: 2021-03-18T00:56:04.000Z
CVE-2021-20676 
M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D) versions prior to Ver3.0, and type E (DL8-E) versions prior to Ver3.0) allows remote authenticated attackers to bypass access restriction and conduct prohibited operations via unspecified vectors.
Problem types: description: Improper Access Control
Affected products: vendor: M-System Co., Ltd.
product: M-System DL8 series
Published: 2021-03-18T00:56:05.000Z
CVE-2021-20677 
UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending a specially crafted command.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: NEC Platforms, Ltd.
product: UNIVERGE Aspire series PBX
Published: 2021-03-26T08:50:26.000Z
CVE-2021-20678 
SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: SQL Injection
Affected products: vendor: Stranger Studios
product: Paid Memberships Pro
Published: 2021-03-18T00:56:05.000Z
CVE-2021-20679 
Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII C7788/C6688/C5588, ApeosPort-VII C7773/C6673/C5573/C4473/C3373/C3372 C2273, ApeosPort-VII C7788/C6688/C5588, ApeosPort C7070/C6570/C5570/C4570/C3570/C3070/C7070G/C6570G/C5570G/C4570G/C3570G/C3070G, ApeosPort-VII C4421/C3321, ApeosPort C3060/C2560/C2060/C3060G/C2560G/C2060G, ApeosPort-VII CP4421, ApeosPort Print C5570, ApeosPort 5570/4570/5570G/4570G, ApeosPort 3560/3060/2560/3560G/3060G/2560G, ApeosPort-VII 5021/ 4021, ApeosPort-VII P5021, DocuPrint CP 555 d/505 d, DocuPrint P505 d, PrimeLink C9065/C9070, DocuPrint CP475AP, and DocuPrint P475AP) allow an attacker to cause a denial of service (DoS) condition and abnormal end (ABEND) of the affected products via sending a specially crafted command.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: Fuji Xerox Co.,Ltd.
product: Fuji Xerox multifunction devices and printers
Published: 2021-03-25T05:30:18.000Z
CVE-2021-20680 
Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 and earlier, Aterm WG1800HP4 firmware Ver.1.3.1 and earlier, Aterm WG1800HP3 firmware Ver.1.5.1 and earlier, Aterm WG1200HS2 firmware Ver.2.5.0 and earlier, Aterm WG1200HP3 firmware Ver.1.3.1 and earlier, Aterm WG1200HP2 firmware Ver.2.5.0 and earlier, Aterm W1200EX firmware Ver.1.3.1 and earlier, Aterm W1200EX-MS firmware Ver.1.3.1 and earlier, Aterm WG1200HS firmware all versions Aterm WG1200HP firmware all versions Aterm WF800HP firmware all versions Aterm WF300HP2 firmware all versions Aterm WR8165N firmware all versions Aterm W500P firmware all versions, and Aterm W300P firmware all versions) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: NEC Corporation
product: NEC Aterm devices
Published: 2021-04-26T00:20:39.000Z
CVE-2021-20681 
Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: baserCMS Users Community
product: baserCMS
Published: 2021-03-26T08:50:27.000Z
CVE-2021-20682 
baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: baserCMS Users Community
product: baserCMS
Published: 2021-03-26T08:50:28.000Z
CVE-2021-20683 
Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: baserCMS Users Community
product: baserCMS
Published: 2021-03-26T08:50:29.000Z
CVE-2021-20684 
Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: CGI Script Market
product: MagazinegerZ
Published: 2021-04-07T07:15:29.000Z
CVE-2021-20685 
Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: daifukuya.com
product: Kagemai
Published: 2021-04-07T07:15:29.000Z
CVE-2021-20686 
Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: daifukuya.com
product: Kagemai
Published: 2021-04-07T07:15:30.000Z
CVE-2021-20687 
Cross-site request forgery (CSRF) vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: daifukuya.com
product: Kagemai
Published: 2021-04-07T07:15:31.000Z
CVE-2021-20688 
Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: GoPlace!
product: Click Ranker
Published: 2021-04-07T07:15:31.000Z
CVE-2021-20689 
Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: WonderLink
product: Yomi-Search
Published: 2021-04-07T07:15:32.000Z
CVE-2021-20690 
Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: WonderLink
product: Yomi-Search
Published: 2021-04-07T07:15:33.000Z
CVE-2021-20691 
Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: WonderLink
product: Yomi-Search
Published: 2021-04-07T07:15:33.000Z
CVE-2021-20692 
Directory traversal vulnerability in Archive collectively operation utility Ver.2.10.1.0 and earlier allows an attacker to create or overwrite files by leading a user to expand a malicious ZIP archives.
Problem types: description: Directory traversal
Affected products: vendor: EikiSoft
product: Archive collectively operation utility
Published: 2021-04-07T07:15:34.000Z
CVE-2021-20693 
Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.
Problem types: description: Improper Access Control
Affected products: vendor: Gurunavi, Inc.
product: Gurunavi App
Published: 2021-04-26T00:20:40.000Z
CVE-2021-20694 
Improper access control vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to bypass access restriction and to start a telnet service via unspecified vectors.
Problem types: description: Improper Access Control
Affected products: vendor: D-Link Japan K.K.
product: DAP-1880AC
Published: 2021-04-26T00:20:41.000Z
CVE-2021-20695 
Improper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to gain root privileges via unspecified vectors.
Problem types: description: Improper following of a certificate's chain of trust
Affected products: vendor: D-Link Japan K.K.
product: DAP-1880AC
Published: 2021-04-26T00:20:41.000Z
CVE-2021-20696 
DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to execute arbitrary OS commands by sending a specially crafted request to a specific CGI program.
Problem types: description: OS Command Injection
Affected products: vendor: D-Link Japan K.K.
product: DAP-1880AC
Published: 2021-04-26T00:20:42.000Z
CVE-2021-20697 
Missing authentication for critical function in DAP-1880AC firmware version 1.21 and earlier allows a remote attacker to login to the device as an authenticated user without the access privilege via unspecified vectors.
Problem types: description: Missing authentication for critical function
Affected products: vendor: D-Link Japan K.K.
product: DAP-1880AC
Published: 2021-04-26T00:20:43.000Z