rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Log4j2
Credits: lang: en
value: This issue was discovered by Chen Zhaojun of Alibaba Cloud Security Team.
Published: 2021-12-10T00:00:00.000Z
CVE-2021-44230 
PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. In this scenario, the compromised account may have inherited read access to sensitive configuration, database, and log files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T18:17:35.000Z
CVE-2021-44231 
Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
Problem types: description: Code injection
Affected products: vendor: SAP SE
product: SAP ABAP Server & ABAP Platform (Translation Tools)
Published: 2021-12-14T15:44:08.000Z
CVE-2021-44232 
SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.
Problem types: description: Path Traversal
Affected products: vendor: SAP SE
product: SAF-T Framework
Published: 2021-12-14T15:44:10.000Z
CVE-2021-44233 
SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: SAP SE
product: SAP GRC Access Control
Published: 2021-12-14T15:44:08.000Z
CVE-2021-44234 
SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Problem types: cwe_id: CWE-532
description: CWE-532
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2022-01-14T19:11:27.000Z
CVE-2021-44235 
Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This could allow execution of arbitrary commands on the operating system, that could highly impact the Confidentiality, Integrity and Availability of the system.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP
Published: 2021-12-14T15:44:09.000Z
CVE-2021-44238 
AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE) via /aya/module/admin/ust_tab_e.inc.php,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T14:55:53.000Z
CVE-2021-44244 
An SQL Injection vulnerabiity exists in Sourcecodester Logistic Hub Parcel's Management System 1.0 via the username parameter in login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T18:12:53.000Z
CVE-2021-44245 
An SQL Injection vulnerability exists in Courcecodester COVID 19 Testing Management System (CTMS) 1.0 via the (1) username and (2) contactno parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T18:38:04.000Z
CVE-2021-44246 
Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain a stack overflow in the function setNoticeCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IpTo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:34:03.000Z
CVE-2021-44247 
Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability allows attackers to execute arbitrary commands via the IpFrom parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:34:03.000Z
CVE-2021-44249 
Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal. This can lead attackers to remotely dump MySQL database credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T14:37:40.000Z
CVE-2021-44255 
Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-31T11:18:20.000Z
CVE-2021-44259 
A vulnerability is in the 'wx.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When an unauthorized user accesses this page directly, it connects to this device as a friend of the device owner.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T12:13:55.000Z
CVE-2021-44260 
A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information of the manager of router.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T12:11:10.000Z
CVE-2021-44261 
A vulnerability is in the 'BRS_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any authentication. When processed, it exposes firmware version information for the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T12:24:14.000Z
CVE-2021-44262 
A vulnerability is in the 'MNU_top.htm' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information for the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T12:21:44.000Z
CVE-2021-44263 
Gurock TestRail before 7.2.4 mishandles HTML escaping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-20T08:28:49.000Z
CVE-2021-44266 
GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-11T14:50:50.000Z
CVE-2021-44269 
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-10T16:13:27.000Z
CVE-2021-44273 
e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-23T00:00:00.000Z
CVE-2021-44277 
Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T13:36:17.000Z
CVE-2021-44278 
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-03T12:39:36.000Z
CVE-2021-44279 
Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T13:09:01.000Z
CVE-2021-44280 
attendance management system 1.0 is affected by a SQL injection vulnerability in admin/incFunctions.php through the makeSafe function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T12:42:30.000Z
CVE-2021-44283 
A buffer overflow in the component /Enclave.cpp of Electronics and Telecommunications Research Institute ShieldStore commit 58d455617f99705f0ffd8a27616abdf77bdc1bdc allows attackers to cause an information leak via a crafted structure from an untrusted operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-09T00:00:00.000Z
CVE-2021-44299 
A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of Navigate CMS v2.9.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T17:45:43.000Z
CVE-2021-44302 
BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidu_map parameters in /user/ztconfig.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:52:47.000Z
CVE-2021-44310 
An issue was discovered in Firmware Analysis and Comparison Tool v3.2. With administrator privileges, the attacker could perform stored XSS attacks by inserting JavaScript and HTML code in user creation functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T16:38:29.000Z
CVE-2021-44312 
An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T16:39:58.000Z
CVE-2021-44315 
In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which contains sensitive information of the user or server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T18:21:17.000Z
CVE-2021-44317 
In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T18:26:11.000Z
CVE-2021-44321 
Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery (CSRF), where an attacker can update/delete items in the inventory. The attacker must be logged into the application create a malicious file for updating the inventory details and items.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-04T12:31:17.000Z
CVE-2021-44331 
ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T16:29:10.000Z
CVE-2021-44334 
David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function ok_jpg_convert_YCbCr_to_RGB() in "/ok_jpg.c:513" .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T14:20:44.000Z
CVE-2021-44335 
David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function ok_png_transform_scanline() in "/ok_png.c:533".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:13:28.000Z
CVE-2021-44339 
David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_png_transform_scanline() in "/ok_png.c:712".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T15:24:33.000Z
CVE-2021-44340 
David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_jpg_generate_huffman_table() in "/ok_jpg.c:403".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T15:50:53.000Z
CVE-2021-44342 
David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok_png_transform_scanline() in "/ok_png.c:494".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T16:18:16.000Z
CVE-2021-44343 
David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_png_read_data() in "/ok_png.c".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:23:10.000Z
CVE-2021-44345 
Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-20T15:59:45.000Z
CVE-2021-44347 
SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-03T18:55:33.000Z
CVE-2021-44348 
SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-03T19:01:46.000Z
CVE-2021-44349 
SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-03T19:05:34.000Z
CVE-2021-44350 
SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T22:09:06.000Z
CVE-2021-44351 
An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate_download.php id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T11:37:24.000Z
CVE-2021-44352 
A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18_multi device via the list parameter in a post request in goform/SetIpMacBind.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-03T18:31:35.000Z
CVE-2021-44354 
Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Reolink
product: RLC-410W
Published: 2022-04-14T19:56:23.213Z
CVE-2021-44355 
Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Reolink
product: RLC-410W
Published: 2022-04-14T19:56:24.787Z
CVE-2021-44356 
Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Reolink
product: RLC-410W
Published: 2022-04-14T19:56:26.219Z
CVE-2021-44357 
Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Reolink
product: RLC-410W
Published: 2022-04-14T19:56:27.654Z
CVE-2021-44358 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetRec param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:13.000Z
CVE-2021-44359 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetCrop param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:14.000Z
CVE-2021-44360 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetNorm param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:16.000Z
CVE-2021-44361 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Set3G param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:16.000Z
CVE-2021-44362 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetCloudSchedule param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:17.000Z
CVE-2021-44363 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPush param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:18.000Z
CVE-2021-44364 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetWifi param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:19.000Z
CVE-2021-44365 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetDevName param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:19.000Z
CVE-2021-44366 
Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Reolink
product: RLC-410W
Published: 2022-04-14T19:56:29.333Z
CVE-2021-44367 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetUpnp param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:20.000Z
CVE-2021-44368 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetNetPort param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:21.000Z
CVE-2021-44369 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetNtp param is not object. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T21:42:22.000Z