rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-26436 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Microsoft Edge (Chromium-based)
cpes: cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C
Published: 2021-09-02T22:25:23.000Z
CVE-2021-26437 Visual Studio Code Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Visual Studio Code
cpes: cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2021-09-15T11:23:03.000Z
CVE-2021-26439 Microsoft Edge for Android Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Microsoft Edge for Android
cpes: cpe:2.3:a:microsoft:edge:-:*:*:*:*:android:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2021-09-02T22:25:24.000Z
CVE-2021-26443 Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2300:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2300:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2300:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1916:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1348:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2022
cpes: cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.350:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1348:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1348:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19041.1348:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 11 version 21H2
cpes: cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.318:*:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 9
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:46:21.000Z
CVE-2021-26444 Azure RTOS Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Azure Real Time Operating System
cpes: cpe:2.3:o:microsoft:azure_real_time_operating_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
Published: 2021-11-10T00:46:23.000Z
CVE-2021-26461 malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds
Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Problem types: cwe_id: CWE-190
description: INTEGER OVERFLOW OR WRAPAROUND CWE-190
Affected products: vendor: Apache Software Foundation
product: Apache NuttX
Credits: lang: en
value: Apache NuttX would like to thank Omri Ben-Bassat of Section 52 at Azure Defender for IoT of Microsoft Corp for bringing this issue to our attention.
Published: 2021-06-21T17:10:11.000Z
CVE-2021-26471 Unauthenticated remote command execution in Vembu products
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Discovered by Wietse Boonstra
lang: en
value: Addional research by Frank Breedijk
Published: 2021-06-08T18:36:14.329Z
CVE-2021-26472 Unauthenticated remote command execution with SYSTEM privileges in Vembu products
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Discovered by Wietse Boonstra
lang: en
value: Addional research by Frank Breedijk
Published: 2021-06-08T18:37:29.497Z
CVE-2021-26473 Unauthenticated arbitrary file upload and command execution in Vembu products
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Discovered by Wietse Boonstra
lang: en
value: Addional research by Frank Breedijk
Published: 2021-06-08T18:38:48.809Z
CVE-2021-26474 UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS
Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Discovered by Wietse Boonstra
lang: en
value: Addional research by Frank Breedijk
Published: 2021-06-08T18:39:55.493Z
CVE-2021-26475 
EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-01T21:01:49.000Z
CVE-2021-26476 
EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-01T21:01:42.000Z
CVE-2021-26504 
Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2021-26505 
Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2021-26528 
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T20:13:36.000Z
CVE-2021-26529 
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T20:13:36.000Z
CVE-2021-26530 
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T20:13:36.000Z
CVE-2021-26539 
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T16:16:06.000Z
CVE-2021-26540 
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T16:16:07.000Z
CVE-2021-26541 
The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T16:16:08.000Z
CVE-2021-26543 
The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. The issue has been resolved in version 1.0.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-06T12:28:10.000Z
CVE-2021-26544 Apache Livy (Incubating) is vulnerable to cross site scripting
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Apache Software Foundation
product: Apache Livy (Incubating)
Credits: lang: en
value: We would like to thank Andras Beni for reporting this issue
Published: 2021-02-20T09:00:15.000Z
CVE-2021-26549 
An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T19:03:25.000Z
CVE-2021-26550 
An issue was discovered in SmartFoxServer 2.17.0. Cleartext password disclosure can occur via /config/server.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T19:07:23.000Z
CVE-2021-26551 
An issue was discovered in SmartFoxServer 2.17.0. An attacker can execute arbitrary Python code, and bypass the javashell.py protection mechanism, by creating /config/ConsoleModuleUnlock.txt and editing /config/admin/admintool.xml to enable the Console module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-09T19:11:42.000Z
CVE-2021-26556 
When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.
Problem types: description: Local privilege escalation in Octopus Server (Windows)
Affected products: vendor: Octopus Deploy
product: Octopus Server
Published: 2021-10-07T01:00:12.000Z
CVE-2021-26557 
When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.
Problem types: description: Local privilege escalation in Octopus Tentacle (Windows)
Affected products: vendor: Octopus Deploy
product: Octopus Tentacle
Published: 2021-10-07T01:00:13.000Z
CVE-2021-26558 Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache ShardingSphere-UI
Published: 2021-11-11T09:35:09.000Z
CVE-2021-26559 CWE-284 Improper Access Control on Configurations Endpoint for the Stable API
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control on Configurations Endpoint for the Stable API
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
Credits: lang: en
value: Apache Airflow would like to thank Ian Carroll for reporting this issue.
Published: 2021-02-17T14:15:14.000Z
CVE-2021-26560 
Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Synology
product: Synology DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-02-26T21:45:30.498Z
CVE-2021-26561 
Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Synology
product: Synology DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-02-26T21:45:31.206Z
CVE-2021-26562 
Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Synology
product: Synology DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-02-26T21:45:31.818Z
CVE-2021-26563 
Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-02-26T21:45:33.039Z
CVE-2021-26564 
Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Synology
product: Synology DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-02-26T21:45:33.663Z
CVE-2021-26565 
Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Synology
product: Synology DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-02-26T21:45:34.345Z
CVE-2021-26566 
Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary commands via inbound QuickConnect traffic.
Problem types: cwe_id: CWE-201
description: CWE-201: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Synology
product: Synology DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-02-26T21:45:35.118Z
CVE-2021-26567 
Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: github/knik0
product: faad2
Published: 2021-02-26T21:45:35.788Z
CVE-2021-26569 
Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.
Problem types: cwe_id: CWE-366
description: CWE-366: Race Condition within a Thread
Affected products: vendor: Synology
product: Synology DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-03-12T06:40:13.071Z
CVE-2021-26570 
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webifc_setadconfig function.
Problem types: description: HPE Apollo 70 system bmc firmware libifc.so webifc_setadconfig function has a buffer overflow vulnerability.
Affected products: vendor: n/a
product: HPE Apollo 70 System
Published: 2021-02-08T18:47:43.000Z
CVE-2021-26571 
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg function.
Problem types: description: HPE Apollo 70 system bmc firmware libifc.so webgetactivexcfg function has a buffer overflow vulnerability.
Affected products: vendor: n/a
product: HPE Apollo 70 System
Published: 2021-02-08T18:43:35.000Z
CVE-2021-26572 
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg function.
Problem types: description: HPE Apollo 70 system bmc firmware libifc.so webgetactivexcfg function has a buffer overflow vulnerability.
Affected products: vendor: n/a
product: HPE Apollo 70 System
Published: 2021-02-08T18:50:42.000Z
CVE-2021-26573 
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgeneratesslcfg function.
Problem types: description: HPE Apollo 70 system bmc firmware libifc.so webgeneratesslcfg function has a buffer overflow vulnerability.
Affected products: vendor: n/a
product: HPE Apollo 70 System
Published: 2021-02-08T19:05:31.000Z
CVE-2021-26574 
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletevideofile function.
Problem types: description: HPE Apollo 70 system bmc firmware libifc.so webdeletevideofile function has a path traversal vulnerability.
Affected products: vendor: n/a
product: HPE Apollo 70 System
Published: 2021-02-08T19:51:01.000Z
CVE-2021-26575 
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletesolvideofile function.
Problem types: description: HPE Apollo 70 system bmc firmware libifc.so webdeletesolvideofile function has a path traversal vulnerability.
Affected products: vendor: n/a
product: HPE Apollo 70 System
Published: 2021-02-08T19:43:43.000Z
CVE-2021-26576 
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so uploadsshkey function.
Problem types: description: HPE Apollo 70 system bmc firmware libifc.so uploadsshkey function has a command injection vulnerability.
Affected products: vendor: n/a
product: HPE Apollo 70 System
Published: 2021-02-08T20:04:28.000Z
CVE-2021-26577 
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so uploadsshkey function.
Problem types: description: HPE Aollo 70 system bmc firmware libfc.so uploadsshkey function has a buffer overflow vulnerability.
Affected products: vendor: n/a
product: HPE Apollo 70 System
Published: 2021-02-08T19:46:58.000Z