rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-26117 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Apache Software Foundation
product: Apache ActiveMQ
Credits: lang: en
value: Apache ActiveMQ would like to thank Gregor Tudan <gregor.tudan@cofinpro.de> for reporting this issue.
Published: 2021-01-27T00:00:00.000Z
CVE-2021-26118 Flaw in ActiveMQ Artemis OpenWire support
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Apache Software Foundation
product: Apache ActiveMQ Artemis
Credits: lang: en
value: Apache ActiveMQ  would like to thank Francesco Marchioni (Red Hat) for reporting this issue.
Published: 2021-01-27T18:55:13.000Z
CVE-2021-26119 
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T01:34:05.000Z
CVE-2021-26120 
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T01:38:15.000Z
CVE-2021-26122 
LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T11:07:20.000Z
CVE-2021-26123 
LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T11:07:27.000Z
CVE-2021-26194 
An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_is_lexical_environment in the ecma-helpers.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T22:14:44.000Z
CVE-2021-26195 
An issue was discovered in JerryScript 2.4.0. There is a heap-buffer-overflow in lexer_parse_number in js-lexer.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T22:14:49.000Z
CVE-2021-26197 
An issue was discovered in JerryScript 2.4.0. There is a SEGV in main_print_unhandled_exception in main-utils.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T22:14:55.000Z
CVE-2021-26198 
An issue was discovered in JerryScript 2.4.0. There is a SEVG in ecma_deref_bigint in ecma-helpers.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T22:15:00.000Z
CVE-2021-26199 
An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_bytecode_ref in ecma-helpers.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-10T22:15:04.000Z
CVE-2021-26200 
The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-15T20:39:41.000Z
CVE-2021-26201 
The Login Panel of CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection authentication bypass. An attacker can obtain access to the admin panel by injecting a SQL query in the username field of the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-15T20:39:48.000Z
CVE-2021-26215 
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T15:44:47.000Z
CVE-2021-26216 
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T15:44:55.000Z
CVE-2021-26220 
The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T20:13:36.000Z
CVE-2021-26221 
The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T20:13:36.000Z
CVE-2021-26222 
The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T20:13:36.000Z
CVE-2021-26223 
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to view_pay.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T18:34:46.000Z
CVE-2021-26224 
Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T18:40:50.000Z
CVE-2021-26226 
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T17:06:13.000Z
CVE-2021-26227 
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the student information parameters to edit_stud.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:49:17.000Z
CVE-2021-26228 
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_class1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:23:57.000Z
CVE-2021-26229 
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_stud.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:17:05.000Z
CVE-2021-26230 
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the user information to save_user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:39:47.000Z
CVE-2021-26231 
SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:29:20.000Z
CVE-2021-26232 
SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id parameter to news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:44:37.000Z
CVE-2021-26233 
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfcb, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T13:53:52.000Z
CVE-2021-26234 
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d8a, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T13:55:18.000Z
CVE-2021-26235 
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfc9, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T13:56:33.000Z
CVE-2021-26236 
FastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file parsing functionality (BITMAPINFOHEADER Structure, 'BitCount' file format field), that will end up corrupting the Structure Exception Handler (SEH). Attackers could exploit this issue to achieve code execution when a user opens or views a malformed/specially crafted CUR file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T12:55:54.000Z
CVE-2021-26237 
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d7d, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T13:59:13.000Z
CVE-2021-26247 
As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" to successfully execute the JavaScript payload present in the "ref" URL parameter.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Cacti
Published: 2022-01-19T20:38:53.000Z
CVE-2021-26248 Philips MRI 1.5T and 3T Incorrect Ownership Assignment
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Problem types: cwe_id: CWE-708
description: CWE-708 Incorrect Ownership Assignment
Affected products: vendor: Philips
product: MRI 1.5T
default_status: unaffected
vendor: Philips
product: MRI 3T
default_status: unaffected
Credits: lang: en
value: Michael Aguilar, a Secureworks Adversary Group consultant, reported these vulnerabilities to Philips.
Published: 2021-11-19T18:37:35.000Z
CVE-2021-26251 
Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Toolkit may allow an authenticated user to potentially enable denial of service via network access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Distribution of OpenVINO(TM) Toolkit
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: 2022-11-11T15:48:43.246Z
CVE-2021-26252 
A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in pspdf_prepare_page(),in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: htmldoc
Published: 2022-02-24T00:00:00.000Z
CVE-2021-26253 Bypass of Splunk Enterprise's implementation of DUO MFA
A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or service.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: Splunk
product: Splunk Enterprise
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sanket Bhimani
Published: 2022-05-06T16:34:33.000Z
CVE-2021-26254 
Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
Published: 2022-08-18T19:39:46.000Z
CVE-2021-26256 WordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Survey Maker team
product: Survey Maker (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ngo Van Thien (Patchstack Red Team project).
Published: 2022-02-21T17:49:34.180Z
CVE-2021-26257 
Improper buffer restrictions in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products
Published: 2022-08-18T19:44:07.000Z
CVE-2021-26258 
Improper access control for the Intel(R) Killer(TM) Control Center software before version 2.4.3337.0 may allow an authorized user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Killer(TM) Control Center software
Published: 2022-05-12T16:35:51.000Z
CVE-2021-26259 
A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in render_table_row(),in ps-pdf.cxx may lead to arbitrary code execution and denial of service.
Problem types: cwe_id: CWE-787
description: CWE-787->CWE-400
Affected products: vendor: n/a
product: htmldoc
Published: 2022-03-03T00:00:00.000Z
CVE-2021-26260 
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: OpenEXR
Published: 2021-06-08T00:00:00.000Z
CVE-2021-26262 Philips MRI 1.5T and 3T Improper Access Control
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Problem types: cwe_id: CWE-286
description: CWE-286 Incorrect User Management
Affected products: vendor: Philips
product: MRI 1.5T
default_status: unaffected
vendor: Philips
product: MRI 3T
default_status: unaffected
Credits: lang: en
value: Michael Aguilar, a Secureworks Adversary Group consultant, reported these vulnerabilities to Philips.
Published: 2021-11-19T18:35:52.000Z
CVE-2021-26263 
Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS)
Affected products: vendor: Odoo
product: Odoo Community
default_status: unaffected
vendor: Odoo
product: Odoo Enterprise
default_status: unaffected
Credits: lang: eng
value: Theodoros Malachias
lang: eng
value: iamsushi
lang: eng
value: Ranjit Pahan
Published: 2023-04-25T18:33:40.613Z
CVE-2021-26264 Emerson DeltaV Missing Authentication for Critical Function
A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to Emerson.
Published: 2022-01-28T19:09:49.871Z
CVE-2021-26266 
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T03:35:43.000Z
CVE-2021-26267 
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T03:35:35.000Z
CVE-2021-26271 
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T20:39:46.000Z
CVE-2021-26272 
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T20:39:56.000Z
CVE-2021-26273 
The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:56:58.000Z
CVE-2021-26274 
The Agent in NinjaRMM 5.0.909 has Insecure Permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-07T13:59:37.000Z
CVE-2021-26275 
The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T23:34:13.000Z
CVE-2021-26276 
scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-27T19:36:02.000Z
CVE-2021-26277 Security Advisory | PendingIntent hijacking vulnerability in Framework Services
The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: vivo
product: Frame service
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.6
baseSeverity: MEDIUM
Published: 2023-02-17T00:00:00.000Z
CVE-2021-26278 Sensitive information leakage vulnerability in wifi module
The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: vivo
product: Wifi
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2024-12-17T03:05:03.842Z
CVE-2021-26279 Information disclosure vulnerability in Weather module
Some parameters of the weather module are improperly stored, leaking some sensitive information.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: vivo
product: Weather
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2024-12-17T03:34:42.148Z
CVE-2021-26280 Permission bypass vulnerability in permission manager module
Locally installed application can bypass the permission check and perform system operations that require permission.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: vivo
product: Permission manager module
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H
version: 3.1
Published: 2024-12-17T06:27:22.498Z
CVE-2021-26281 Information disclosure vulnerability in Alarm clock module
Some parameters of the alarm clock module are improperly stored, leaking some sensitive information.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: vivo
product: Alarm clock
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2024-12-17T06:37:53.687Z