rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-30006 
In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-11T11:24:23.000Z
CVE-2021-30014 
There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC from v0.9.0-preview to 1.0.1 which results in a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T19:34:08.000Z
CVE-2021-30015 
There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1. The pid comes from function av1dmx_parse_flush_sample, the ctx.opid maybe NULL. The result is a crash in gf_filter_pck_new_alloc_internal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T19:34:08.000Z
CVE-2021-30019 
In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a heap overflow in the memcpy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T19:34:08.000Z
CVE-2021-30020 
In the function gf_hevc_read_pps_bs_internal function in media_tools/av_parsers.c in GPAC 1.0.1 there is a loop, which with crafted file, pps->num_tile_columns may be larger than sizeof(pps->column_width), which results in a heap overflow in the loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T19:34:08.000Z
CVE-2021-30022 
There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC from 0.5.2 to 1.0.1. pps_id may be a negative number, so it will not return. However, avc->pps only has 255 unit, so there is an overflow, which results a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T19:34:08.000Z
CVE-2021-30027 
md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T14:29:19.000Z
CVE-2021-30028 
SOOTEWAY Wi-Fi Range Extender v1.5 was discovered to use default credentials (the admin password for the admin account) to access the TELNET service, allowing attackers to erase/read/write the firmware remotely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T14:54:11.000Z
CVE-2021-30030 
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T23:06:34.000Z
CVE-2021-30034 
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T23:06:32.000Z
CVE-2021-30039 
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T23:06:23.000Z
CVE-2021-30042 
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T23:06:26.000Z
CVE-2021-30044 
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T23:06:29.000Z
CVE-2021-30045 
SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T12:09:17.000Z
CVE-2021-30046 
VIGRA Computer Vision Library Version-1-11-1 contains a segmentation fault vulnerability in the impex.hxx read_image_band() function, in which a crafted file can cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-06T12:09:38.000Z
CVE-2021-30047 
VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2021-30048 
Directory Traversal in the fileDownload function in com/java2nb/common/controller/FileController.java in Novel-plus (小说精品屋-plus) 3.5.1 allows attackers to read arbitrary files via the filePath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T16:21:09.000Z
CVE-2021-30049 
SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T11:54:48.000Z
CVE-2021-30055 
A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-05T10:45:58.000Z
CVE-2021-30056 
Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-05T10:45:52.000Z
CVE-2021-30057 
A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-05T10:45:45.000Z
CVE-2021-30058 
Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBI_HOST' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-05T10:45:40.000Z
CVE-2021-30061 
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, physically proximate attackers can execute code via a crafted file on a USB stick.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T21:46:05.000Z
CVE-2021-30062 
On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can bypass the OPC enforcer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T21:49:39.000Z
CVE-2021-30063 
On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can cause an OPC enforcer denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T21:52:45.000Z
CVE-2021-30064 
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can succeed with hardcoded default credentials (if the device is in the uncommissioned state).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T21:56:29.000Z
CVE-2021-30065 
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus packets can bypass the ModBus enforcer. NOTE: this issue exists because of an incomplete fix of CVE-2017-11401.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:N/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2022-04-03T21:59:18.000Z
CVE-2021-30066 
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification (for a USB stick) can be bypassed. NOTE: this issue exists because of an incomplete fix of CVE-2017-11400.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T22:01:59.000Z
CVE-2021-30070 
An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T04:16:34.000Z
CVE-2021-30071 
A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T04:16:53.000Z
CVE-2021-30072 
An issue was discovered in prog.cgi on D-Link DIR-878 1.30B08 devices. Because strcat is misused, there is a stack-based buffer overflow that does not require authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T19:55:08.000Z
CVE-2021-30074 
docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T20:40:10.000Z
CVE-2021-30080 
An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T15:37:04.000Z
CVE-2021-30081 
An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via admin/navbar.php?action=add_page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:50:30.000Z
CVE-2021-30082 
An issue was discovered in Gris CMS v0.1. There is a Persistent XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via admin/dashboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:50:41.000Z
CVE-2021-30083 
An issue was discovered in Mediat 1.4.1. There is a Reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML without authentication via the 'return' parameter in login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:50:50.000Z
CVE-2021-30086 
Cross Site Scripting (XSS) vulnerability exists in KindEditor (Chinese versions) 4.1.12, which can be exploited by an attacker to obtain user cookie information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T18:17:24.000Z
CVE-2021-30108 
Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T19:27:25.000Z
CVE-2021-30109 
Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-05T12:52:17.000Z
CVE-2021-30110 
dttray.exe in Greyware Automation Products Inc Domain Time II before 5.2.b.20210331 allows remote attackers to execute arbitrary code via a URL to a malicious update in a spoofed response to the UDP query used to check for updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T12:05:12.000Z
CVE-2021-30111 
A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields. An attack can inject a JavaScript code that will be stored in the page. If any visitor sees the events, then the payload will be executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T11:16:36.000Z
CVE-2021-30112 
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student_leave_application request through module/core/studentleaveapplication/create. The application fails to validate the CSRF token for a POST request using Guardian privilege.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T11:13:53.000Z
CVE-2021-30113 
A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attacker website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T11:12:20.000Z
CVE-2021-30114 
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment request through module/accounting/voucher/create. The application fails to validate the CSRF token for a POST request using admin privilege.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T11:09:50.000Z
CVE-2021-30116 Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Wietse Boonstra of DIVD
lang: en
value: Additional research by Frank Breedijk of DIVD
Published: 2021-07-09T00:00:00.000Z
CVE-2021-30117 Authenticated SQL injection in Kaseya VSA < v9.5.6
The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: ``` GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Where the sessionId cookie value has been obtained via CVE-2021-30116. The result should be a failure. Response: ``` HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/html; Charset=Utf-8 Date: Thu, 01 Apr 2021 19:12:11 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 881 <!DOCTYPE html> <HTML> <HEAD> <title>Whoops.</title> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <link id="favIcon" rel="shortcut icon" href="/themes/default/images/favicon.ico?307447361"></link> ----SNIP---- ``` However when fldrId is set to ‘(SELECT (CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END))’ the request is allowed. Request: ``` GET /InstallTab/exportFldr.asp?fldrId=%28SELECT%20%28CASE%20WHEN%20%281%3D1%29%20THEN%201%20ELSE%20%28SELECT%201%20UNION%20SELECT%202%29%20END%29%29 HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA; sessionId=30548861; agentguid=840997037507813; vsaUser=scopeId=3&roleId=2; webWindowId=59091519; ``` Response: ``` HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; Charset=Utf-8 Date: Thu, 01 Apr 2021 17:33:53 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains Connection: close Content-Length: 7960 <html> <head> <title>Export Folder</title> <style> ------ SNIP ----- ```
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Discovered by Wietse Boonstra of DIVD
lang: en
value: Additional research by Frank Breedijk of DIVD
Published: 2021-07-09T13:18:21.000Z
CVE-2021-30119 Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6
Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Discovered by Wietse Boonstra of DIVD
lang: en
value: Additional research by Frank Breedijk and Hidde Smit of DIVD
Published: 2021-07-09T13:20:58.000Z
CVE-2021-30120 2FA bypass in Kaseya VSA <= v9.5.6
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Discovered by Wietse Boonstra of DIVD
Published: 2021-07-09T13:22:17.000Z
CVE-2021-30121 (Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6
Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Discovered by Wietse Boonstra of DIVD
lang: en
value: Additional research by Frank Breedijk of DIVD
Published: 2021-07-09T13:24:28.000Z
CVE-2021-30123 
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-07T19:16:02.000Z
CVE-2021-30124 
The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-29T10:27:18.000Z
CVE-2021-30125 
Jamf Pro before 10.28.0 allows XSS related to inventory history, aka PI-009376.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T19:19:39.000Z
CVE-2021-30126 
Lightmeter ControlCenter 1.1.0 through 1.5.x before 1.5.1 allows anyone who knows the URL of a publicly available Lightmeter instance to access application settings, possibly including an SMTP password and a Slack access token, via a settings HTTP query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T19:36:08.000Z
CVE-2021-30127 
TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistent with the "It is only available on the local network" documentation. NOTE: manually editing /etc/upnp.json provides a partial but undocumented workaround.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-03T17:08:16.000Z