rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-45456 Command injection
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
Problem types: description: Command injection
Affected products: vendor: Apache Software Foundation
product: Apache Kylin
Credits: lang: en
value: Alvaro Munoz <pwntester@github.com>
Published: 2022-01-06T12:35:21.000Z
CVE-2021-45457 Overly broad CORS configuration
In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Problem types: description: CORS
Affected products: vendor: Apache Software Foundation
product: Apache Kylin
Credits: lang: en
value: Alvaro Munoz <pwntester@github.com>
Published: 2022-01-06T12:35:22.000Z
CVE-2021-45458 Hardcoded credentials
Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Apache Software Foundation
product: Apache Kylin
Credits: lang: en
value: Alvaro Munoz <pwntester@github.com>
Published: 2022-01-06T12:35:24.000Z
CVE-2021-45459 
lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T05:26:49.000Z
CVE-2021-45460 
A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As there are spaces in this path, attackers with write privilege to those directories might be able to plant executables that will run in place of the legitimate process. Attackers might achieve persistence on the system ("backdoors") or cause a denial of service.
Problem types: cwe_id: CWE-428
description: CWE-428: Unquoted Search Path or Element
Affected products: vendor: Siemens
product: SICAM PQ Analyzer
Published: 2022-01-11T11:27:18.000Z
CVE-2021-45461 
FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, as exploited in the wild in December 2021. The fixed versions are 15.0.20 and 16.0.19.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T18:25:54.000Z
CVE-2021-45462 
In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2021-12-23T00:00:00.000Z
CVE-2021-45463 
load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-23T06:00:57.000Z
CVE-2021-45464 
kvmtool through 39181fc allows an out-of-bounds write, related to virtio/balloon.c and virtio/pci.c. This allows a guest OS user to execute arbitrary code on the host machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2021-45465 
A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing BMP files. This could result in a write-what-where condition and an attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15696)
Problem types: cwe_id: CWE-123
description: CWE-123: Write-what-where Condition
Affected products: vendor: Siemens
product: syngo fastView
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-01-04T11:20:18.660Z
CVE-2021-45466 
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2021-45467 
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2021-45468 
Imperva Web Application Firewall (WAF) before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WAF security controls and send malicious HTTP POST requests to web servers behind the WAF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T17:58:09.000Z
CVE-2021-45469 
In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-23T18:45:57.000Z
CVE-2021-45470 
lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-23T20:32:50.000Z
CVE-2021-45471 
In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-24T01:04:20.000Z
CVE-2021-45472 
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-24T01:04:04.000Z
CVE-2021-45473 
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-24T01:03:46.000Z
CVE-2021-45474 
In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-24T01:03:28.000Z
CVE-2021-45475 Information disclosure in Yordam Library Information Document Automation Program
Yordam Library Information Document Automation product before version 19.02 has an unauthenticated Information disclosure vulnerability.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Yordam Informatics Systems
product: Yordam Library Information Document Automation Program
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Credits: lang: en
value: Bartu Utku Sarp
Published: 2022-10-27T08:40:10.199Z
CVE-2021-45476 Information disclosure in Yordam Library Information Document Automation Program
Yordam Library Information Document Automation product before version 19.02 has an unauthenticated reflected XSS vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Yordam Informatics Systems
product: Yordam Library Information Document Automation Program
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Credits: lang: en
value: Bartu Utku Sarp
Published: 2022-10-27T08:55:09.794Z
CVE-2021-45477 IDOR in Yordam Library Automation System
Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.

This issue affects Library Automation System: before 19.2.
Problem types: cwe_id: CWE-233
description: CWE-233 Improper Handling of Parameters
Affected products: vendor: Yordam Information Technologies
product: Library Automation System
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: Oguzhan KARA
Published: 2023-03-02T08:24:10.566Z
CVE-2021-45478 IDOR in Yordam Library Automation System
Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.

This issue affects Library Automation System: before 19.2.
Problem types: cwe_id: CWE-233
description: CWE-233 Improper Handling of Parameters
Affected products: vendor: Yordam Information Technologies
product: Library Automation System
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: Oguzhan KARA
Published: 2023-03-02T08:26:02.908Z
CVE-2021-45479 XSS in Yordam Library Automation System
Improper Neutralization of Input During Web Page Generation vulnerability in Yordam Information Technologies Library Automation System allows Stored XSS.

This issue affects Library Automation System: before 19.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Yordam Information Technologies
product: Library Automation System
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Oguzhan KARA
Published: 2023-03-02T08:30:11.618Z
CVE-2021-45480 
An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function in net/rds/connection.c in a certain combination of circumstances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-24T22:55:27.000Z
CVE-2021-45481 
In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application crash, a different vulnerability than CVE-2021-30889.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-25T00:04:23.000Z
CVE-2021-45482 
In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability than CVE-2021-30889.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-25T00:04:08.000Z
CVE-2021-45483 
In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability than CVE-2021-30889.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-25T00:03:55.000Z
CVE-2021-45484 
In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-25T01:05:21.000Z
CVE-2021-45485 
In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-25T01:05:07.000Z
CVE-2021-45486 
In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-25T01:04:27.000Z
CVE-2021-45487 
In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-25T01:04:12.000Z
CVE-2021-45488 
In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-25T01:03:58.000Z
CVE-2021-45489 
In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-25T01:03:41.000Z
CVE-2021-45490 
The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T01:10:43.000Z
CVE-2021-45491 
3CX System through 2022-03-17 stores cleartext passwords in a database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T01:14:24.000Z
CVE-2021-45492 
In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions and therefore inherits weak permissions from the C:\ folder. Because entries in the system-wide PATH variable are included in the search order for DLLs, an attacker could perform DLL search-order hijacking to escalate their privileges to SYSTEM. Furthermore, if the Global Search or Web Screens functionality is enabled, then privilege escalation is possible via the GlobalSearchService and Sage.CNA.WindowsService services, again via DLL search-order hijacking because unprivileged users would have modify permissions on the application directory. Note that while older versions of the software default to installing in %PROGRAMFILES(X86)% (which would allow the Sage folder to inherit strong permissions, making the installation not vulnerable), the official Sage 300 installation guides for those versions recommend installing in C:\Sage, which would make the installation vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T15:03:32.000Z
CVE-2021-45493 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects RAX35 before 1.0.4.102, RAX38 before 1.0.4.102, and RAX40 before 1.0.4.102.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:H/I:L/PR:N/S:U/UI:R
version: 3.1
Published: 2021-12-26T01:04:53.000Z
CVE-2021-45494 
Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4.0.10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N
version: 3.1
Published: 2021-12-26T01:04:26.000Z
CVE-2021-45495 
NETGEAR D7000 devices before 1.0.1.68 are affected by authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:H/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2021-12-26T01:04:16.000Z
CVE-2021-45496 
NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-12-26T01:04:04.000Z
CVE-2021-45497 
NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-12-26T01:03:54.000Z
CVE-2021-45498 
NETGEAR R6700v2 devices before 1.2.0.88 are affected by authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:H/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2021-12-26T01:03:45.000Z
CVE-2021-45499 
Certain NETGEAR devices are affected by authentication bypass. This affects R6900P before 1.3.3.140, R7000P before 1.3.3.140, R7900P before 1.4.2.84, R7960P before 1.4.2.84, R8000P before 1.4.2.84, RAX75 before 1.0.3.106, and RAX80 before 1.0.3.106.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N
version: 3.1
Published: 2021-12-26T01:03:34.000Z
CVE-2021-45500 
Certain NETGEAR devices are affected by authentication bypass. This affects R7000P before 1.3.3.140 and R8000 before 1.0.4.68.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:L/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2021-12-26T01:03:25.000Z
CVE-2021-45501 
Certain NETGEAR devices are affected by authentication bypass. This affects AC2400 before 1.1.0.84, AC2600 before 1.1.0.84, D7000 before 1.0.1.82, R6020 before 1.0.0.52, R6080 before 1.0.0.52, R6120 before 1.0.0.80, R6220 before 1.1.0.110, R6230 before 1.1.0.110, R6260 before 1.1.0.84, R6330 before 1.1.0.84, R6350 before 1.1.0.84, R6700v2 before 1.1.0.84, R6800 before 1.1.0.84, R6850 before 1.1.0.84, R6900v2 before 1.1.0.84, R7200 before 1.1.0.84, R7350 before 1.1.0.84, R7400 before 1.1.0.84, and R7450 before 1.1.0.84.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2021-12-26T01:03:14.000Z
CVE-2021-45502 
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2021-12-26T01:03:05.000Z
CVE-2021-45503 
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2021-12-26T01:02:51.000Z