rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-28205 ASUS BMC's firmware: path traversal - Delete SOL video file function
The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ASUS
product: BMC firmware for Z10PR-D16
vendor: ASUS
product: BMC firmware for ASMB8-iKVM
vendor: ASUS
product: BMC firmware for Z10PE-D16 WS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-04-06T05:02:22.632Z
CVE-2021-28206 ASUS BMC's firmware: path traversal - Record video file function
The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ASUS
product: BMC firmware for ASMB9-iKVM
vendor: ASUS
product: BMC firmware for RS720A-E9-RS24-E
vendor: ASUS
product: BMC firmware for RS700A-E9-RS4
vendor: ASUS
product: BMC firmware for RS700-E9-RS4
vendor: ASUS
product: BMC firmware for ESC4000 G4X
vendor: ASUS
product: BMC firmware for RS700-E9-RS12
vendor: ASUS
product: BMC firmware for RS100-E10-PI2
vendor: ASUS
product: BMC firmware for RS300-E10-PS4
vendor: ASUS
product: BMC firmware for RS300-E10-RS4
vendor: ASUS
product: BMC firmware for RS500A-E9-PS4
vendor: ASUS
product: BMC firmware for RS500A-E9-RS4
vendor: ASUS
product: BMC firmware for RS500A-E9 RS4
vendor: ASUS
product: BMC firmware for E700 G4
vendor: ASUS
product: BMC firmware for WS C422 PRO/SE
vendor: ASUS
product: BMC firmware for WS X299 PRO/SE
vendor: ASUS
product: BMC firmware for Z11PA-U12
vendor: ASUS
product: BMC firmware for Z11PA-U12/10G-2S
vendor: ASUS
product: BMC firmware for KNPA-U16
vendor: ASUS
product: BMC firmware for ESC4000 DHD G4
vendor: ASUS
product: BMC firmware for ESC4000 G4
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS24-S
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS8
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS8-S
vendor: ASUS
product: BMC firmware for Z11PA-D8
vendor: ASUS
product: BMC firmware for Z11PA-D8C
vendor: ASUS
product: BMC firmware for RS720-E9-RS24-U
vendor: ASUS
product: BMC firmware for RS720-E9-RS8-G
vendor: ASUS
product: BMC firmware for RS500-E9-PS4
vendor: ASUS
product: BMC firmware for Pro E800 G4
vendor: ASUS
product: BMC firmware for RS500-E9-RS4
vendor: ASUS
product: BMC firmware for RS500-E9-RS4-U
vendor: ASUS
product: BMC firmware for RS520-E9-RS12-E
vendor: ASUS
product: BMC firmware for RS520-E9-RS8
vendor: ASUS
product: BMC firmware for ESC8000 G4
vendor: ASUS
product: BMC firmware for ESC8000 G4/10G
vendor: ASUS
product: BMC firmware for RS720-E9-RS12-E
vendor: ASUS
product: BMC firmware for WS C621E SAGE
vendor: ASUS
product: BMC firmware for RS500A-E10-PS4
vendor: ASUS
product: BMC firmware for RS500A-E10-RS4
vendor: ASUS
product: BMC firmware for RS700A-E9-RS12V2
vendor: ASUS
product: BMC firmware for RS700A-E9-RS4V2
vendor: ASUS
product: BMC firmware for RS720A-E9-RS12V2
vendor: ASUS
product: BMC firmware for RS720A-E9-RS24V2
vendor: ASUS
product: BMC firmware for Z11PR-D16
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-04-06T05:02:23.403Z
CVE-2021-28207 ASUS BMC's firmware: path traversal - Get Help file function
The specific function in ASUS BMC’s firmware Web management page (Get Help file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ASUS
product: BMC firmware for ASMB9-iKVM
vendor: ASUS
product: BMC firmware for RS720A-E9-RS24-E
vendor: ASUS
product: BMC firmware for RS700A-E9-RS4
vendor: ASUS
product: BMC firmware for RS700-E9-RS4
vendor: ASUS
product: BMC firmware for ESC4000 G4X
vendor: ASUS
product: BMC firmware for RS700-E9-RS12
vendor: ASUS
product: BMC firmware for RS100-E10-PI2
vendor: ASUS
product: BMC firmware for RS300-E10-PS4
vendor: ASUS
product: BMC firmware for RS300-E10-RS4
vendor: ASUS
product: BMC firmware for RS500A-E9-PS4
vendor: ASUS
product: BMC firmware for RS500A-E9-RS4
vendor: ASUS
product: BMC firmware for RS500A-E9 RS4
vendor: ASUS
product: BMC firmware for E700 G4
vendor: ASUS
product: BMC firmware for WS C422 PRO/SE
vendor: ASUS
product: BMC firmware for WS X299 PRO/SE
vendor: ASUS
product: BMC firmware for Z11PA-U12
vendor: ASUS
product: BMC firmware for Z11PA-U12/10G-2S
vendor: ASUS
product: BMC firmware for KNPA-U16
vendor: ASUS
product: BMC firmware for ESC4000 DHD G4
vendor: ASUS
product: BMC firmware for ESC4000 G4
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS24-S
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS8
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS8-S
vendor: ASUS
product: BMC firmware for Z11PA-D8
vendor: ASUS
product: BMC firmware for Z11PA-D8C
vendor: ASUS
product: BMC firmware for RS720-E9-RS24-U
vendor: ASUS
product: BMC firmware for RS720-E9-RS8-G
vendor: ASUS
product: BMC firmware for RS500-E9-PS4
vendor: ASUS
product: BMC firmware for Pro E800 G4
vendor: ASUS
product: BMC firmware for RS500-E9-RS4
vendor: ASUS
product: BMC firmware for RS500-E9-RS4-U
vendor: ASUS
product: BMC firmware for RS520-E9-RS12-E
vendor: ASUS
product: BMC firmware for RS520-E9-RS8
vendor: ASUS
product: BMC firmware for ESC8000 G4
vendor: ASUS
product: BMC firmware for ESC8000 G4/10G
vendor: ASUS
product: BMC firmware for RS720-E9-RS12-E
vendor: ASUS
product: BMC firmware for WS C621E SAGE
vendor: ASUS
product: BMC firmware for RS500A-E10-PS4
vendor: ASUS
product: BMC firmware for RS500A-E10-RS4
vendor: ASUS
product: BMC firmware for RS700A-E9-RS12V2
vendor: ASUS
product: BMC firmware for RS700A-E9-RS4V2
vendor: ASUS
product: BMC firmware for RS720A-E9-RS12V2
vendor: ASUS
product: BMC firmware for RS720A-E9-RS24V2
vendor: ASUS
product: BMC firmware for Z11PR-D16
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-04-06T05:02:24.218Z
CVE-2021-28208 ASUS BMC's firmware: path traversal - Get video file function
The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ASUS
product: BMC firmware for ASMB9-iKVM
vendor: ASUS
product: BMC firmware for RS720A-E9-RS24-E
vendor: ASUS
product: BMC firmware for RS700A-E9-RS4
vendor: ASUS
product: BMC firmware for RS700-E9-RS4
vendor: ASUS
product: BMC firmware for ESC4000 G4X
vendor: ASUS
product: BMC firmware for RS700-E9-RS12
vendor: ASUS
product: BMC firmware for RS100-E10-PI2
vendor: ASUS
product: BMC firmware for RS300-E10-PS4
vendor: ASUS
product: BMC firmware for RS300-E10-RS4
vendor: ASUS
product: BMC firmware for RS500A-E9-PS4
vendor: ASUS
product: BMC firmware for RS500A-E9-RS4
vendor: ASUS
product: BMC firmware for RS500A-E9 RS4
vendor: ASUS
product: BMC firmware for E700 G4
vendor: ASUS
product: BMC firmware for WS C422 PRO/SE
vendor: ASUS
product: BMC firmware for WS X299 PRO/SE
vendor: ASUS
product: BMC firmware for Z11PA-U12
vendor: ASUS
product: BMC firmware for Z11PA-U12/10G-2S
vendor: ASUS
product: BMC firmware for KNPA-U16
vendor: ASUS
product: BMC firmware for ESC4000 DHD G4
vendor: ASUS
product: BMC firmware for ESC4000 G4
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS24-S
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS8
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS8-S
vendor: ASUS
product: BMC firmware for Z11PA-D8
vendor: ASUS
product: BMC firmware for Z11PA-D8C
vendor: ASUS
product: BMC firmware for RS720-E9-RS24-U
vendor: ASUS
product: BMC firmware for RS720-E9-RS8-G
vendor: ASUS
product: BMC firmware for RS500-E9-PS4
vendor: ASUS
product: BMC firmware for Pro E800 G4
vendor: ASUS
product: BMC firmware for RS500-E9-RS4
vendor: ASUS
product: BMC firmware for RS500-E9-RS4-U
vendor: ASUS
product: BMC firmware for RS520-E9-RS12-E
vendor: ASUS
product: BMC firmware for RS520-E9-RS8
vendor: ASUS
product: BMC firmware for ESC8000 G4
vendor: ASUS
product: BMC firmware for ESC8000 G4/10G
vendor: ASUS
product: BMC firmware for RS720-E9-RS12-E
vendor: ASUS
product: BMC firmware for WS C621E SAGE
vendor: ASUS
product: BMC firmware for RS500A-E10-PS4
vendor: ASUS
product: BMC firmware for RS500A-E10-RS4
vendor: ASUS
product: BMC firmware for RS700A-E9-RS12V2
vendor: ASUS
product: BMC firmware for RS700A-E9-RS4V2
vendor: ASUS
product: BMC firmware for RS720A-E9-RS12V2
vendor: ASUS
product: BMC firmware for RS720A-E9-RS24V2
vendor: ASUS
product: BMC firmware for Z11PR-D16
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-04-06T05:02:25.088Z
CVE-2021-28209 ASUS BMC's firmware: path traversal - Delete video file function
The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ASUS
product: BMC firmware for ASMB9-iKVM
vendor: ASUS
product: BMC firmware for RS720A-E9-RS24-E
vendor: ASUS
product: BMC firmware for RS700A-E9-RS4
vendor: ASUS
product: BMC firmware for RS700-E9-RS4
vendor: ASUS
product: BMC firmware for ESC4000 G4X
vendor: ASUS
product: BMC firmware for RS700-E9-RS12
vendor: ASUS
product: BMC firmware for RS100-E10-PI2
vendor: ASUS
product: BMC firmware for RS300-E10-PS4
vendor: ASUS
product: BMC firmware for RS300-E10-RS4
vendor: ASUS
product: BMC firmware for RS500A-E9-PS4
vendor: ASUS
product: BMC firmware for RS500A-E9-RS4
vendor: ASUS
product: BMC firmware for RS500A-E9 RS4
vendor: ASUS
product: BMC firmware for E700 G4
vendor: ASUS
product: BMC firmware for WS C422 PRO/SE
vendor: ASUS
product: BMC firmware for WS X299 PRO/SE
vendor: ASUS
product: BMC firmware for Z11PA-U12
vendor: ASUS
product: BMC firmware for Z11PA-U12/10G-2S
vendor: ASUS
product: BMC firmware for KNPA-U16
vendor: ASUS
product: BMC firmware for ESC4000 DHD G4
vendor: ASUS
product: BMC firmware for ESC4000 G4
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS24-S
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS8
vendor: ASUS
product: BMC firmware for RS720Q-E9-RS8-S
vendor: ASUS
product: BMC firmware for Z11PA-D8
vendor: ASUS
product: BMC firmware for Z11PA-D8C
vendor: ASUS
product: BMC firmware for RS720-E9-RS24-U
vendor: ASUS
product: BMC firmware for RS720-E9-RS8-G
vendor: ASUS
product: BMC firmware for RS500-E9-PS4
vendor: ASUS
product: BMC firmware for Pro E800 G4
vendor: ASUS
product: BMC firmware for RS500-E9-RS4
vendor: ASUS
product: BMC firmware for RS500-E9-RS4-U
vendor: ASUS
product: BMC firmware for RS520-E9-RS12-E
vendor: ASUS
product: BMC firmware for RS520-E9-RS8
vendor: ASUS
product: BMC firmware for ESC8000 G4
vendor: ASUS
product: BMC firmware for ESC8000 G4/10G
vendor: ASUS
product: BMC firmware for RS720-E9-RS12-E
vendor: ASUS
product: BMC firmware for WS C621E SAGE
vendor: ASUS
product: BMC firmware for RS500A-E10-PS4
vendor: ASUS
product: BMC firmware for RS500A-E10-RS4
vendor: ASUS
product: BMC firmware for RS700A-E9-RS12V2
vendor: ASUS
product: BMC firmware for RS700A-E9-RS4V2
vendor: ASUS
product: BMC firmware for RS720A-E9-RS12V2
vendor: ASUS
product: BMC firmware for RS720A-E9-RS24V2
vendor: ASUS
product: BMC firmware for Z11PR-D16
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-04-06T05:02:25.860Z
CVE-2021-28210 
An unlimited recursion in DxeCore in EDK II.
Problem types: cwe_id: CWE-674
description: A case of CWE-674 is occurring in MdeModulePkg, which can lead to stack and heap corruption.
Affected products: vendor: TianoCore
product: EDK II
Published: 2021-06-11T15:11:23.000Z
CVE-2021-28211 
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.
Problem types: cwe_id: CWE-122
description: A case of CWE-122 is occurring in the LzmaUefiDecompressGetInfo function.
Affected products: vendor: TianoCore
product: EDK II
Published: 2021-06-11T15:11:23.000Z
CVE-2021-28213 
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.
Problem types: description: Replacing example EDK II encrypted private key stored in PcdIpsecUefiCertificateKey presents potential security risks that will expose manufacturer key pair in EDK II.
Affected products: vendor: TianoCore
product: EDK II
Published: 2021-06-11T15:11:23.000Z
CVE-2021-28216 
BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.
Problem types: cwe_id: CWE-587
description: A case of CWE-587 occurs in function FpdtStatusCodeListenerPei().
Affected products: vendor: TianoCore
product: EDK II
Published: 2021-08-05T20:44:13.000Z
CVE-2021-28233 
Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-27T18:34:18.000Z
CVE-2021-28235 
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-04T00:00:00.000Z
CVE-2021-28236 
LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T21:47:39.000Z
CVE-2021-28237 
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T21:47:40.000Z
CVE-2021-28242 
SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cf_name" parameter when creating a new filter under the "Collections" tab.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-15T13:51:23.000Z
CVE-2021-28245 
PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-31T13:32:10.000Z
CVE-2021-28246 
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T07:04:46.000Z
CVE-2021-28247 
CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the platform users. The affected endpoints are: cgi/nhWeb with the parameter report, aviewbin/filtermibobjects.pl with the parameter namefilter, and aviewbin/query.pl with the parameters System, SystemText, Group, and GroupText. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T07:09:37.000Z
CVE-2021-28248 
CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T07:14:33.000Z
CVE-2021-28249 
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a malicious library in the writable RPATH, to be dynamically linked when the FtpCollector executable is run. The code in the library will be executed as the root user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T07:11:42.000Z
CVE-2021-28250 
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the script code will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T07:18:47.000Z
CVE-2021-28254 
A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-18T00:00:00.000Z
CVE-2021-28269 
Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T14:59:30.000Z
CVE-2021-28271 
Soyal Technologies SOYAL 701Server 9.0.1 suffers from an elevation of privileges vulnerability which can be used by an authenticated user to change the executable file with a binary choice. The vulnerability is due to improper permissions with the 'F' flag (Full) for 'Everyone'and 'Authenticated Users' group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-27T12:51:17.000Z
CVE-2021-28275 
A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T00:00:00.000Z
CVE-2021-28276 
A Denial of Service vulnerability exists in jhead 3.04 and 3.05 via a wild address read in the ProcessCanonMakerNoteDir function in makernote.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T00:00:00.000Z
CVE-2021-28277 
A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T00:00:00.000Z
CVE-2021-28278 
A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in jpgfile.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T00:00:00.000Z
CVE-2021-28280 
CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T14:57:23.000Z
CVE-2021-28290 
A cross-site scripting (XSS) vulnerability in Skoruba IdentityServer4.Admin before 2.0.0 via unencoded value passed to the data-secret-value parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T17:34:34.000Z
CVE-2021-28293 
Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct configuration leads to recovery of the password reset link generated via the password reset functionality, and thus an unauthenticated attacker can set an arbitrary password for any user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-08T18:00:47.000Z
CVE-2021-28294 
Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php, which may lead to remote code execution (RCE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-16T19:54:20.000Z
CVE-2021-28295 
Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to database information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-16T19:54:31.000Z
CVE-2021-28300 
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to execute arbitrary code or cause a Denial-of-Service (DoS) by uploading a malicious MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:51:42.000Z
CVE-2021-28302 
A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-12T14:32:39.000Z
CVE-2021-28305 
An issue was discovered in the diesel crate before 1.4.6 for Rust. There is a use-after-free in the SQLite backend because the semantics of sqlite3_column_name are not followed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-12T08:15:58.000Z
CVE-2021-28306 
An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a multi label type if the image is nonexistent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-12T08:15:46.000Z