rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-30128 Unsafe deserialization in Apache OFBiz
Apache OFBiz has unsafe deserialization prior to 17.12.07 version
Problem types: description: Java serialisation
Affected products: vendor: Apache Software Foundation
product: Apache OFBiz
Credits: lang: en
value: Apache OFBiz would like to thank Litch1 from the Security Team of Alibaba Cloud <litch1chk@gmail.com> for report
Published: 2021-04-27T19:50:14.000Z
CVE-2021-30129 DoS/OOM leak vulnerability in Apache Mina SSHD Server
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
Problem types: description: oom
Affected products: vendor: Apache Software Foundation
product: Apache Mina SSHD
Published: 2021-07-12T12:10:10.000Z
CVE-2021-30130 
phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T00:00:00.000Z
CVE-2021-30132 
Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T13:07:17.000Z
CVE-2021-30133 
A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-09T14:33:39.000Z
CVE-2021-30134 
php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2021-30137 
Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:L/I:L/PR:L/S:C/UI:N
version: 3.1
Published: 2021-09-15T12:35:09.000Z
CVE-2021-30139 
In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T15:14:55.000Z
CVE-2021-30140 
LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content), the payload is executed upon a click. This is fixed in 3.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
version: 3.1
Published: 2021-04-06T15:46:55.000Z
CVE-2021-30141 
Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an attempted access to an array offset on a value of type null, and excessive memory consumption. NOTE: the vendor states "the feature still requires a valid authentication cookie even if the route is accessible to non-logged users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-05T22:44:54.000Z
CVE-2021-30144 
The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the connected users, and the users in the tech category. For example, plugins/dashboard/front/main2.php can be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2021-04-06T04:40:38.000Z
CVE-2021-30145 
A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T13:34:53.000Z
CVE-2021-30146 
Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T15:51:43.000Z
CVE-2021-30147 
DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T02:02:53.000Z
CVE-2021-30149 
Composr 10.0.36 allows upload and execution of PHP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T05:40:57.000Z
CVE-2021-30150 
Composr 10.0.36 allows XSS in an XML script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T05:40:38.000Z
CVE-2021-30151 
Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T00:00:00.000Z
CVE-2021-30152 
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-09T06:08:35.000Z
CVE-2021-30153 
An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2021-30154 
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T06:43:51.000Z
CVE-2021-30155 
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-09T06:09:46.000Z
CVE-2021-30156 
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-09T06:10:16.000Z
CVE-2021-30157 
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T06:43:05.000Z
CVE-2021-30158 
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T06:42:45.000Z
CVE-2021-30159 
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-09T06:12:55.000Z
CVE-2021-30161 
An issue was discovered on LG mobile devices with Android OS 11 software. Attackers can bypass the lockscreen protection mechanism after an incoming call has been terminated. The LG ID is LVE-SMP-210002 (April 2021).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T07:18:40.000Z
CVE-2021-30162 
An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. Attackers can leverage ISMS services to bypass access control on specific content providers. The LG ID is LVE-SMP-210003 (April 2021).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T07:18:19.000Z
CVE-2021-30163 
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T07:59:55.000Z
CVE-2021-30164 
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T07:58:51.000Z
CVE-2021-30165 EDIMAX Technology Co., Ltd. HD Wireless Day & Night Network Camera IC-3140W - Hard-coded password
The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privileged permission and further control the devices.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: EDIMAX Technology Co., Ltd.
product: IC-3140W
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-04-27T03:07:36.944Z
CVE-2021-30166 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection
The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: MERIT LILIN ENT.CO.,LTD.
product: P2/Z2/P3/Z3 IP camera firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-04-28T09:30:43.337Z
CVE-2021-30167 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication
The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: MERIT LILIN ENT.CO.,LTD.
product: P2/Z2/P3/Z3 IP camera firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-04-28T09:30:44.048Z
CVE-2021-30168 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1
The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: MERIT LILIN ENT.CO.,LTD.
product: P2/Z2/P3/Z3 IP camera firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-04-28T09:30:44.741Z
CVE-2021-30169 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2
The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: MERIT LILIN ENT.CO.,LTD.
product: P2/Z2/P3/Z3 IP camera firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-04-28T09:30:45.489Z
CVE-2021-30170 Jun-He Technology Ltd. ERP POS - Stored XSS-1
Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Jun-He Technology Ltd.
product: ERP POS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2021-05-07T09:30:24.312Z
CVE-2021-30171 Jun-He Technology Ltd. ERP POS - Stored XSS-2
Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Jun-He Technology Ltd.
product: ERP POS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2021-05-07T09:30:24.945Z
CVE-2021-30172 Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSS
Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additionally access and manipulate customer’s information.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Jun-He Technology Ltd.
product: Quan-Fang-Wei-Tong-Xun system
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2021-05-07T09:30:25.577Z
CVE-2021-30173 Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File Inclusion
Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file.
Problem types: cwe_id: CWE-36
description: CWE-36 Absolute Path Traversal
Affected products: vendor: Jun-He Technology Ltd.
product: Quan-Fang-Wei-Tong-Xun system
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-05-07T09:30:26.202Z
CVE-2021-30174 RiyaLab Co., Ltd. CloudISO - Stored XSS
RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: RiyaLab Co., Ltd.
product: CloudISO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-05-11T06:10:19.089Z
CVE-2021-30175 
ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-13T13:44:01.000Z
CVE-2021-30176 
The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-13T13:47:31.000Z
CVE-2021-30177 
There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T10:48:16.000Z
CVE-2021-30178 
An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynIC Hyper-V context, aka CID-919f4ebc5987.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T23:29:00.000Z
CVE-2021-30179 Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter
Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.
Problem types: description: Remote Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache Dubbo
Credits: lang: en
value: This issue was first reported by GitHub Security Lab
Published: 2021-05-31T07:25:13.000Z
CVE-2021-30180 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
Problem types: description: Remote Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache Dubbo
Credits: lang: en
value: This issue was first reported by GitHub Security Lab
Published: 2021-05-31T07:25:14.000Z
CVE-2021-30181 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Problem types: description: Script Injection
Affected products: vendor: Apache Software Foundation
product: Apache Dubbo
Published: 2021-05-29T07:30:12.000Z
CVE-2021-30183 
Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-14T10:36:18.000Z
CVE-2021-30184 
GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and cmd_pgnreplay functions in frontend/cmd.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T11:30:55.000Z
CVE-2021-30185 
CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T13:25:41.000Z
CVE-2021-30186 
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T12:33:12.000Z
CVE-2021-30187 
CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T11:47:16.000Z
CVE-2021-30188 
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T12:33:16.000Z