rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-33846 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users.
Problem types: cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Fresenius Kabi
product: Vigilant Software Suite (Mastermed Dashboard)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Julian Suleder (ERNW Research GmbH), Nils Emmerich (ERNW Research GmbH), Raphael Pavlidis (ERNW Research GmbH), and Dr. Oliver Matula (ERNW Enno Rey Netzwerke GmbH) reported these vulnerabilities to the German Federal Office for Information Security (BSI) in the context of the BSI project ManiMed (Medical Device Manipulation Project).
Published: 2022-01-21T18:17:37.000Z
CVE-2021-33847 
Improper buffer restrictions in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products
Published: 2022-08-18T19:43:51.000Z
CVE-2021-33848 Fresenius Kabi Agilia Connect Infusion System cross site scripting
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject JavaScript in a GET parameter of HTTP requests and perform unauthorized actions such as stealing internal information and performing actions in context of an authenticated user.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Fresenius Kabi
product: Vigilant Software Suite (Mastermed Dashboard)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Julian Suleder (ERNW Research GmbH), Nils Emmerich (ERNW Research GmbH), Raphael Pavlidis (ERNW Research GmbH), and Dr. Oliver Matula (ERNW Enno Rey Netzwerke GmbH) reported these vulnerabilities to the German Federal Office for Information Security (BSI) in the context of the BSI project ManiMed (Medical Device Manipulation Project).
Published: 2022-01-21T18:17:43.000Z
CVE-2021-33849 
A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload executes whenever the user changes the form values or deletes a created form in Zoho CRM Lead Magnet Version 1.7.2.4.
Problem types: description: Improper Neutralization of Input During Web Page Generation
Affected products: vendor: Zoho
product: Zoho CRM Lead Magnet
Published: 2021-10-05T21:43:47.000Z
CVE-2021-33850 
There is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3. The XSS payload executes whenever the user changes the clarity configuration in Microsoft Clarity version 0.3. The payload is stored on the configuring project Id page.
Problem types: description: Improper Neutralization of Input During Web Page Generation
Affected products: vendor: n/a
product: Microsoft Clarity
Published: 2021-11-19T15:52:43.000Z
CVE-2021-33851 
A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: WordPress Customize Login Image Plugin
Published: 2022-03-09T16:54:38.000Z
CVE-2021-33852 
A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Duplicate Title" text box executes whenever the user opens the Settings Page of the Post Duplicator Plugin or the application root page after duplicating any of the existing posts.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: WordPress Post Duplicator Plugin
Published: 2022-03-09T16:54:43.000Z
CVE-2021-33853 
A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS payload is executed when the user attempts to access any page of the CRM.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: X2CRM
Published: 2022-03-16T14:03:37.000Z
CVE-2021-33879 
Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only integrity check would be a comparison of the downloaded file's MD5 checksum to the one contained within the XML document, the downloaded executable would then be executed on the victim's machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-06T19:25:23.000Z
CVE-2021-33880 
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-06T14:05:45.000Z
CVE-2021-33881 
On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-06T15:33:44.000Z
CVE-2021-33882 
A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:N/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2021-08-25T11:19:46.000Z
CVE-2021-33883 
A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:N/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-08-25T11:19:53.000Z
CVE-2021-33884 
An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:U/UI:N
version: 3.1
Published: 2021-08-25T11:20:00.000Z
CVE-2021-33885 
An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2021-08-25T11:38:20.000Z
CVE-2021-33886 
An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-08-25T11:38:25.000Z
CVE-2021-33887 
Insufficient verification of data authenticity in Peloton TTR01 up to and including PTV55G allows an attacker with physical access to boot into a modified kernel/ramdisk without unlocking the bootloader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-15T18:45:45.000Z
CVE-2021-33889 
OpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data type for metric_len.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T18:34:38.000Z
CVE-2021-33894 
In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and/or execute SQL statements that alter or delete database elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-09T18:30:19.000Z
CVE-2021-33895 
ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI application, the system procedure (USER_AUTHENTICATE_) used for verifying the Password returns 0 (no error). The reason is that the user is not running the XYGate application. Hence, BBSV assumes the Password is correct. For H4.09, the affected version isT0954V04^AAO. For E4.09, the affected version is 22SEP2020. Note: If your current version is E4.10-16MAY2021 (version procedure T9999V04_16MAY2022_BPAKETI_10), a hotfix (FIXPAK-19OCT-2022) is available in version E4.10-19OCT2022. Resolution to CVE-2021-33895 in version E4.11-19OCT2022
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-25T00:00:00.000Z
CVE-2021-33896 
Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-07T18:12:07.000Z
CVE-2021-33897 
A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes. This file is mishandled during a deletion attempt. In Synthesia before 10.9, an improper path handling allows local attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-17T00:00:00.000Z
CVE-2021-33898 
In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-06T22:28:22.000Z
CVE-2021-33900 StartTLS and SASL confidentiality protection bypass
While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: Apache Software Foundation
product: Apache Directory Studio
Credits: lang: en
value: Apache Directory would like to thank Hugh Cole-Baker for reporting this issue.
Published: 2021-07-26T07:05:10.000Z
CVE-2021-33903 
In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. (However, changing the password of the root user via LANconfig does change the password of the root user for SNMPv3 access.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T14:48:15.000Z
CVE-2021-33904 
In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-07T11:40:46.000Z
CVE-2021-33907 
The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when performing an update of the client. This could lead to remote code execution in an elevated privileged context.
Problem types: description: Improper Verification of Crypto Signature
Affected products: vendor: n/a
product: Zoom Client for Meetings for Windows
Published: 2021-09-27T13:55:30.000Z
CVE-2021-33909 
fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-20T18:01:34.000Z
CVE-2021-33910 
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-20T18:13:49.000Z
CVE-2021-33911 
Zoho ManageEngine ADManager Plus before 7110 allows remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-17T18:19:27.000Z
CVE-2021-33912 
libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T00:00:00.000Z
CVE-2021-33913 
libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data depends on the relationship between the length of an entire domain name and the length of its leftmost label. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T00:00:00.000Z
CVE-2021-33923 
Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-29T09:44:19.000Z
CVE-2021-33924 
Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-29T09:44:26.000Z
CVE-2021-33925 
SQL Injection vulnerability in nitinparashar30 cms-corephp through commit bdabe52ef282846823bda102728a35506d0ec8f9 (May 19, 2021) allows unauthenticated attackers to gain escilated privledges via a crafted login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-15T00:00:00.000Z
CVE-2021-33926 
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2021-33928 
Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-02T14:58:05.000Z
CVE-2021-33929 
Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-02T14:58:11.000Z
CVE-2021-33930 
Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-02T14:58:13.000Z
CVE-2021-33938 
Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-02T14:58:15.000Z
CVE-2021-33945 
RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SNw, SP 221SNw, SP 221SF, SP 220SFNw, SP 221SFNw v1.06 were discovered to contain a stack buffer overflow in the file /etc/wpa_supplicant.conf. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-15T19:08:26.000Z
CVE-2021-33948 
SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2021-33949 
An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2021-33950 
An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2021-33959 
Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-18T00:00:00.000Z
CVE-2021-33961 
A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-22T20:23:39.000Z
CVE-2021-33962 
China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/pop_usb_device component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T11:49:58.000Z
CVE-2021-33963 
China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/mac_addr_clone receives parameters by POST request, and the parameter macType has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-15T09:16:29.000Z
CVE-2021-33964 
China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/set_firewall_level which receives parameters by POST request, and the parameter firewall_level has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T11:26:52.000Z