rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-43271 
Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a (when configured to use local, RADIUS, or TACACS authentication) logs usernames and passwords if either is entered incorrectly. If a user enters an incorrect username and/or password when logging into the WebUI, these attempted credentials are included in an error message that is logged in the WebUI log file. A log entry does not appear if the username and password provided correctly match a valid set of credentials. This also does not happen if AppResponse is configured to use SAML authentication. The WebUI log file is included in subsequent diagnostic system dumps that are generated. (Only users with Full Control access to the System Configuration permission can generate system dumps. By default, only System Administrators have Full Control access to the System Configuration permission.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T19:55:52.000Z
CVE-2021-43272 
An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process invalid or malicious DWF files instead of stopping upon an exception. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:59:16.000Z
CVE-2021-43273 
An Out-of-bounds Read vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.11. Crafted data in a DGN file and lack of verification of input data can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:48:28.000Z
CVE-2021-43274 
A Use After Free Vulnerability exists in the Open Design Alliance Drawings SDK before 2022.11. The specific flaw exists within the parsing of DWF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:49:48.000Z
CVE-2021-43275 
A Use After Free vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:50:17.000Z
CVE-2021-43276 
An Out-of-bounds Read vulnerability exists in Open Design Alliance ODA Viewer before 2022.8. Crafted data in a DWF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:51:18.000Z
CVE-2021-43277 
An out-of-bounds read vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:52:12.000Z
CVE-2021-43278 
An Out-of-bounds Read vulnerability exists in the OBJ file reading procedure in Open Design Alliance Drawings SDK before 2022.11. The lack of validating the input length can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:52:49.000Z
CVE-2021-43279 
An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:53:15.000Z
CVE-2021-43280 
A stack-based buffer overflow vulnerability exists in the DWF file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T20:58:03.000Z
CVE-2021-43281 
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-04T17:42:34.000Z
CVE-2021-43282 
An issue was discovered on Victure WR1200 devices through 1.0.3. The default Wi-Fi WPA2 key is advertised to anyone within Wi-Fi range through the router's MAC address. The device default Wi-Fi password corresponds to the last 4 bytes of the MAC address of its 2.4 GHz network interface controller (NIC). An attacker within scanning range of the Wi-Fi network can thus scan for Wi-Fi networks to obtain the default key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T18:21:09.000Z
CVE-2021-43283 
An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device, allowing an attacker with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges. This occurs in the ping and traceroute features. An attacker would thus be able to use this vulnerability to open a reverse shell on the device with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T18:22:00.000Z
CVE-2021-43284 
An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an attacker to gain control of the device through SSH (regardless of whether the admin password was changed on the web interface).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T18:23:13.000Z
CVE-2021-43286 
An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection" feature to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T12:55:51.000Z
CVE-2021-43287 
An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T11:52:39.000Z
CVE-2021-43288 
An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T12:55:37.000Z
CVE-2021-43289 
An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T12:55:29.000Z
CVE-2021-43290 
An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T12:55:19.000Z
CVE-2021-43293 
Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-04T17:51:51.000Z
CVE-2021-43294 
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T18:38:26.000Z
CVE-2021-43295 
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T18:39:37.000Z
CVE-2021-43296 
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T18:40:54.000Z
CVE-2021-43297 Dubbo Hessian cause RCE when parse error
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Dubbo
Credits: lang: en
value: There are differences in the use of entrances. The following people or organizations reported security vulnerabilities independently. Sort by discovery time: 1. cxc&yhbl&wh1t3p1g&fynch3r from G5-RD6@IIE 2. yxxx
Published: 2022-01-10T15:25:48.000Z
CVE-2021-43298 
The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.
Problem types: cwe_id: CWE-208
description: CWE-208
Affected products: vendor: embedthis
product: goahead
Published: 2022-01-25T19:11:17.000Z
CVE-2021-43299 
Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: teluu
product: pjsip
Published: 2022-02-16T00:00:00.000Z
CVE-2021-43300 
Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: teluu
product: pjsip
Published: 2022-02-16T00:00:00.000Z
CVE-2021-43301 
Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: teluu
product: pjsip
Published: 2022-02-16T00:00:00.000Z
CVE-2021-43302 
Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: teluu
product: pjsip
Published: 2022-02-16T00:00:00.000Z
CVE-2021-43303 
Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied
Problem types: cwe_id: CWE-120
description: CWE-120
Affected products: vendor: teluu
product: pjsip
Published: 2022-02-16T00:00:00.000Z
CVE-2021-43304 
Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: yandex
product: clickhouse
Published: 2022-03-14T00:00:00.000Z
CVE-2021-43305 
Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: yandex
product: clickhouse
Published: 2022-03-14T00:00:00.000Z
CVE-2021-43306 Exponential ReDoS in jquery-validation
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: jquery-validation
product: jquery-validation
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Denys Vozniuk from JFrog Security Research
Published: 2022-06-01T16:47:27.576Z
CVE-2021-43307 Exponential ReDoS in semver-regex
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: semver-regex
product: semver-regex
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Denys Vozniuk from JFrog Security Research
Published: 2022-06-01T16:47:38.625Z
CVE-2021-43308 Exponential ReDoS in markdown-link-extractor
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: markdown-link-extractor
product: markdown-link-extractor
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Denys Vozniuk from JFrog Security Research
Published: 2022-06-01T16:47:49.228Z
CVE-2021-43309 ReDoS in uri-template-lite URI.expand function
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: uri-template-lite
product: uri-template-lite
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-24T15:48:36.000Z
CVE-2021-43310 
A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remote code execution.
Problem types: cwe_id: CWE-290
description: CWE-290
Affected products: vendor: n/a
product: keylime
Published: 2022-09-21T18:23:41.000Z
CVE-2021-43311 
A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5382.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: upx
Published: 2023-03-24T00:00:00.000Z
CVE-2021-43312 
A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf64::invert_pt_dynamic at p_lx_elf.cpp:5239.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: upx
Published: 2023-03-24T00:00:00.000Z
CVE-2021-43313 
A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf32::invert_pt_dynamic at p_lx_elf.cpp:1688.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: upx
Published: 2023-03-24T00:00:00.000Z
CVE-2021-43314 
A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5368
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: upx
Published: 2023-03-24T00:00:00.000Z
CVE-2021-43315 
A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5349
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: upx
Published: 2023-03-24T00:00:00.000Z
CVE-2021-43316 
A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le64().
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: upx
Published: 2023-03-24T00:00:00.000Z
CVE-2021-43317 
A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf64::elf_lookup() at p_lx_elf.cpp:5404
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: upx
Published: 2023-03-24T00:00:00.000Z
CVE-2021-43319 
Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T18:44:16.000Z
CVE-2021-43323 
An issue was discovered in UsbCoreDxe in Insyde InsydeH2O with kernel 5.5 before 05.51.45, 5.4 before 05.43.45, 5.3 before 05.35.45, 5.2 before 05.26.45, 5.1 before 05.16.45, and 5.0 before 05.08.45. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-03T01:50:01.000Z
CVE-2021-43324 
LibreNMS through 21.10.2 allows XSS via a widget title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T14:05:34.000Z
CVE-2021-43325 
Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T06:14:23.000Z
CVE-2021-43326 
Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T06:14:57.000Z
CVE-2021-43327 
An issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can extract the security ID key from the device. Then, the protected firmware can be extracted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T20:00:59.000Z
CVE-2021-43329 
A SQL injection vulnerability in license_update.php in Mumara Classic through 2.93 allows a remote unauthenticated attacker to execute arbitrary SQL commands via the license parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:31:01.000Z
CVE-2021-43331 
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T20:44:11.000Z
CVE-2021-43332 
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T20:45:35.000Z
CVE-2021-43333 
The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-01T05:05:44.000Z
CVE-2021-43334 
BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T15:37:46.000Z
CVE-2021-43336 
An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF and DWG files. Crafted data in a DXF or DWG file (an invalid number of properties) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T00:00:00.000Z