rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-27505 mySCADA myPRO Exposure of Information Through Directory Listing
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.
Problem types: cwe_id: CWE-548
description: CWE-548: Exposure of Information Through Directory Listing
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-05-13T15:17:59.788Z
CVE-2021-27506 
The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T14:28:20.000Z
CVE-2021-27509 
In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-19T22:16:31.000Z
CVE-2021-27513 
The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le filtre userside."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-21T23:05:43.000Z
CVE-2021-27514 
EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (such as in CVE-2021-27513 exploitation).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-21T23:05:32.000Z
CVE-2021-27515 
url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-21T00:00:00.000Z
CVE-2021-27516 
URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-21T23:29:56.000Z
CVE-2021-27517 
Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious PDF document containing embedded JavaScript code that abuses app.alert (in the Acrobat JavaScript API).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-20T11:38:37.000Z
CVE-2021-27519 
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T18:54:16.000Z
CVE-2021-27520 
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T18:53:54.000Z
CVE-2021-27522 
Learnsite 1.2.5.0 contains a remote privilege escalation vulnerability in /Manager/index.aspx through the JudgIsAdmin() function. By modifying the initial letter of the key of a user cookie, the key of the administrator cookie can be obtained.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T15:13:02.000Z
CVE-2021-27523 
An issue was discovered in open-falcon dashboard version 0.2.0, allows remote attackers to gain, modify, and delete sensitive information via crafted POST request to register interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2021-27524 
Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2021-27526 
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "page" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-23T13:21:55.000Z
CVE-2021-27527 
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "valueID" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-23T13:20:45.000Z
CVE-2021-27528 
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-23T13:18:20.000Z
CVE-2021-27529 
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-23T13:15:46.000Z
CVE-2021-27530 
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-23T13:19:50.000Z
CVE-2021-27531 
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-23T13:16:55.000Z
CVE-2021-27544 
Cross Site Scripting (XSS) in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "sername" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-15T11:53:36.000Z
CVE-2021-27545 
SQL Injection in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to obtain sensitive database information by injecting SQL commands into the "sername" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-15T11:54:21.000Z
CVE-2021-27548 
There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-18T14:37:01.000Z
CVE-2021-27549 
Genymotion Desktop through 3.2.0 leaks the host's clipboard data to the Android application by default. NOTE: the vendor's position is that this is intended behavior that can be changed through the Settings > Device screen
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T16:37:19.000Z
CVE-2021-27550 
Polaris Office v9.102.66 is affected by a divide-by-zero error in PolarisOffice.exe and EngineDLL.dll that may cause a local denial of service. To exploit the vulnerability, someone must open a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-23T14:35:31.000Z
CVE-2021-27556 
The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T02:38:28.000Z
CVE-2021-27557 
A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T02:41:15.000Z
CVE-2021-27558 
A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-31T02:44:27.000Z
CVE-2021-27559 
The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T14:37:46.000Z
CVE-2021-27561 
Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-15T17:11:45.000Z
CVE-2021-27562 
In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T18:27:20.000Z
CVE-2021-27564 
A stored XSS issue exists in Appspace 6.2.4. After a user is authenticated and enters an XSS payload under the groups section of the network tab, it is stored as the group name. Whenever another member visits that group, this payload executes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T16:01:53.000Z
CVE-2021-27565 
The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite loop and networking outage) via an unexpected valid HTTP request such as OPTIONS. This occurs because the HTTP request handler enters a miscoded wbs_loop() debugger hook.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-19T11:04:23.000Z
CVE-2021-27568 
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-23T01:32:14.000Z
CVE-2021-27569 
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name in a crafted packet. This information is sent in cleartext and is not protected by any authentication logic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T16:31:21.000Z
CVE-2021-27570 
An issue was discovered in Emote Remote Mouse through 3.015. Attackers can close any running process by sending the process name in a specially crafted packet. This information is sent in cleartext and is not protected by any authentication logic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T16:31:28.000Z
CVE-2021-27571 
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can retrieve recently used and running applications, their icons, and their file paths. This information is sent in cleartext and is not protected by any authentication logic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T16:31:34.000Z
CVE-2021-27572 
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Authentication Bypass can occur via Packet Replay. Remote unauthenticated users can execute arbitrary code via crafted UDP packets even when passwords are set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T16:32:29.000Z
CVE-2021-27573 
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Remote unauthenticated users can execute arbitrary code via crafted UDP packets with no prior authorization or authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T16:32:35.000Z
CVE-2021-27574 
An issue was discovered in Emote Remote Mouse through 4.0.0.0. It uses cleartext HTTP to check, and request, updates. Thus, attackers can machine-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T16:32:41.000Z
CVE-2021-27576 Apache OpenMeetings: bandwidth can be overloaded with public web service
If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0
Problem types: description: Server bandwidth overload
Affected products: vendor: Apache Software Foundation
product: Apache OpenMeetings
Credits: lang: en
value: This issue was identified by Trung Le, Chi Tran, Linh Cua
Published: 2021-03-15T09:05:17.000Z
CVE-2021-27577 Incorrect handling of url fragment leads to cache poisoning
Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Published: 2021-06-29T11:45:19.000Z
CVE-2021-27578 Cross Site Scripting in markdown interpreter
Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0.
Problem types: description: Cross Site Scripting
Affected products: vendor: Apache Software Foundation
product: Apache Zeppelin
Credits: lang: en
value: Apache Zeppelin would like to thank Paulo Pacheco for reporting this issue
Published: 2021-09-02T00:00:00.000Z
CVE-2021-27579 
Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed and in use across an IT environment. A privilege-escalation vulnerability exists if CPUID is enabled, and thus it should be disabled via configuration settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-23T17:03:46.000Z
CVE-2021-27581 
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-05T22:29:02.000Z
CVE-2021-27582 
org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-23T17:58:39.000Z
CVE-2021-27583 
In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password reset feature. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-23T18:54:20.000Z
CVE-2021-27584 
When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:13:10.000Z
CVE-2021-27585 
When a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:11:55.000Z
CVE-2021-27586 
When a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:12:54.000Z
CVE-2021-27587 
When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:12:40.000Z
CVE-2021-27588 
When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:13:04.000Z
CVE-2021-27589 
When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:12:08.000Z
CVE-2021-27590 
When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:13:22.000Z
CVE-2021-27591 
When a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:12:16.000Z
CVE-2021-27592 
When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:13:57.000Z
CVE-2021-27593 
When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-22T16:58:10.000Z
CVE-2021-27594 
When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-22T16:58:38.000Z
CVE-2021-27595 
When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-22T16:58:20.000Z
CVE-2021-27596 
When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-22T16:58:30.000Z
CVE-2021-27597 
SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method memmove() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-125
description: Improper Input Validation (CWE-125)
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for ABAP (RFC Gateway)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27598 
SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet.
Problem types: cwe_id: CWE-284
description: Improper Access Control (CWE-284)
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for JAVA (Customer Usage Provisioning Servlet)
Published: 2021-04-13T18:38:46.000Z
CVE-2021-27599 
SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, allows an attacker to access information under certain conditions, which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Process Integration (Integration Builder Framework)
Published: 2021-04-14T14:23:01.000Z
CVE-2021-27600 
SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes. e.g., information can be read, modified, and sent to the attacker. However, availability of the server cannot be impacted.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Manufacturing Execution (System Rules)
Published: 2021-04-13T18:43:37.000Z
CVE-2021-27601 
SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting (XSS) vulnerability and the attacker can read and modify data. However, the attacker does not have control over kind or degree.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for Java (Applications based on HTMLB for Java)
Published: 2021-04-13T18:43:53.000Z