rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-32037 User may trigger invariant when allowed to send commands directly to shards
An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.2.
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-11-24T10:40:10.557Z
CVE-2021-32039 MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text
Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: MongoDB Inc.
product: MongoDB for VS Code
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-01-20T14:50:10.319Z
CVE-2021-32040 Large aggregation pipelines with a specific stage can crash mongod under default configuration
It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16.

Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-04-12T14:15:16.692Z
CVE-2021-32050 Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.

Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).

This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: MongoDB Inc
product: MongoDB C Driver
default_status: unaffected
vendor: MongoDB Inc
product: MongoDB C++ Driver
default_status: unaffected
vendor: MongoDB Inc
product: MongoDB PHP Driver
default_status: unaffected
vendor: MongoDB Inc
product: MongoDB Swift Driver
default_status: unaffected
vendor: MongoDB Inc
product: MongoDB Node.js Driver
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-08-29T15:24:30.389Z
CVE-2021-32051 
Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-14T00:38:38.000Z
CVE-2021-32052 
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-06T15:49:20.000Z
CVE-2021-32053 
JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-10T20:43:45.000Z
CVE-2021-32054 
Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted files to be delivered to clients such that they are rendered directly in a victim's web browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-14T20:39:25.000Z
CVE-2021-32055 
Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T15:06:52.000Z
CVE-2021-32056 
Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-10T13:05:40.000Z
CVE-2021-32061 
S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-29T03:00:48.000Z
CVE-2021-32062 
MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-05T18:39:41.000Z
CVE-2021-32066 
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-01T00:00:00.000Z
CVE-2021-32067 
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:27:42.000Z
CVE-2021-32068 
The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to modify application data and state.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:28:55.000Z
CVE-2021-32069 
The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:37:36.000Z
CVE-2021-32070 
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response. A successful exploit could allow an attacker to modify the browser header and redirect users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:31:11.000Z
CVE-2021-32071 
The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful exploit could allow an attacker to view and modify application data, and cause a denial of service for users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:31:56.000Z
CVE-2021-32072 
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T15:32:58.000Z
CVE-2021-32073 
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-14T23:20:08.000Z
CVE-2021-32074 
HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T04:01:29.000Z
CVE-2021-32075 
Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T12:42:04.000Z
CVE-2021-32076 Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.
Problem types: cwe_id: CWE-290
description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: SolarWinds
product: Web Help Desk
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Moaaz Taha for reporting on the issue in a responsible manner.
Published: 2021-08-26T14:53:25.774Z
CVE-2021-32077 
Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (SSN) values via a brute-force attack on a (sometimes hidden) search field, because the last four SSN digits are part of the supported combination of search selectors. This discloses doctors' and nurses' social security numbers and PII.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-06T23:00:51.000Z
CVE-2021-32078 
An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-17T14:13:38.000Z
CVE-2021-32089 
An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. An unauthenticated attacker can upload arbitrary files to the filesystem that can then be accessed through the web interface. This can lead to information disclosure and code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T20:39:29.000Z
CVE-2021-32090 
The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:52:36.000Z
CVE-2021-32091 
A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:52:26.000Z
CVE-2021-32092 
A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:52:18.000Z
CVE-2021-32093 
The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:52:07.000Z
CVE-2021-32094 
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:51:58.000Z
CVE-2021-32095 
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:51:47.000Z
CVE-2021-32096 
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:51:37.000Z
CVE-2021-32098 
Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:51:23.000Z
CVE-2021-32099 
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:51:15.000Z
CVE-2021-32100 
A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:51:05.000Z
CVE-2021-32101 
The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:50:56.000Z
CVE-2021-32102 
A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:50:46.000Z
CVE-2021-32103 
A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:50:35.000Z
CVE-2021-32104 
A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-07T03:50:23.000Z
CVE-2021-32106 
In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-08T12:40:04.000Z
CVE-2021-32122 
Certain NETGEAR devices are affected by CSRF. This affects EX3700 before 1.0.0.90, EX3800 before 1.0.0.90, EX6120 before 1.0.0.64, and EX6130 before 1.0.0.44.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-08-10T23:58:01.000Z
CVE-2021-32132 
The abst_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-13T14:32:47.000Z
CVE-2021-32134 
The gf_odf_desc_copy function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-13T13:20:39.000Z
CVE-2021-32135 
The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-13T14:17:04.000Z
CVE-2021-32136 
Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-13T12:14:32.000Z
CVE-2021-32137 
Heap buffer overflow in the URL_GetProtocolType function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-13T13:36:40.000Z
CVE-2021-32138 
The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-13T19:11:14.000Z
CVE-2021-32139 
The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-13T19:59:04.000Z
CVE-2021-32142 
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2021-32156 
A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T05:37:30.000Z
CVE-2021-32157 
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T05:38:51.000Z
CVE-2021-32158 
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T05:40:27.000Z
CVE-2021-32159 
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T05:41:36.000Z
CVE-2021-32160 
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T05:43:44.000Z
CVE-2021-32161 
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T05:45:24.000Z
CVE-2021-32162 
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T05:46:44.000Z
CVE-2021-32163 
Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2021-32172 
Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T10:18:09.000Z
CVE-2021-32198 
EmTec ZOC through 8.02.4 allows remote servers to cause a denial of service (Windows GUI hang) by telling the ZOC window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon processing a title change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-06T11:41:29.000Z
CVE-2021-32202 
In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-14T11:37:58.000Z