rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-42294 Microsoft SharePoint Server Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
cpes: cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Server 2019
cpes: cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Server Subscription Edition
cpes: cpe:2.3:a:microsoft:sharepoint_server:-:*:*:*:subscription:*:*:*
vendor: Microsoft
product: SharePoint Server Subscription Edition Language Pack
cpes: cpe:2.3:a:microsoft:sharepoint_server:-:language_pack:*:*:subscription:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Foundation 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:14:54.000Z
CVE-2021-42295 Visual Basic for Applications Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Microsoft Office 2019
cpes: cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
cpes: cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft Office LTSC 2021
cpes: cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Office 2016
cpes: cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*
vendor: Microsoft
product: Microsoft Office 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*
cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2021-12-15T14:14:55.000Z
CVE-2021-42296 Microsoft Word Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
cpes: cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft Office LTSC 2021
cpes: cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:27.000Z
CVE-2021-42297 Windows 10 Update Assistant Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows Update Assistant
cpes: cpe:2.3:a:microsoft:windows_10_update_assistant:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Published: 2021-11-24T01:05:12.000Z
CVE-2021-42298 Microsoft Defender Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Malware Protection Engine
cpes: cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:29.000Z
CVE-2021-42299 Microsoft Surface Pro 3 Security Feature Bypass Vulnerability
Problem types: description: Security Feature Bypass
Affected products: vendor: Microsoft
product: Microsoft Surface Pro 3
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.6
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N/E:P/RL:U/RC:C
Published: 2021-10-20T21:15:10.000Z
CVE-2021-42300 Azure Sphere Tampering Vulnerability
Problem types: description: Tampering
Affected products: vendor: Microsoft
product: Azure Sphere
cpes: cpe:2.3:a:microsoft:azure_sphere:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:31.000Z
CVE-2021-42301 Azure RTOS Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Azure Real Time Operating System
cpes: cpe:2.3:o:microsoft:azure_real_time_operating_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:32.000Z
CVE-2021-42302 Azure RTOS Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Real Time Operating System
cpes: cpe:2.3:o:microsoft:azure_real_time_operating_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.6
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:34.000Z
CVE-2021-42303 Azure RTOS Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Real Time Operating System
cpes: cpe:2.3:o:microsoft:azure_real_time_operating_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.6
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:35.000Z
CVE-2021-42304 Azure RTOS Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Real Time Operating System
cpes: cpe:2.3:o:microsoft:azure_real_time_operating_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.6
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:37.000Z
CVE-2021-42305 Microsoft Exchange Server Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Microsoft Exchange Server 2013 Cumulative Update 23
cpes: cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2016 Cumulative Update 21
cpes: cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2019 Cumulative Update 10
cpes: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2016 Cumulative Update 22
cpes: cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2019 Cumulative Update 11
cpes: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:38.000Z
CVE-2021-42306 Azure Active Directory Information Disclosure Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Azure Automation
cpes: cpe:2.3:a:microsoft:azure_automation:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Active Directory
vendor: Microsoft
product: Azure Site Recovery
vendor: Microsoft
product: Azure Migrate
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Published: 2021-11-24T01:05:13.000Z
CVE-2021-42307 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Microsoft Edge (Chromium-based)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Published: 2023-06-30T23:08:37.767Z
CVE-2021-42308 Microsoft Edge (Chromium-based) Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Microsoft Edge (Chromium-based)
cpes: cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: LOW
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
Published: 2021-11-24T01:05:13.000Z
CVE-2021-42309 Microsoft SharePoint Server Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
cpes: cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Server 2019
cpes: cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Server Subscription Edition
cpes: cpe:2.3:a:microsoft:sharepoint_server:-:*:*:*:subscription:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Foundation 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:14:56.000Z
CVE-2021-42310 Microsoft Defender for IoT Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Defender for IoT
cpes: cpe:2.3:a:microsoft:defender_for_iot:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:14:57.000Z
CVE-2021-42311 Microsoft Defender for IoT Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Defender for IoT
cpes: cpe:2.3:a:microsoft:defender_for_iot:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 10
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:14:57.000Z
CVE-2021-42312 Microsoft Defender for IoT Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Microsoft Defender for IoT
cpes: cpe:2.3:a:microsoft:defender_for_iot:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:14:58.000Z
CVE-2021-42313 Microsoft Defender for IoT Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Defender for IoT
cpes: cpe:2.3:a:microsoft:defender_for_iot:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 10
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:14:59.000Z
CVE-2021-42314 Microsoft Defender for IoT Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Defender for IoT
cpes: cpe:2.3:a:microsoft:defender_for_iot:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:00.000Z
CVE-2021-42315 Microsoft Defender for IoT Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Defender for IoT
cpes: cpe:2.3:a:microsoft:defender_for_iot:-:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:01.000Z
CVE-2021-42316 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Dynamics 365 (on-premises) version 9.1
cpes: cpe:2.3:a:microsoft:dynamics_365:9.1:*:*:*:on-premises:*:*:*
vendor: Microsoft
product: Microsoft Dynamics 365 (on-premises) version 9.0
cpes: cpe:2.3:a:microsoft:dynamics_365:9.0:*:*:*:on-premises:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:40.000Z
CVE-2021-42319 Visual Studio Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
cpes: cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
cpes: cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
cpes: cpe:2.3:a:microsoft:visual_studio_2019:16.9:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
cpes: cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:41.000Z
CVE-2021-42320 Microsoft SharePoint Server Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
cpes: cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Server 2019
cpes: cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Server Subscription Edition
cpes: cpe:2.3:a:microsoft:sharepoint_server:-:*:*:*:subscription:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-12-15T14:15:02.000Z
CVE-2021-42321 Microsoft Exchange Server Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Exchange Server 2016 Cumulative Update 21
cpes: cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2019 Cumulative Update 10
cpes: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2016 Cumulative Update 22
cpes: cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Exchange Server 2019 Cumulative Update 11
cpes: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:43.000Z
CVE-2021-42322 Visual Studio Code Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Visual Studio Code
cpes: cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:45.000Z
CVE-2021-42323 Azure RTOS Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Azure Real Time Operating System
cpes: cpe:2.3:o:microsoft:azure_real_time_operating_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
Published: 2021-11-10T00:47:46.000Z
CVE-2021-42324 
An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470. Due to improper parameter validation in the console interface, it is possible for a low-privileged authenticated attacker to escape the sandbox environment and execute system commands as root via shell metacharacters in the capture command parameters. Command output will be shown on the Serial interface of the device. Exploitation requires both credentials and physical access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T01:05:29.000Z
CVE-2021-42325 
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-12T19:01:48.000Z
CVE-2021-42326 
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-12T18:08:53.000Z
CVE-2021-42327 
dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-21T00:00:00.000Z
CVE-2021-42329 ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS
The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: ShinHer Information Co., LTD.
product: ShinHer StudyOnline System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-10-15T12:10:29.738Z
CVE-2021-42330 ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1
The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: ShinHer Information Co., LTD.
product: ShinHer StudyOnline System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-15T12:10:31.314Z
CVE-2021-42331 ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-2
The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: ShinHer Information Co., LTD.
product: ShinHer StudyOnline System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2021-10-15T12:10:32.855Z
CVE-2021-42332 ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-3
The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: ShinHer Information Co., LTD.
product: ShinHer StudyOnline System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-10-15T12:10:34.347Z
CVE-2021-42333 Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1
The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Huachu Digital Technology Co.,Ltd.
product: Easytest
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-15T12:10:35.859Z
CVE-2021-42334 Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2
The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Huachu Digital Technology Co.,Ltd.
product: Easytest
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-15T12:10:37.398Z
CVE-2021-42335 Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS
Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Huachu Digital Technology Co.,Ltd.
product: Easytest
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-10-15T12:10:38.906Z
CVE-2021-42336 Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization
The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Huachu Digital Technology Co.,Ltd.
product: Easytest
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-10-15T12:10:40.380Z