rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-37185 
A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V21.9 < V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.5.0 < V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.9.2 < V2.9.4), SIMATIC S7-1500 Software Controller (All versions >= V21.9 < V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions >= V4.0 < V4.0 SP1), SIPLUS TIM 1531 IRC (All versions < V2.3.6), TIM 1531 IRC (All versions < V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.
Problem types: cwe_id: CWE-672
description: CWE-672: Operation on a Resource after Expiration or Release
Affected products: vendor: Siemens
product: SIMATIC Drive Controller family
default_status: unknown
vendor: Siemens
product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC S7-1500 Software Controller
default_status: unknown
vendor: Siemens
product: SIMATIC S7-PLCSIM Advanced
default_status: unknown
vendor: Siemens
product: SIPLUS TIM 1531 IRC
default_status: unknown
vendor: Siemens
product: TIM 1531 IRC
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
baseScore: 7.5
baseSeverity: HIGH
Published: 2022-02-09T15:16:44.000Z
CVE-2021-37186 
A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMATIC RTU3030C (All versions < V4.0.9), SIMATIC RTU3031C (All versions < V4.0.9), SIMATIC RTU3041C (All versions < V4.0.9). The underlying TCP/IP stack does not properly calculate the random numbers used as ISN (Initial Sequence Numbers). An adjacent attacker with network access to the LAN interface could interfere with traffic, spoof the connection and gain access to sensitive information.
Problem types: cwe_id: CWE-330
description: CWE-330: Use of Insufficiently Random Values
Affected products: vendor: Siemens
product: LOGO! CMR2020
vendor: Siemens
product: LOGO! CMR2040
vendor: Siemens
product: SIMATIC RTU3010C
vendor: Siemens
product: SIMATIC RTU3030C
vendor: Siemens
product: SIMATIC RTU3031C
vendor: Siemens
product: SIMATIC RTU3041C
Published: 2021-09-14T10:47:49.000Z
CVE-2021-37187 
An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the device, which allows decoding of other users' passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-10T12:24:20.000Z
CVE-2021-37188 
An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware (because the bootloader does not verify that it is authentic), changing the behavior of the gateway.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-10T12:46:43.000Z
CVE-2021-37189 
An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-10T12:47:50.000Z
CVE-2021-37190 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerability that could allow an attacker to retrieve VPN connection for a known user.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
Published: 2021-09-14T10:47:50.000Z
CVE-2021-37191 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could brute force the usernames from the affected software.
Problem types: cwe_id: CWE-799
description: CWE-799: Improper Control of Interaction Frequency
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
Published: 2021-09-14T10:47:50.000Z
CVE-2021-37192 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerability that could allow an attacker to retrieve a list of network devices a known user can manage.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
Published: 2021-09-14T10:47:51.000Z
CVE-2021-37193 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could manipulate certain parameters and set a valid user of the affected software as invalid (or vice-versa).
Problem types: cwe_id: CWE-471
description: CWE-471: Modification of Assumed-Immutable Data (MAID)
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
Published: 2021-09-14T10:47:52.000Z
CVE-2021-37194 
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS allows to upload and store arbitrary files at the webserver. This could allow an attacker to store malicious files.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Siemens
product: COMOS V10.2
vendor: Siemens
product: COMOS V10.3
vendor: Siemens
product: COMOS V10.4
Published: 2022-02-09T15:16:48.000Z
CVE-2021-37195 
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS accepts arbitrary code as attachment to tasks. This could allow an attacker to inject malicious code that is executed when loading the attachment.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Siemens
product: COMOS V10.2
vendor: Siemens
product: COMOS V10.3
vendor: Siemens
product: COMOS V10.4
Published: 2022-01-11T11:27:13.000Z
CVE-2021-37196 
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.3 (All versions >= V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS unpacks specially crafted archive files to relative paths. This vulnerability could allow an attacker to store files in any folder accessible by the COMOS Web webservice.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Siemens
product: COMOS V10.2
vendor: Siemens
product: COMOS V10.3
vendor: Siemens
product: COMOS V10.3
vendor: Siemens
product: COMOS V10.4
Published: 2022-01-11T11:27:13.000Z
CVE-2021-37197 
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: COMOS V10.2
vendor: Siemens
product: COMOS V10.3
vendor: Siemens
product: COMOS V10.4
Published: 2022-01-11T11:27:14.000Z
CVE-2021-37198 
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS uses a flawed implementation of CSRF prevention. An attacker could exploit this vulnerability to perform cross-site request forgery attacks.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Siemens
product: COMOS V10.2
vendor: Siemens
product: COMOS V10.3
vendor: Siemens
product: COMOS V10.4
Published: 2022-01-11T11:27:15.000Z
CVE-2021-37199 
A vulnerability has been identified in SINUMERIK 808D (All versions), SINUMERIK 828D (All versions < V4.95). Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SINUMERIK 808D
vendor: Siemens
product: SINUMERIK 828D
Published: 2021-10-12T09:49:37.000Z
CVE-2021-37200 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of an affected system could download arbitrary files from the underlying filesystem by sending a specially crafted HTTP request.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-09-14T10:47:53.000Z
CVE-2021-37201 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). The web interface of affected devices is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This could allow an attacker to manipulate the SINEC NMS configuration by tricking an unsuspecting user with administrative privileges to click on a malicious link.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-09-14T10:47:54.000Z
CVE-2021-37202 
A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The IFC adapter in affected application contains a use-after-free vulnerability that could be triggered while parsing user-supplied IFC files. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Siemens
product: NX 1980 Series
vendor: Siemens
product: Solid Edge SE2021
Published: 2021-09-14T10:47:55.000Z
CVE-2021-37203 
A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The plmxmlAdapterIFC.dll contains an out-of-bounds read while parsing user supplied IFC files which could result in a read past the end of an allocated buffer. This could allow an attacker to cause a denial-of-service condition or read sensitive information from memory locations.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: NX 1980 Series
vendor: Siemens
product: Solid Edge SE2021
Published: 2021-09-14T10:47:56.000Z
CVE-2021-37205 
A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V21.9 < V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.5.0 < V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.9.2 < V2.9.4), SIMATIC S7-1500 Software Controller (All versions >= V21.9 < V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions >= V4.0 < V4.0 SP1), SIPLUS TIM 1531 IRC (All versions < V2.3.6), TIM 1531 IRC (All versions < V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.
Problem types: cwe_id: CWE-401
description: CWE-401: Missing Release of Memory after Effective Lifetime
Affected products: vendor: Siemens
product: SIMATIC Drive Controller family
default_status: unknown
vendor: Siemens
product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC S7-1500 Software Controller
default_status: unknown
vendor: Siemens
product: SIMATIC S7-PLCSIM Advanced
default_status: unknown
vendor: Siemens
product: SIPLUS TIM 1531 IRC
default_status: unknown
vendor: Siemens
product: TIM 1531 IRC
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
baseScore: 7.5
baseSeverity: HIGH
Published: 2022-02-09T15:16:57.000Z
CVE-2021-37206 
A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP300 (All versions < V8.80). Received webpackets are not properly processed. An unauthenticated remote attacker with access to any of the Ethernet interfaces could send specially crafted packets to force a restart of the target device.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP050
vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP100
vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP300
Published: 2021-09-14T10:47:57.000Z
CVE-2021-37207 
A vulnerability has been identified in SENTRON powermanager V3 (All versions). The affected application assigns improper access rights to a specific folder containing configuration files. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Siemens
product: SENTRON powermanager V3
Published: 2021-11-09T11:32:03.000Z
CVE-2021-37211 Larvata Digital Technology Co. Ltd. FLYGO - Stored XSS
The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Larvata Digital Technology Co. Ltd.
product: FLYGO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-08-09T09:15:25.418Z
CVE-2021-37212 Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1
The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content.
Problem types: cwe_id: CWE-706
description: CWE-706 Use of Incorrectly-Resolved Name or Reference
Affected products: vendor: Larvata Digital Technology Co. Ltd.
product: FLYGO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2021-08-09T09:15:26.935Z
CVE-2021-37213 Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-2
The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee’s check-in record.
Problem types: cwe_id: CWE-706
description: CWE-706 Use of Incorrectly-Resolved Name or Reference
Affected products: vendor: Larvata Digital Technology Co. Ltd.
product: FLYGO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-08-09T09:15:28.482Z
CVE-2021-37214 Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3
The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator privilege and execute arbitrary command.
Problem types: cwe_id: CWE-706
description: CWE-706 Use of Incorrectly-Resolved Name or Reference
Affected products: vendor: Larvata Digital Technology Co. Ltd.
product: FLYGO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-08-09T09:15:30.054Z
CVE-2021-37215 Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-4
The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s user data by specifying that employee’s ID in the API parameter.
Problem types: cwe_id: CWE-706
description: CWE-706 Use of Incorrectly-Resolved Name or Reference
Affected products: vendor: Larvata Digital Technology Co. Ltd.
product: FLYGO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-08-09T09:15:31.594Z
CVE-2021-37216 QSAN Storage Manager - Reflected Cross-Site Scripting
QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: QSAN
product: Storage Manager XN8008T
vendor: QSAN
product: Storage Manager XN8024R
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-08-02T11:18:56.385Z
CVE-2021-37218 
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T11:40:36.000Z
CVE-2021-37219 
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T11:33:26.000Z
CVE-2021-37220 
MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consider the maximum key size of a hash table. This can, for example, be seen with crafted "mutool draw" input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-21T21:02:04.000Z
CVE-2021-37221 
A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer create option, which could let a remote malicious user upload an arbitrary php file. .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T14:23:12.000Z
CVE-2021-37222 
Parsers in the open source project RCDCAP before 1.0.5 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via specially crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T10:30:12.000Z
CVE-2021-37223 
Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-05T11:59:50.000Z
CVE-2021-37231 
A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499f through APar_readX() in src/util.cpp while parsing a crafted mp4 file because of the missing boundary check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T00:00:00.000Z
CVE-2021-37232 
A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_buffer while reading more bytes in APar_read64.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-04T00:00:00.000Z
CVE-2021-37234 
Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37253 
M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-05T20:28:48.000Z