rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-42554 
An issue was discovered in Insyde InsydeH2O with Kernel 5.0 before 05.08.42, Kernel 5.1 before 05.16.42, Kernel 5.2 before 05.26.42, Kernel 5.3 before 05.35.42, Kernel 5.4 before 05.42.51, and Kernel 5.5 before 05.50.51. An SMM memory corruption vulnerability in FvbServicesRuntimeDxe allows a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-03T01:40:56.000Z
CVE-2021-42555 
Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-15T16:28:01.000Z
CVE-2021-42556 
Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model archive, an attacker has arbitrary write capability within specific directories via a crafted archive file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T18:36:14.000Z
CVE-2021-42557 
In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T11:14:56.000Z
CVE-2021-42558 
An issue was discovered in CALDERA 2.8.1. It contains multiple reflected, stored, and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T19:06:45.000Z
CVE-2021-42559 
An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T19:11:03.000Z
CVE-2021-42560 
An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks (e.g., File Exfiltration, Server Side Request Forgery, Out of Band Exfiltration, etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T18:58:06.000Z
CVE-2021-42561 
An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters (e.g., backticks "``" or dollar parenthesis "$()" ) in order to escape the current command and execute arbitrary shell commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T18:52:40.000Z
CVE-2021-42562 
An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T18:46:00.000Z
CVE-2021-42563 
There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T20:48:49.000Z
CVE-2021-42564 
An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to provide confidential messages via Cryptshare) to redirect targeted victims to any URL via the '<meta http-equiv="refresh"' substring in the editor parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T19:15:16.000Z
CVE-2021-42565 
myfactory.FMS before 7.1-912 allows XSS via the UID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T07:24:10.000Z
CVE-2021-42566 
myfactory.FMS before 7.1-912 allows XSS via the Error parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T07:24:01.000Z
CVE-2021-42567 
Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T21:10:49.000Z
CVE-2021-42568 
Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-02T12:42:39.000Z
CVE-2021-42574 
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T00:00:00.000Z
CVE-2021-42575 
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T14:38:13.000Z
CVE-2021-42576 
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T14:36:43.000Z
CVE-2021-42577 
An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-11T22:09:25.000Z
CVE-2021-42580 
Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and authenticated file upload in (Master.php) file , we can craft these two vunlerablities to get unauthenticated remote command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-15T15:57:28.000Z
CVE-2021-42581 
Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-10T10:08:13.000Z
CVE-2021-42583 
A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-28T18:12:42.000Z
CVE-2021-42584 
A Stored Cross Site Scripting (XSS) issue exists in Convos-Chat before 6.32.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-17T13:02:26.000Z
CVE-2021-42585 
A heap buffer overflow was discovered in copy_compressed_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T10:35:43.000Z
CVE-2021-42586 
A heap buffer overflow was discovered in copy_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T10:39:30.000Z
CVE-2021-42597 
A Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Storage Unit Rental Management System PHP 8.0.10 , Apache 2.4.14, SURMS V 1.0 via the Add New Tenant List Rent List form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T16:23:15.000Z
CVE-2021-42612 
A use after free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have other unspecified impact via a crafted text document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T18:02:24.000Z
CVE-2021-42613 
A double free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a denial of service or possibly have other unspecified impact via a crafted text document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T18:16:37.000Z
CVE-2021-42614 
A use after free in info_width_internal in bk_info.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T18:30:27.000Z
CVE-2021-42624 
A local buffer overflow vulnerability exists in the latest version of Miniftpd in ftpproto.c through the tmp variable, where a crafted payload can be sent to the affected function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-04T10:36:48.000Z
CVE-2021-42627 
The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T11:51:11.000Z
CVE-2021-42631 
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-31T17:48:05.000Z
CVE-2021-42633 
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional audit records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-02T17:10:08.000Z
CVE-2021-42635 
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-31T17:54:50.000Z
CVE-2021-42637 
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a URL, resulting in a Server Side Request Forgery (SSRF) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-02T17:14:36.000Z
CVE-2021-42638 
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-01T22:08:54.000Z
CVE-2021-42639 
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to multiple reflected cross site scripting vulnerabilities. Attacker controlled input is reflected back in the page without sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-02T17:16:40.000Z
CVE-2021-42640 
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to reassign drivers for any printer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-02T17:18:46.000Z
CVE-2021-42641 
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the username and email address of all users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-02T17:21:27.000Z
CVE-2021-42642 
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the plaintext console username and password for a printer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-02T17:23:01.000Z
CVE-2021-42643 
cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-17T11:15:54.000Z
CVE-2021-42644 
cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-17T11:21:58.000Z
CVE-2021-42645 
CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker must use the "File" parameter to upload a PHP payload to get a reverse shell from the vulnerable host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-10T11:14:13.000Z
CVE-2021-42646 
XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T00:00:00.000Z
CVE-2021-42648 
Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T17:34:38.000Z
CVE-2021-42650 
Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T20:53:13.000Z
CVE-2021-42651 
A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T14:11:24.000Z
CVE-2021-42654 
SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T12:41:13.000Z
CVE-2021-42655 
SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T12:55:13.000Z
CVE-2021-42656 
SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T13:00:39.000Z
CVE-2021-42659 
There is a buffer overflow vulnerability in the Web server httpd of the router in Tenda router devices such as Tenda AC9 V1.0 V15.03.02.19(6318) and Tenda AC9 V3.0 V15.03.06.42_multi. When setting the virtual service, the httpd program will crash and exit when the super-long list parameter occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T11:41:53.000Z
CVE-2021-42662 
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the Holiday reason parameter. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to cookie stealing and more.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T10:21:22.000Z
CVE-2021-42663 
An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a given link he will display the content of the HTML code of the attacker's choice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T12:17:30.000Z
CVE-2021-42664 
A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) quiz description parameters to add_quiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to cookie stealing and more.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T12:19:00.000Z
CVE-2021-42665 
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T12:21:35.000Z
CVE-2021-42666 
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_question.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T12:24:09.000Z
CVE-2021-42667 
A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in some cases he can use this vulnerability in order to get a remote code execution on the remote web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T12:26:06.000Z
CVE-2021-42668 
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code execution on the remote web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T12:34:23.000Z
CVE-2021-42669 
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By uploading a php webshell containing "<?php system($_GET["cmd"]); ?>" the attacker can execute commands on the web server with - /admin/uploads/php-webshell?cmd=id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T12:36:43.000Z
CVE-2021-42670 
A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T12:39:03.000Z
CVE-2021-42671 
An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of authentication or authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T12:41:11.000Z
CVE-2021-42675 
Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-14T16:29:42.000Z
CVE-2021-42681 
A Buffer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105. The IOCTL Handler 0x22001B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T20:03:33.000Z
CVE-2021-42682 
An Integer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105 .The IOCTL Handler 0x22001B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T20:04:36.000Z
CVE-2021-42683 
A Buffer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. The IOCTL Handler 0x22001B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T20:05:42.000Z