rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-29267 
Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T15:05:05.000Z
CVE-2021-29271 
remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-27T17:57:06.000Z
CVE-2021-29272 
bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-27T17:57:28.000Z
CVE-2021-29274 
Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T03:46:59.000Z
CVE-2021-29279 
There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyValue *value,maybe value->value.data.size is a negative number. In result, memcpy in gf_props_assign_value failed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T19:34:08.000Z
CVE-2021-29280 
In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-19T15:31:55.000Z
CVE-2021-29281 
File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T19:38:54.000Z
CVE-2021-29294 
Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK_1.01, which could let a remove malicious user cause a denial of service via the send_hnap_unauthorized function. It could be triggered by sending crafted POST request to /HNAP1/. NOTE: The DSL-2740R and all hardware revisions are considered End of Life and as such this issue will not be patched
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T19:32:49.000Z
CVE-2021-29295 
Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via usr/bin/lighttpd. It could be triggered by sending an HTTP request without URL in the start line directly to the device. NOTE: The DSP-W215 and all hardware revisions is considered End of Life and as such this issue will not be patched
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T19:38:00.000Z
CVE-2021-29296 
Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vulnerability could be triggered by sending an HTTP request with URL /vct_wan; the sbin/httpd would invoke the strchr function and take NULL as a first argument, which finally leads to the segmentation fault. NOTE: The DIR-825 and all hardware revisions is considered End of Life and as such this issue will not be patched
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T19:52:06.000Z
CVE-2021-29297 
Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafted traffic from a Man-in-the-Middle (MITM) attack to the component "FrameworX.exe" in the module "MSVCR100.dll".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-30T18:20:50.000Z
CVE-2021-29298 
Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafted traffic from a Man-in-the-Middle (MITM) attack to the component "FrameworX.exe"in the module "fxVPStatcTcp.dll".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-30T18:20:59.000Z
CVE-2021-29300 
The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T15:42:01.000Z
CVE-2021-29302 
TP-Link TL-WR802N(US), Archer_C50v5_US v4_200 <= 2020.06 contains a buffer overflow vulnerability in the httpd process in the body message. The attack vector is: The attacker can get shell of the router by sending a message through the network, which may lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T17:47:02.000Z
CVE-2021-29313 
Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-17T18:11:57.000Z
CVE-2021-29323 
OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow via the component /modules/network/wifi/esp/modwifi.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T16:39:34.000Z
CVE-2021-29324 
OpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component /moddable/xs/sources/xsScript.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T16:39:34.000Z
CVE-2021-29325 
OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_String_prototype_repeat function at /moddable/xs/sources/xsString.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T16:39:36.000Z
CVE-2021-29326 
OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fxIDToString function at /moddable/xs/sources/xsSymbol.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T16:39:37.000Z
CVE-2021-29327 
OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_ArrayBuffer function at /moddable/xs/sources/xsDataView.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T16:39:38.000Z
CVE-2021-29328 
OpenSource Moddable v10.5.0 was discovered to contain buffer over-read in the fxDebugThrow function at /moddable/xs/sources/xsDebug.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T16:39:39.000Z
CVE-2021-29329 
OpenSource Moddable v10.5.0 was discovered to contain a stack overflow in the fxBinaryExpressionNodeDistribute function at /moddable/xs/sources/xsTree.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T16:39:40.000Z
CVE-2021-29334 
An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-23T00:00:00.000Z
CVE-2021-29337 
MODAPI.sys in MSI Dragon Center 2.0.104.0 allows low-privileged users to access kernel memory and potentially escalate privileges via a crafted IOCTL 0x9c406104 call. This IOCTL provides the MmMapIoSpace feature for mapping physical memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-21T11:44:12.000Z
CVE-2021-29338 
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:52:26.000Z
CVE-2021-29343 
Ovidentia CMS 6.x contains a SQL injection vulnerability in the "id" parameter of index.php. The "checkbox" property into "text" data can be extracted and displayed in the text region or in source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T11:26:08.000Z
CVE-2021-29349 
Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieform_delete_all_notifications request, which leads to removing all messages from a mailbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T22:31:41.000Z
CVE-2021-29350 
SQL injection in the getip function in conn/function.php in 发货100-设计素材下载系统 1.1 allows remote attackers to inject arbitrary SQL commands via the X-Forwarded-For header to admin/product_add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T15:12:04.000Z
CVE-2021-29357 
The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T18:59:08.000Z
CVE-2021-29358 
A buffer overflow vulnerability in FORMATS!ReadPVR_W+0xfa of Irfanview 4.57 allows attackers to cause a denial of service (DOS) via a crafted PVR file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T15:27:29.000Z
CVE-2021-29360 
A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x37a of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T15:27:30.000Z
CVE-2021-29361 
A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x340 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T15:27:31.000Z
CVE-2021-29362 
A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa30 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T15:27:32.000Z
CVE-2021-29363 
A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa74 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.0xa74
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T15:27:33.000Z
CVE-2021-29364 
A buffer overflow vulnerability in Formats!ReadRAS_W+0x1001 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T15:27:34.000Z
CVE-2021-29365 
Irfanview 4.57 is affected by an infinite loop when processing a crafted BMP file in the EFFECTS!AutoCrop_W component. This can cause a denial of service (DOS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T15:27:36.000Z
CVE-2021-29366 
A buffer overflow vulnerability in FORMATS!GetPlugInInfo+0x2de9 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T15:27:35.000Z
CVE-2021-29367 
A buffer overflow vulnerability in WPG+0x1dda of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted WPG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T15:27:40.000Z
CVE-2021-29368 
Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2021-29369 
The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-03T11:27:22.000Z
CVE-2021-29370 
A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent scheme. This resulted in Cross-site scripting on the cheetah browser in any website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-13T21:55:41.000Z
CVE-2021-29376 
ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim from an IRC server) via a crafted CTCP UTC message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T06:24:19.000Z
CVE-2021-29377 
Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T21:50:15.000Z
CVE-2021-29378 
SQL Injection in pear-admin-think version 2.1.2, allows attackers to execute arbitrary code and escalate privileges via crafted GET request to Crud.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2021-29379 
An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T04:09:35.000Z
CVE-2021-29387 
Multiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remote attackers to inject arbitrary javascript via any "Add" sections, such as Add Item , Employee and Position or others in the Name Parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-28T13:22:24.000Z
CVE-2021-29388 
A stored cross-site scripting (XSS) vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php via vulnerable field 'Budget Title'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-28T13:36:42.000Z
CVE-2021-29390 
libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2021-29393 
Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inject and execute arbitrary system commands via the unsanitized user-controlled "command" and "commandvalues" parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T18:43:34.000Z
CVE-2021-29394 
Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T18:47:04.000Z
CVE-2021-29395 
Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T18:48:57.000Z
CVE-2021-29396 
Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T18:50:50.000Z
CVE-2021-29397 
Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local user to intercept users credentials transmitted in cleartext over HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T18:52:04.000Z
CVE-2021-29398 
Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to browse and list the directories across the entire filesystem of the host of the web application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T18:55:00.000Z
CVE-2021-29399 
XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input. This bug affects all versions of XMB. All XMB installations must be updated to versions 1.9.12.03 or 1.9.11.16.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T11:00:27.000Z
CVE-2021-29400 
A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change the SMTP settings of the contact forms for the webpages of the CMS after an authenticated admin visits a malicious third-party site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T22:30:08.000Z
CVE-2021-29414 
STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-21T11:38:34.000Z
CVE-2021-29415 
The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor nRF52840 through 2021-03-29 has a non-constant time ECDSA implemenation. This allows an adversary to recover the private ECC key used during an ECDSA operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-21T11:29:59.000Z
CVE-2021-29416 
An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a request that does not respect its upstream proxy configuration. This could leak NetNTLM hashes on Windows systems that fail to block outbound SMB.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T17:51:15.000Z
CVE-2021-29417 
gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T18:07:56.000Z
CVE-2021-29418 
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-30T06:08:00.000Z
CVE-2021-29421 
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-01T00:00:00.000Z
CVE-2021-29424 
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-29T23:02:41.000Z
CVE-2021-29425 Possible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Commons IO
Published: 2021-04-13T06:50:12.000Z
CVE-2021-29427 Repository content filters do not work in Settings pluginManagement
In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies. This feature was introduced in the wake of the "A Confusing Dependency" blog post. In some cases, Gradle may ignore content filters and search all repositories for dependencies. This only occurs when repository content filtering is used from within a `pluginManagement` block in a settings file. This may change how dependencies are resolved for Gradle plugins and build scripts. For builds that are vulnerable, there are two risks: 1) Information disclosure: Gradle could make dependency requests to repositories outside your organization and leak internal package identifiers. 2) Dependency poisoning/Dependency confusion: Gradle could download a malicious binary from a repository outside your organization due to name squatting. For a full example and more details refer to the referenced GitHub Security Advisory. The problem has been patched and released with Gradle 7.0. Users relying on this feature should upgrade their build as soon as possible. As a workaround, users may use a company repository which has the right rules for fetching packages from public repositories, or use project level repository content filtering, inside `buildscript.repositories`. This option is available since Gradle 5.1 when the feature was introduced.
Problem types: cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: gradle
product: gradle
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-04-13T17:55:24.000Z