rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-45689 
An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:51:34.000Z
CVE-2021-45690 
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:51:15.000Z
CVE-2021-45691 
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:50:58.000Z
CVE-2021-45692 
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:50:50.000Z
CVE-2021-45693 
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:50:41.000Z
CVE-2021-45694 
An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:50:29.000Z
CVE-2021-45695 
An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:50:16.000Z
CVE-2021-45696 
An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:50:03.000Z
CVE-2021-45697 
An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:49:49.000Z
CVE-2021-45698 
An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:49:38.000Z
CVE-2021-45699 
An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:49:25.000Z
CVE-2021-45700 
An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:49:14.000Z
CVE-2021-45701 
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:49:03.000Z
CVE-2021-45702 
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:48:54.000Z
CVE-2021-45703 
An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:48:44.000Z
CVE-2021-45704 
An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:48:33.000Z
CVE-2021-45705 
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:48:21.000Z
CVE-2021-45706 
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:48:11.000Z
CVE-2021-45707 
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:48:02.000Z
CVE-2021-45708 
An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:47:45.000Z
CVE-2021-45709 
An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:47:32.000Z
CVE-2021-45710 
An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:47:20.000Z
CVE-2021-45711 
An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:47:07.000Z
CVE-2021-45712 
An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:46:50.000Z
CVE-2021-45713 
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_scalar_function has a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:46:38.000Z
CVE-2021-45714 
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_aggregate_function has a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:46:28.000Z
CVE-2021-45715 
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_window_function has a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:46:20.000Z
CVE-2021-45716 
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:46:02.000Z
CVE-2021-45717 
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commit_hook has a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:45:53.000Z
CVE-2021-45718 
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollback_hook has a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:45:39.000Z
CVE-2021-45719 
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. update_hook has a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:45:28.000Z
CVE-2021-45720 
An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-26T21:45:09.000Z
CVE-2021-45721 
JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to 7.29.8; JFrog Artifactory versions before 6.23.41 versions prior to 6.23.38.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: JFrog
product: JFrog Artifactory
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2022-07-06T09:15:11.000Z
CVE-2021-45729 WordPress WP Google Map plugin <= 1.8.0 - Privilege Escalation vulnerability
The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create, edit, and delete maps.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: WP Google Map
product: WP Google Map (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Nguyen Van Khanh (Patchstack Red Team)
Published: 2022-01-25T19:11:15.848Z
CVE-2021-45730 
JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: JFrog
product: Artifactory
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Published: 2022-05-19T14:30:10.000Z
CVE-2021-45732 
Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools, a user can reconfigure settings not intended to be manipulated, repackage the configuration, and restore a backup causing these settings to be changed.
Problem types: description: Hardcoded Credentials
Affected products: vendor: n/a
product: Netgear Nighthawk R6700
Published: 2021-12-30T21:31:20.000Z
CVE-2021-45733 
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the parameter host_time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:34:00.000Z
CVE-2021-45734 
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:59.000Z
CVE-2021-45735 
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via packet capture software.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:58.000Z
CVE-2021-45736 
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setL2tpServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the eip, sip, server parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:55.000Z
CVE-2021-45737 
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the Host parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:54.000Z
CVE-2021-45738 
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:53.000Z
CVE-2021-45739 
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the flag parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:53.000Z
CVE-2021-45740 
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the setWiFiWpsStart function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the pin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:52.000Z
CVE-2021-45741 
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setIpv6Cfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the relay6to4 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:51.000Z
CVE-2021-45742 
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:51.000Z
CVE-2021-45744 
A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:43:53.000Z
CVE-2021-45745 
A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:45:12.000Z
CVE-2021-45746 
A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T20:29:04.000Z
CVE-2021-45756 
Asus RT-AC68U <3.0.0.4.385.20633 and RT-AC5300 <3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T10:49:10.000Z
CVE-2021-45757 
ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T10:55:27.000Z
CVE-2021-45760 
GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function gf_list_last(). This vulnerability allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-13T00:00:00.000Z
CVE-2021-45761 
ROPium v3.1 was discovered to contain an invalid memory address dereference via the find() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T18:58:00.000Z
CVE-2021-45762 
GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function gf_sg_vrml_mf_reset(). This vulnerability allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T00:00:00.000Z
CVE-2021-45763 
GPAC v1.1.0 was discovered to contain an invalid call in the function gf_node_changed(). This vulnerability can lead to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T00:00:00.000Z
CVE-2021-45764 
GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function shift_chunk_offsets.isra().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T00:00:00.000Z
CVE-2021-45767 
GPAC 1.1.0 was discovered to contain an invalid memory address dereference via the function lsr_read_id(). This vulnerability can lead to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T00:00:00.000Z
CVE-2021-45769 
A NULL pointer dereference in AcseConnection_parseMessage at src/mms/iso_acse/acse.c of libiec61850 v1.5.0 can lead to a segmentation fault or application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T19:10:38.000Z
CVE-2021-45773 
A NULL pointer dereference in CS104_IPAddress_setFromString at src/iec60870/cs104/cs104_slave.c of lib60870 commit 0d5e76e can lead to a segmentation fault or application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T19:11:18.000Z
CVE-2021-45783 
Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T10:22:05.000Z
CVE-2021-45785 
TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has sufficient privileges), would visit the page and the server restart would begin. The attacker must know the full URL that TruDesk is on in order to craft the webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2021-45786 
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-16T12:29:54.000Z
CVE-2021-45787 
There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-16T12:38:41.000Z
CVE-2021-45788 
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T11:42:48.000Z
CVE-2021-45789 
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T11:51:55.000Z
CVE-2021-45790 
An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where attackers can write a cron job to execute commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T11:58:36.000Z
CVE-2021-45791 
Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin/modules/system/user_group.php, and /admin/modules/membership/index.php through the dir parameter. It can be used by remotely authenticated librarian users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T10:35:45.000Z
CVE-2021-45792 
Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T10:55:48.000Z
CVE-2021-45793 
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T11:12:50.000Z
CVE-2021-45794 
Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T11:16:56.000Z
CVE-2021-45802 
MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because the email and phone parameter values are added to the SQL query without any verification at the time of membership registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T12:56:31.000Z
CVE-2021-45803 
MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because this view parameter value is added to the SQL query without additional verification when viewing reservation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T12:56:37.000Z
CVE-2021-45806 
jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-13T13:47:37.000Z
CVE-2021-45807 
jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-13T18:22:45.000Z
CVE-2021-45808 
jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T12:51:44.000Z
CVE-2021-45809 
GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application. The way GlobalProtect-Openconnect is set up enables arbitrary users to execute commands as root by submitting the `--script=<script>` parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-22T10:30:20.000Z