rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-33781 Azure AD Security Feature Bypass Vulnerability
Problem types: description: Security Feature Bypass
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1679:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1110:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 11 version 21H2
cpes: cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.258:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.258:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows 10 Version 1607
cpes: cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4704:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4704:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2016
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4704:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4704:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Published: 2021-07-14T17:53:53.000Z
CVE-2021-33784 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1679:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1110:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1110:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-07-14T17:53:56.000Z
CVE-2021-33785 Windows AF_UNIX Socket Provider Denial of Service Vulnerability
Problem types: description: Denial of Service
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2061:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 1909
cpes: cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1679:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1679:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows 10 Version 21H1
cpes: cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1110:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows 10 Version 2004
cpes: cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1110:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 10 Version 20H2
cpes: cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1110:*:*:*:*:*:arm64:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1110:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Published: 2021-07-14T17:53:57.000Z
CVE-2021-33786 Windows LSA Security Feature Bypass Vulnerability
Problem types: description: Security Feature Bypass
Affected products: vendor: Microsoft
product: Windows Server 2019
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server version 2004
cpes: cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server version 20H2
cpes: cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1110:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
cpes: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2008  Service Pack 2
cpes: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x86:*
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
cpes: cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25661:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25661:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012
cpes: cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23409:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23409:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 R2
cpes: cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20069:*:*:*:*:*:x64:*
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
cpes: cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20069:*:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Published: 2021-07-14T17:53:58.000Z
CVE-2021-33790 
The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-31T04:00:33.000Z
CVE-2021-33792 
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T17:14:06.000Z
CVE-2021-33793 
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during Office document conversion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T19:34:14.000Z
CVE-2021-33794 
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 allow information disclosure or an application crash after mishandling the Tab key during XFA form interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-11T19:28:25.000Z
CVE-2021-33795 
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document owner, and signature author are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T17:13:39.000Z
CVE-2021-33796 
In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.


Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: MuJS
product: MuJS
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 10
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2023-07-07T17:55:00.630Z
CVE-2021-33797 
Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when js_strtod() reads in floating point exponent, which leads to a buffer overflow in the pointer *d.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: mujs
Published: 2023-04-17T00:00:00.000Z
CVE-2021-33798 
A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and potential code execute via a crafted file.



Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: libpano13
product: libpano13
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: 2023-07-07T17:39:16.274Z
CVE-2021-33800 
In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: Druid
Published: 2021-11-03T19:09:33.000Z
CVE-2021-33806 
The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of its use of Java serialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T11:22:05.000Z
CVE-2021-33807 
Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-12T14:51:57.000Z
CVE-2021-33813 
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-16T11:18:14.000Z
CVE-2021-33815 
dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T00:00:00.000Z
CVE-2021-33816 
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-10T22:37:21.000Z
CVE-2021-33818 
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T18:38:03.000Z
CVE-2021-33820 
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T18:32:04.000Z
CVE-2021-33822 
An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T18:47:47.000Z
CVE-2021-33823 
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T19:02:06.000Z
CVE-2021-33824 
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T19:08:05.000Z
CVE-2021-33827 
The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-15T20:55:50.000Z
CVE-2021-33828 
The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share) are supposed to be deleted upon detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-15T20:54:30.000Z
CVE-2021-33829 
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-09T11:51:00.000Z
CVE-2021-33831 
api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can interfere with tracing of infection chains by creating 500 random users within 2500 seconds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T05:09:31.000Z
CVE-2021-33833 
ConnMan (aka Connection Manager) 1.30 through 1.39 has a stack-based buffer overflow in uncompress in dnsproxy.c via NAME, RDATA, or RDLENGTH (for A or AAAA).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-09T17:44:52.000Z
CVE-2021-33834 
An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-08T00:00:00.000Z
CVE-2021-33838 
Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T23:58:25.000Z
CVE-2021-33839 
Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T23:58:01.000Z
CVE-2021-33840 
The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Number data lacks a digital signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T23:57:32.000Z
CVE-2021-33841 Circutor SGE-PLC1000 OS command Injection
SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Circutor
product: SGE-PLC1000
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Industrial Cybersecurity team of S21sec, special mention to Aarón Flecha Menéndez.
Published: 2021-06-09T11:50:24.638Z
CVE-2021-33842 Circutor SGE-PLC1000 improper authentication
Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located.
Problem types: cwe_id: CWE-565
description: CWE-565 Reliance on Cookies without Validation and Integrity Checking
Affected products: vendor: Circutor
product: SGE-PLC1000
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Industrial Cybersecurity team of S21sec, special mention to Aarón Flecha Menéndez.
Published: 2021-06-09T11:39:52.302Z
CVE-2021-33843 Fresenius Kabi Agilia Connect Infusion System files or directories accessible to external parties
Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to change the exposed configuration values such as network settings.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Fresenius Kabi
product: Agilia Connect WiFi 
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Julian Suleder (ERNW Research GmbH), Nils Emmerich (ERNW Research GmbH), Raphael Pavlidis (ERNW Research GmbH), and Dr. Oliver Matula (ERNW Enno Rey Netzwerke GmbH) reported these vulnerabilities to the German Federal Office for Information Security (BSI) in the context of the BSI project ManiMed (Medical Device Manipulation Project).
Published: 2022-01-21T18:17:41.000Z
CVE-2021-33844 
A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause an application to crash.
Problem types: cwe_id: CWE-369
description: CWE-369 - Divide By Zero
Affected products: vendor: n/a
product: SoX (Sound eXchange)
Published: 2022-08-25T19:34:38.000Z
CVE-2021-33845 Username enumeration through lockout message in REST API
The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors.
Problem types: cwe_id: CWE-203
description: CWE-203
Affected products: vendor: Splunk
product: Splunk Enterprise
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Kyle Bambrick
Published: 2022-05-06T16:35:58.000Z