rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-44471 Delta Electronics DIAEnergie (Update A)
DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “name” of the script “DIAE_HandlerAlarmGroup.ashx”.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2021-12-22T18:06:49.880Z
CVE-2021-44476 
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files.
Problem types: cwe_id: CWE-267
description: Privilege Defined With Unsafe Actions
Affected products: vendor: Odoo
product: Odoo Community
default_status: unaffected
vendor: Odoo
product: Odoo Enterprise
default_status: unaffected
Credits: lang: eng
value: Toufik Ben Jaa
Published: 2023-04-25T18:33:32.237Z
CVE-2021-44477 GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference
GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: GE Gas Power
product: ToolBoxST
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Sharon Briznov of Claroty reported these vulnerabilities to GE.
Published: 2022-03-25T18:02:29.378Z
CVE-2021-44478 
A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: Polarion ALM
vendor: Siemens
product: Polarion WebClient for SVN
Published: 2022-03-08T11:31:24.000Z
CVE-2021-44479 
NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of USB In-System Programming (ISP) mode. This discloses protected flash memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:L/C:H/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2021-12-01T14:56:53.000Z
CVE-2021-44480 
Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's surroundings via a callback in an SMS command, as demonstrated by the 123456 and 523681 default passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T15:38:28.000Z
CVE-2021-44481 
An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of parameter validation in calls to memcpy in check_and_set_timeout in sr_unix/ztimeoutroutines.c allows attackers to attempt to read from a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:17:03.000Z
CVE-2021-44482 
An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to do_verify in sr_unix/do_verify.c allows attackers to attempt to jump to a NULL pointer by corrupting a function pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:17:35.000Z
CVE-2021-44483 
An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to eb_div in sr_port/eb_muldiv.c allows attackers to crash the application by performing a divide by zero.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:19:24.000Z
CVE-2021-44484 
An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in calls to emit_trip in sr_port/emit_code.c allows attackers to crash the application by dereferencing a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:19:54.000Z
CVE-2021-44485 
An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in trip_gen in sr_port/emit_code.c allows attackers to crash the application by dereferencing a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:21:45.000Z
CVE-2021-44486 
An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can manipulate the value of a function pointer used in op_write in sr_port/op_write.c in order to gain control of the flow of execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:22:10.000Z
CVE-2021-44487 
An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in calls to ious_open in sr_unix/ious_open.c allows attackers to crash the application by dereferencing a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:22:44.000Z
CVE-2021-44488 
An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can control the size and input to calls to memcpy in op_fnfnumber in sr_port/op_fnfnumber.c in order to corrupt memory or crash the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:23:27.000Z
CVE-2021-44489 
An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause an integer underflow of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c in order to cause a segmentation fault and crash the application. This is a "- digs" subtraction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:24:10.000Z
CVE-2021-44490 
An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c to result in an extremely large value in order to cause a segmentation fault and crash the application. This is a "- (digs < 1 ? 1 : digs)" subtraction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:24:34.000Z
CVE-2021-44491 
An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c to result in an extremely large value in order to cause a segmentation fault and crash the application. This is a digs-- calculation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:24:59.000Z
CVE-2021-44492 
An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, attackers can cause a type to be incorrectly initialized in the function f_incr in sr_port/f_incr.c and cause a crash due to a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:27:38.000Z
CVE-2021-44493 
An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, an attacker can cause a call to $Extract to force an signed integer holding the size of a buffer to take on a large negative number, which is then used as the length of a memcpy call that occurs on the stack, causing a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:36:02.000Z
CVE-2021-44494 
An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, an attacker can cause calls to ZRead to crash due to a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:37:33.000Z
CVE-2021-44495 
An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, an attacker can cause a NULL pointer dereference after calls to ZPrint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:38:16.000Z
CVE-2021-44496 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can control the size variable and buffer that is passed to a call to memcpy. An attacker can use this to overwrite key data structures and gain control of the flow of execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:42:18.000Z
CVE-2021-44497 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, can cause the bounds of a for loop to be miscalculated, which leads to a use after free condition a pointer is pushed into previously free memory by the loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:43:25.000Z
CVE-2021-44498 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause a type to be incorrectly initialized in the function f_incr in sr_port/f_incr.c and cause a crash due to a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:44:24.000Z
CVE-2021-44499 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a call to $Extract to force an signed integer holding the size of a buffer to take on a large negative number, which is then used as the length of a memcpy call that occurs on the stack, causing a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:45:29.000Z
CVE-2021-44500 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of input validation in calls to eb_div in sr_port/eb_muldiv.c allows attackers to crash the application by performing a divide by zero.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:47:16.000Z
CVE-2021-44501 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause calls to ZRead to crash due to a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:49:40.000Z
CVE-2021-44502 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can control the size of a memset that occurs in calls to util_format in sr_unix/util_output.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:50:52.000Z
CVE-2021-44503 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a call to va_arg on an empty variadic parameter list, most likely causing a memory segmentation fault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:51:55.000Z
CVE-2021-44504 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a size variable, stored as an signed int, to equal an extremely large value, which is interpreted as a negative value during a check. This value is then used in a memcpy call on the stack, causing a memory segmentation fault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:53:06.000Z
CVE-2021-44505 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a NULL pointer dereference after calls to ZPrint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:54:02.000Z
CVE-2021-44506 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of input validation in calls to do_verify in sr_unix/do_verify.c allows attackers to attempt to jump to a NULL pointer by corrupting a function pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:55:04.000Z
CVE-2021-44507 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of parameter validation in calls to memcpy in str_tok in sr_unix/ztimeoutroutines.c allows attackers to attempt to read from a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T18:02:00.000Z
CVE-2021-44508 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of NULL checks in calls to ious_open in sr_unix/ious_open.c allows attackers to crash the application by dereferencing a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:56:55.000Z
CVE-2021-44509 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause an integer underflow of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c in order to cause a segmentation fault and crash the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:57:54.000Z
CVE-2021-44510 
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c to result in an extremely large value in order to cause a segmentation fault and crash the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T17:58:56.000Z
CVE-2021-44512 
World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T02:07:50.000Z
CVE-2021-44513 
Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T02:09:15.000Z
CVE-2021-44514 
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-09T19:15:27.000Z
CVE-2021-44515 
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-12T04:04:55.000Z
CVE-2021-44518 
An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing code before each operation (lock or unlock) activated via the companion app. The code is sent unencrypted, allowing any attacker with the same app (either Android or iOS) to add the lock and take complete control. For successful exploitation, the attacker must be able to touch the lock's power button, and must be able to capture BLE network communication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T17:00:11.000Z
CVE-2021-44519 
In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-19T15:26:27.000Z
CVE-2021-44520 
In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-12T23:21:37.000Z
CVE-2021-44521 Remote code execution for scripted UDFs
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Cassandra
Credits: lang: en
value: This issue was discovered by Omer Kaspi of the JFrog Security vulnerability research team.
Published: 2022-02-11T12:20:12.000Z
CVE-2021-44522 
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal message broker system. This could allow an unauthenticated remote attacker to subscribe to arbitrary message queues.
Problem types: cwe_id: CWE-668
description: CWE-668: Exposure of Resource to Wrong Sphere
Affected products: vendor: Siemens
product: SiPass integrated V2.76
vendor: Siemens
product: SiPass integrated V2.80
vendor: Siemens
product: SiPass integrated V2.85
vendor: Siemens
product: Siveillance Identity V1.5
vendor: Siemens
product: Siveillance Identity V1.6
Published: 2021-12-14T12:07:09.000Z
CVE-2021-44523 
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal activity feed database. This could allow an unauthenticated remote attacker to read, modify or delete activity feed entries.
Problem types: cwe_id: CWE-668
description: CWE-668: Exposure of Resource to Wrong Sphere
Affected products: vendor: Siemens
product: SiPass integrated V2.76
vendor: Siemens
product: SiPass integrated V2.80
vendor: Siemens
product: SiPass integrated V2.85
vendor: Siemens
product: Siveillance Identity V1.5
vendor: Siemens
product: Siveillance Identity V1.6
Published: 2021-12-14T12:07:10.000Z
CVE-2021-44524 
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal user authentication service. This could allow an unauthenticated remote attacker to trigger several actions on behalf of valid user accounts.
Problem types: cwe_id: CWE-668
description: CWE-668: Exposure of Resource to Wrong Sphere
Affected products: vendor: Siemens
product: SiPass integrated V2.76
vendor: Siemens
product: SiPass integrated V2.80
vendor: Siemens
product: SiPass integrated V2.85
vendor: Siemens
product: Siveillance Identity V1.5
vendor: Siemens
product: Siveillance Identity V1.6
Published: 2021-12-14T12:07:11.000Z
CVE-2021-44525 
Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-20T15:06:18.000Z
CVE-2021-44526 
Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-23T14:57:02.000Z
CVE-2021-44527 
A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the network to perform a Deny of Service (DoS) attack on the affected switch.This vulnerability is fixed in UniFi Switch firmware 5.76.6 and later.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: UniFi Switches
Published: 2021-12-07T13:12:26.000Z
CVE-2021-44528 
A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Problem types: cwe_id: CWE-601
description: Open Redirect (CWE-601)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2022-01-07T00:00:00.000Z
CVE-2021-44529 
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Ivanti EPM
Published: 2021-12-08T00:00:00.000Z
CVE-2021-44530 
An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to control the application.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: n/a
product: UniFi Network application
Published: 2022-01-14T19:15:37.000Z