rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-43442 
A Logic Flaw vulnerability exists in i3 International Inc Annexxus Camera V5.2.0 build 150317 (Ax46), V5.0.9 build 151106 (Ax68), and V5.0.9 build 150615 (Ax78) due to a failure to allow the creation of more than one administrator account; however, this can be bypassed by parameter maniulation using PUT and DELETE and by calling the 'UserPermission' endpoint with the ID of created account and set it to 'admin' userType, successfully adding a second administrative account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T18:34:21.000Z
CVE-2021-43444 
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2021-43445 
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2021-43446 
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site scripting payloads to be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2021-43447 
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2021-43448 
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2021-43449 
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2021-43451 
SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in /forgetpassword.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T18:14:00.000Z
CVE-2021-43453 
A Heap-based Buffer Overflow vulnerability exists in JerryScript 2.4.0 and prior versions via an out-of-bounds read in parser_parse_for_statement_start in the js-parser-statm.c file. This issue is similar to CVE-2020-29657.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T20:23:52.000Z
CVE-2021-43454 
An Unquoted Service Path vulnerability exists in AnyTXT Searcher 1.2.394 via a specially crafted file in the ATService path. .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T14:01:48.000Z
CVE-2021-43455 
An Unquoted Service Path vulnerability exists in FreeLAN 2.2 via a specially crafted file in the FreeLAN Service path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T14:23:30.000Z
CVE-2021-43456 
An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T14:37:38.000Z
CVE-2021-43457 
An Unquoted Service Path vulnerability exists in bVPN 2.5.1 via a specially crafted file in the waselvpnserv service path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T14:45:34.000Z
CVE-2021-43458 
An Unquoted Service Path vulnerability exits in Vembu BDR 4.2.0.1 via a specially crafted file in the (1) hsflowd, (2) VembuBDR360Agent, or (3) VembuOffice365Agent service paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T14:53:12.000Z
CVE-2021-43459 
A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the (1) domain and (2) path parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T15:01:53.000Z
CVE-2021-43460 
An Unquoted Service Path vulnerability exists in System Explorer 7.0.0 via via a specially crafted file in the SystemExplorerHelpService service executable path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T15:29:35.000Z
CVE-2021-43461 
Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T15:34:31.000Z
CVE-2021-43462 
A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T15:39:22.000Z
CVE-2021-43463 
An Unquoted Service Path vulnerability exists in Ext2Fsd v0.68 via a specially crafted file in the Ext2Srv Service executable service path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T15:46:27.000Z
CVE-2021-43464 
A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T17:28:04.000Z
CVE-2021-43466 
In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T00:00:00.000Z
CVE-2021-43469 
VINGA WR-N300U 77.102.1.4853 is affected by a command execution vulnerability in the goahead component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-06T11:48:05.000Z
CVE-2021-43471 
In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after entering the background, creating a denial of service vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-06T12:13:29.000Z
CVE-2021-43474 
An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T21:02:44.000Z
CVE-2021-43478 
A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, which could let a malicious user reinstall the website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T19:01:16.000Z
CVE-2021-43479 
A Remote Code Execution (RCE) vulnerability exists in The-Secretary 2.5 via install.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T19:05:40.000Z
CVE-2021-43481 
An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstage.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T19:41:06.000Z
CVE-2021-43483 
An Access Control vulnerability exists in CLARO KAON CG3000 1.00.67 in the router configuration, which could allow a malicious user to read or update the configuraiton without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T15:15:44.000Z
CVE-2021-43484 
A Remote Code Execution (RCE) vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T18:41:04.000Z
CVE-2021-43492 
AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system andcan significantly aid in getting remote code access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T14:49:14.000Z
CVE-2021-43493 
ServerManagement master branch as of commit 49491cc6f94980e6be7791d17be947c27071eb56 is affected by a directory traversal vulnerability. This vulnerability can be used to extract credentials which can in turn be used to execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T14:33:52.000Z
CVE-2021-43494 
OpenCV-REST-API master branch as of commit 69be158c05d4dd5a4aff38fdc680a162dd6b9e49 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T13:51:30.000Z
CVE-2021-43495 
AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO/input.py. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-15T12:26:59.000Z
CVE-2021-43496 
Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T13:36:10.000Z
CVE-2021-43498 
An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters are set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T18:06:02.000Z
CVE-2021-43505 
Multiple Cross Site Scripting (XSS) vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via (1) Add new Client and (2) Add new invoice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T16:29:37.000Z
CVE-2021-43506 
An SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the password parameter in Login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T16:36:02.000Z
CVE-2021-43509 
SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the id parameter in view-service.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-01T13:14:06.000Z
CVE-2021-43510 
SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-01T13:14:10.000Z
CVE-2021-43512 
An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T23:27:38.000Z
CVE-2021-43515 
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T16:23:33.000Z
CVE-2021-43517 
FOSCAM Camera FI9805E with firmware V4.02.R12.00018510.10012.143900.00000 contains a backdoor that opens Telnet port when special command is sent on port 9530.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T16:11:00.000Z
CVE-2021-43518 
Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate m_Channels value coming from a map file, leading to a buffer overflow. A malicious server may offer a specially crafted map that will overwrite client's stack causing denial of service or code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T14:33:05.000Z
CVE-2021-43519 
Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-09T12:26:22.000Z
CVE-2021-43521 
A Buffer Overflow vulnerability exists in zlog 1.2.15 via zlog_conf_build_with_file in src/zlog/src/conf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T15:56:29.000Z
CVE-2021-43522 
An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08. A StorageSecurityCommandDxe SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-02T23:41:09.000Z
CVE-2021-43523 
In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, getaddrinfo, gethostbyaddr, and getnameinfo can lead to output of wrong hostnames (leading to domain hijacking) or injection into applications (leading to remote code execution, XSS, applications crashes, etc.). In other words, a validation step, which is expected in any stub resolver, does not occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-10T14:03:56.000Z
CVE-2021-43527 
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
Problem types: description: Memory corruption via DER-encoded DSA and RSA-PSS signatures
Affected products: vendor: Mozilla
product: NSS
Published: 2021-12-08T00:00:00.000Z
CVE-2021-43528 
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird < 91.4.0.
Problem types: description: JavaScript unexpectedly enabled for the composition area
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2021-12-08T21:21:12.000Z
CVE-2021-43529 
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
Problem types: description: Memory corruption when processing S/MIME messages
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2023-02-16T00:00:00.000Z
CVE-2021-43530 
A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94.
Problem types: description: Universal XSS in Firefox for Android via QR Code URLs
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:21:04.000Z
CVE-2021-43531 
When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redirect URL. This is related to CVE-2021-43532 but in the context of Web Extensions. This vulnerability affects Firefox < 94.
Problem types: description: Web Extensions could access pre-redirect URL when their context menu was triggered by a user
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:20:58.000Z
CVE-2021-43532 
The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. If a website tricked a user into copy and pasting the image link back to the page, the page would be able to steal the authentication tokens. This was fixed by making the action return the original URL, before any redirects. This vulnerability affects Firefox < 94.
Problem types: description: 'Copy Image Link' context menu action could have been abused to see authentication tokens
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:20:53.000Z
CVE-2021-43533 
When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing. This vulnerability affects Firefox < 94.
Problem types: description: URL Parsing may incorrectly parse internationalized domains
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:20:47.000Z
CVE-2021-43534 
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
Problem types: description: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2021-12-08T21:20:42.000Z
CVE-2021-43535 
A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.3, and Firefox ESR < 91.3.
Problem types: description: Use-after-free in HTTP2 Session object
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2021-12-08T21:20:35.000Z
CVE-2021-43536 
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Problem types: description: URL leakage when navigating while executing asynchronous function
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:20:30.000Z
CVE-2021-43537 
An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Problem types: description: Heap buffer overflow when using structured clone
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:20:25.000Z
CVE-2021-43538 
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Problem types: description: Missing fullscreen and pointer lock notification when requesting both
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:20:20.000Z
CVE-2021-43539 
Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Problem types: description: GC rooting failure when calling wasm instance methods
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:20:15.000Z
CVE-2021-43540 
WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects Firefox < 95.
Problem types: description: WebExtensions could have installed persistent ServiceWorkers
Affected products: vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:20:08.000Z
CVE-2021-43541 
When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Problem types: description: External protocol handler parameters were unescaped
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:20:02.000Z
CVE-2021-43542 
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Problem types: description: XMLHttpRequest error codes could have leaked the existence of an external protocol handler
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:19:42.000Z
CVE-2021-43543 
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Problem types: description: Bypass of CSP sandbox directive when embedding
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2021-12-08T21:19:38.000Z