rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-45329 
Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-08T22:26:52.000Z
CVE-2021-45330 
An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-09T17:16:16.000Z
CVE-2021-45331 
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-09T17:22:44.000Z
CVE-2021-45334 
Sourcecodester Online Thesis Archiving System 1.0 is vulnerable to SQL Injection. An attacker can bypass admin authentication and gain access to admin panel using SQL Injection
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-09T18:57:05.000Z
CVE-2021-45335 
Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or delete arbitrary system files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T12:29:43.000Z
CVE-2021-45336 
Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using system IPC interfaces which could lead to exit the sandbox and acquire SYSTEM privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T12:35:42.000Z
CVE-2021-45337 
Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by "hollowing" process wsc_proxy.exe which could lead to acquire antimalware (AM-PPL) protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T12:44:28.000Z
CVE-2021-45338 
Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of the main antivirus service which could lead to the (1) arbitrary file delete, (2) write and (3) reset security.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T12:53:00.000Z
CVE-2021-45339 
Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could lead to the bypassing of Avast self-defense.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T12:57:43.000Z
CVE-2021-45340 
In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T11:36:09.000Z
CVE-2021-45341 
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T00:00:00.000Z
CVE-2021-45342 
A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T00:00:00.000Z
CVE-2021-45343 
In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T00:00:00.000Z
CVE-2021-45345 
Buffer Overflow vulnerability found in En3rgy WebcamServer v.0.5.2 allows a remote attacker to cause a denial of service via the WebcamServer.exe file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-10T00:00:00.000Z
CVE-2021-45346 
A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T00:00:00.000Z
CVE-2021-45347 
An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T18:35:48.000Z
CVE-2021-45348 
An Arbitrary File Deletion vulnerability exists in SourceCodester Attendance Management System v1.0 via the csv parameter in admin/pageUploadCSV.php, which can cause a Denial of Service (crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T19:31:31.000Z
CVE-2021-45357 
Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-10T17:38:27.000Z
CVE-2021-45364 
A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publishing this CVE Record, and that all parties agree that the affected code was not used in any Statamic product
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-10T18:38:12.000Z
CVE-2021-45379 
Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-30T17:35:11.000Z
CVE-2021-45380 
AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inc_head.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-23T16:09:29.000Z
CVE-2021-45382 
A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-17T20:07:46.000Z
CVE-2021-45385 
A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load(). When the size information in metadata of the bmp is out of range, it returns without assign memory buffer to `pb->pdata` and did not exit the program. So the program crashes when it tries to access the pb->data, in jfif_encode() at jfif.c:763. This is due to the incomplete patch for CVE-2020-13438.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T15:18:09.000Z
CVE-2021-45386 
tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T00:00:00.000Z
CVE-2021-45387 
tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T00:00:00.000Z
CVE-2021-45389 
A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-04T15:40:34.000Z
CVE-2021-45391 
A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in the goform/setIPv6Status binary file /usr/sbin/httpd via the conType parameter, which causes a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T13:13:26.000Z
CVE-2021-45392 
A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the prefixDelegate parameter, which causes a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T16:25:58.000Z
CVE-2021-45394 
An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T11:15:45.000Z
CVE-2021-45401 
A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T17:31:46.000Z
CVE-2021-45402 
The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T14:36:29.000Z
CVE-2021-45406 
In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T19:25:16.000Z
CVE-2021-45408 
Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T19:43:01.000Z
CVE-2021-45411 
In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload vulnerability to obtain remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T16:34:41.000Z
CVE-2021-45414 
A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Docker environment or Java driver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T20:14:20.000Z
CVE-2021-45416 
Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-01T12:44:53.000Z
CVE-2021-45417 
AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T00:00:00.000Z
CVE-2021-45418 
Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet <=1.3.0.0.6 - Fixed: 1.3.0.0.9 and Titan 180 Premium <=1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T15:56:14.000Z
CVE-2021-45419 
Certain Starcharge products are affected by Improper Input Validation. The affected products include: Nova 360 Cabinet <= 1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0 and Titan 180 Premium <= 1.3.0.0.6 - Fixed: 1.3.0.0.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T16:22:04.000Z
CVE-2021-45420 
Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T13:08:52.000Z
CVE-2021-45421 
Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported since 2018 and should be removed or replaced
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T13:08:45.000Z
CVE-2021-45422 
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process "count" parameter via GET. No authentication is required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-13T18:15:03.000Z
CVE-2021-45423 
A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c.. The array offsets_to_Names is dynamically allocated on the stack using exp->NumberOfFunctions as its size. However, the loop uses exp->NumberOfNames to iterate over it and set its components value. Therefore, the loop code assumes that exp->NumberOfFunctions is greater than ordinal at each iteration. This can lead to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-13T00:00:00.000Z
CVE-2021-45425 
Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-28T12:21:22.000Z
CVE-2021-45427 
Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-30T11:10:01.000Z
CVE-2021-45428 
TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-03T13:25:27.000Z
CVE-2021-45429 
A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr_set_configuration in yara/libyara/libyara.c, which could cause a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T18:09:54.000Z
CVE-2021-45435 
An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the username field in login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T14:05:13.000Z
CVE-2021-45440 
A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on-prem versions only) could allow a local attacker to abuse an impersonation privilege and elevate to a higher level of privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Unnecessary Privileges Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2022-01-08T15:51:06.000Z
CVE-2021-45441 
A origin validation error vulnerability in Trend Micro Apex One (on-prem and SaaS) could allow a local attacker drop and manipulate a specially crafted file to issue commands over a certain pipe and elevate to a higher level of privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Origin Validation Error Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2022-01-08T15:51:07.000Z
CVE-2021-45442 
A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow a local attacker to overwrite arbitrary files in the context of SYSTEM. This is similar to, but not the same as CVE-2021-44024. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Link Following Denial-of-Service
Affected products: vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2022-01-08T15:51:08.000Z
CVE-2021-45444 
In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-13T05:32:21.000Z
CVE-2021-45445 
Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T17:44:37.000Z
CVE-2021-45446  Pentaho Business Analytics Server - Exposure of Information Through Directory Listing
A vulnerability in 

Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 
8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located 
inside the directory. 



Problem types: cwe_id: CWE-548
description: CWE-548
Affected products: vendor: Hitachi Vantara
product: Pentaho Business Analytics Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Published: 2022-11-02T14:26:02.105Z
CVE-2021-45447  Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text

Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 
8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.  

The transmission of sensitive data in clear text allows unauthorized actors with access to the 
network to sniff and obtain sensitive information that can be later used to gain unauthorized 
access.



Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Hitachi Vantara
product: Pentaho Business Analytics Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2022-11-02T14:56:01.585Z
CVE-2021-45448 Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which  allows a user supplied path to access resources that are out of bounds.
Pentaho Business Analytics
 Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho 
Analyzer plugin exposes a service endpoint for templates which allows a 
user-supplied path to access resources that are out of bounds. 

The software uses external input to construct a pathname that is intended to identify a file or 
directory that is located underneath a restricted parent directory, but the software does not 
properly neutralize special elements within the pathname that can cause the pathname to 
resolve to a location that is outside of the restricted directory.  By using special elements such as 
".." and "/" separators, attackers can escape outside of the restricted 
location to access files or directories that are elsewhere on the 
system.




Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Hitachi Vantara
product: Pentaho Business Analytics Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-11-02T15:12:25.164Z
CVE-2021-45449 
Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T19:29:49.000Z
CVE-2021-45450 
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T00:00:00.000Z
CVE-2021-45451 
In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T00:00:00.000Z
CVE-2021-45452 
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-04T23:09:40.000Z
CVE-2021-45454 
Ampere Altra before SRP 1.08b and Altra Max​ before SRP 2.05 allow information disclosure of power telemetry via HWmon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-17T12:46:05.000Z