rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-36085 
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T02:49:22.000Z
CVE-2021-36086 
The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T02:49:37.000Z
CVE-2021-36087 
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T02:49:55.000Z
CVE-2021-36088 
Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T02:50:19.000Z
CVE-2021-36089 
Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from grk::FileFormatDecompress::applyColour).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-01T02:50:42.000Z
CVE-2021-36090 Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Apache Software Foundation
product: Apache Commons Compress
Credits: lang: en
value: This issue was discovered by OSS Fuzz.
Published: 2021-07-13T07:15:23.000Z
CVE-2021-36091 Unautorized access to the calendar appointments
Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: OTRS AG
product: ((OTRS)) Community Edition
vendor: OTRS AG
product: OTRS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Published: 2021-07-26T04:25:41.820Z
CVE-2021-36092 XSS attack using special link in email
It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition:6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: OTRS AG
product: ((OTRS)) Community Edition
vendor: OTRS AG
product: OTRS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-07-26T04:25:43.381Z
CVE-2021-36093 DoS attack using PostMaster filters
It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.
Problem types: cwe_id: CWE-185
description: CWE-185 Incorrect Regular Expression
Affected products: vendor: OTRS AG
product: ((OTRS)) Community Edition
vendor: OTRS AG
product: OTRS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Alberto Molina
Published: 2021-09-06T13:15:24.049Z
CVE-2021-36094 XSS attack in appointment edit popup screen
It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: OTRS AG
product: ((OTRS)) Community Edition
vendor: OTRS AG
product: OTRS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2021-09-06T13:15:25.712Z
CVE-2021-36095 User enumeration issue using "lost password" feature
Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: OTRS AG
product: ((OTRS)) Community Edition
vendor: OTRS AG
product: OTRS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-09-06T13:15:27.220Z
CVE-2021-36096 Support Bundle includes S/Mime and PGP secret or PIN
Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: OTRS AG
product: ((OTRS)) Community Edition
vendor: OTRS AG
product: OTRS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Matthias Terlinde
Published: 2021-09-06T14:50:11.706Z
CVE-2021-36097 Agents are able to lock the ticket without the "Owner" permission
Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: OTRS AG
product: OTRS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-10-18T07:00:13.855Z
CVE-2021-36100 Authenticated remote code execution
Specially crafted string in OTRS system configuration can allow the execution of any system command.
Problem types: description: rce
Affected products: vendor: OTRS AG
product: OTRS
vendor: OTRS AG
product: SystemMonitoring
vendor: OTRS AG
product: OTRSSTORM
vendor: OTRS AG
product: ((OTRS)) Community Edition
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Special thanks to Rayhan Ahmed and Maxime Brigaudeau for reporting these vulnerability.
Published: 2022-03-21T09:15:24.697Z
CVE-2021-36121 
An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeed_Mnt/FileUpload_Upd.cfm is susceptible to an unrestricted upload vulnerability via the name1 parameter, when processing remote input from an authenticated user, leading to the ability for arbitrary files to be written to arbitrary filesystem locations via ../ Directory Traversal on the Z: drive (a hard-coded drive letter where ShareCare application files reside) and remote code execution as the ShareCare service user (NT AUTHORITY\SYSTEM).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-13T13:58:58.000Z
CVE-2021-36122 
An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParse_Sup/UnzipFile_Upd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject arbitrary arguments to 7z.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-13T14:00:51.000Z
CVE-2021-36123 
An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on the server filesystems as well any files accessible via Universal Naming Convention (UNC) paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-13T13:56:20.000Z
CVE-2021-36124 
An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-13T13:57:33.000Z
CVE-2021-36125 
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial of service attacks when a user's current username is beyond an arbitrary maximum configuration value (MaxNameChars).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T13:01:13.000Z
CVE-2021-36126 
An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but that English version could also be invalid on a wiki. This would result in a fatal error, and potentially fail to block or restrict a potentially nefarious user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T13:01:05.000Z
CVE-2021-36127 
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppressed MediaWiki user, were different than for any other user, thus easily disclosing suppressed accounts (which are supposed to be completely hidden).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T13:00:57.000Z
CVE-2021-36128 
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Autoblocks for CentralAuth-issued suppression blocks are not properly implemented.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T13:00:45.000Z
CVE-2021-36129 
An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage right to silently delete various groups' metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T13:00:38.000Z
CVE-2021-36130 
An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate across many pages for many users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T13:00:25.000Z
CVE-2021-36131 
An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages, a privileged user could inject arbitrary HTML and JavaScript within various data fields. The attack could easily propagate across many pages for many users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T13:00:06.000Z
CVE-2021-36132 
An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variable, it might not validate all appropriate user rights, thus allowing a user with insufficient rights to perform operations (specifically file uploads) that they should not be allowed to perform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T12:59:57.000Z
CVE-2021-36133 
The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T20:42:31.000Z
CVE-2021-36134 Out of bounds write in Netop Vision Pro
Out of bounds write vulnerability in the JPEG parsing code of Netop Vision Pro up to and including 9.7.2 allows an adjacent unauthenticated attacker to write to arbitrary memory potentially leading to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Douglas McKee of McAfee ATR
Published: 2021-09-27T16:15:41.000Z
CVE-2021-36143 
ACRN before 2.5 has a hw/pci/virtio/virtio.c vq_endchains NULL Pointer Dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T21:25:09.000Z
CVE-2021-36144 
The polling timer handler in ACRN before 2.5 has a use-after-free for a freed virtio device, related to devicemodel/hw/pci/virtio/*.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T21:24:57.000Z
CVE-2021-36145 
The Device Model in ACRN through 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb_entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T21:24:48.000Z
CVE-2021-36146 
ACRN before 2.5 has a devicemodel/hw/pci/xhci.c NULL Pointer Dereference for a trb pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T21:24:35.000Z
CVE-2021-36147 
An issue was discovered in ACRN before 2.5. It allows a devicemodel/hw/pci/virtio/virtio_net.c virtio_net_ping_rxq NULL pointer dereference for vq->used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T21:24:22.000Z
CVE-2021-36148 
An issue was discovered in ACRN before 2.5. dmar_free_irte in hypervisor/arch/x86/vtd.c allows an irte_alloc_bitmap buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-02T21:24:05.000Z
CVE-2021-36150 
SilverStripe Framework through 4.8.1 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T13:59:08.000Z
CVE-2021-36151 Local Credentials Disclosure Vulnerability
In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
Problem types: description: Hadoop token visible to all local users
Affected products: vendor: Apache Software Foundation
product: Apache Gobblin
Credits: lang: en
value: Apache Gobblin would like to thank Jonathan Leitschuh for reporting this issue.
Published: 2022-02-04T22:32:56.000Z
CVE-2021-36152 Insecure TrustManager used in LDAP connections
Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
Problem types: description: Insecure TrustManager used in LDAP connections
Affected products: vendor: Apache Software Foundation
product: Apache Gobblin
Credits: lang: en
value: Apache Gobblin would like to thank Simon Gerst for reporting this issue.
Published: 2022-02-04T22:32:57.000Z
CVE-2021-36153 
Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC Swift 1.1.0 and 1.1.1 allows remote attackers to deny service by sending malformed requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T11:15:22.000Z
CVE-2021-36154 
HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages within a single HTTP/2 frame, leading to Uncontrolled Recursion and stack consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T11:02:36.000Z
CVE-2021-36155 
LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource consumption and deny service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-09T11:11:10.000Z
CVE-2021-36156 
An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T14:12:11.000Z
CVE-2021-36157 
An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T14:03:49.000Z
CVE-2021-36158 
In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificates and private keys are used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-05T22:36:13.000Z
CVE-2021-36159 
libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\0' terminator one byte too late.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T13:22:54.000Z
CVE-2021-36160 mod_proxy_uwsgi out of bound read
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).
Problem types: cwe_id: CWE-125
description: CWE-125 out of bound read
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Credits: lang: en
value: LI ZHI XIN from NSFocus Security Team
Published: 2021-09-16T14:40:18.000Z
CVE-2021-36161 Unprotected input value toString cause RCE
Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13
Problem types: description: Remote Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache Dubbo
Published: 2021-09-09T07:45:11.000Z
CVE-2021-36162 Unprotected yaml deserialization cause RCE
Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
Problem types: description: Remote Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache Dubbo
Published: 2021-09-07T09:25:10.000Z
CVE-2021-36163 Unsafe deserialization in providers using the Hessian protocol
In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
Problem types: description: Remote Code Execution by tempering the serialization id on server side.
Affected products: vendor: Apache Software Foundation
product: Apache Dubbo
Published: 2021-09-07T09:25:11.000Z
CVE-2021-36165 
RICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of sensitive information and sends username and password as base64.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T09:26:53.000Z