rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-42772 
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer overflow vulnerability in the remote GetDumpFile command that could allow a user to attempt various attacks. In non-secure mode, the user is unauthenticated
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T19:13:34.000Z
CVE-2021-42773 
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, could allow a user to retrieve an arbitrary file from a remote host with the GetDumpFile command. In non-secure mode, the user is unauthenticated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T01:19:42.000Z
CVE-2021-42774 
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer overflow vulnerability in the remote firmware download feature that could allow remote unauthenticated users to perform various attacks. In non-secure mode, the user is unauthenticated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T01:17:10.000Z
CVE-2021-42775 
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a vulnerability in the remote firmware download feature that could allow a user to place or replace an arbitrary file on the remote host. In non-secure mode, the user is unauthenticated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T01:21:46.000Z
CVE-2021-42776 
CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T16:25:40.000Z
CVE-2021-42777 
Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application server or a user's local machine, as demonstrated by System.Diagnostics.Process.Start.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-29T00:00:00.000Z
CVE-2021-42778 
A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.
Problem types: cwe_id: CWE-672
description: CWE-672
Affected products: vendor: n/a
product: opensc
Published: 2022-04-18T16:20:39.000Z
CVE-2021-42779 
A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: opensc
Published: 2022-04-18T00:00:00.000Z
CVE-2021-42780 
A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.
Problem types: cwe_id: CWE-252
description: CWE-252
Affected products: vendor: n/a
product: opensc
Published: 2022-04-18T00:00:00.000Z
CVE-2021-42781 
Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: opensc
Published: 2022-04-18T00:00:00.000Z
CVE-2021-42782 
Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: opensc
Published: 2022-04-18T00:00:00.000Z
CVE-2021-42783 Missing Authentication in debug_post_set.cgi in D-Link DWR-932C E1 Firmware 1.0.0.4
Missing Authentication for Critical Function vulnerability in debug_post_set.cgi of D-Link DWR-932C E1 firmware allows an unauthenticated attacker to execute administrative actions.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: D-Link
product: DWR-932C E1
Credits: lang: en
value: Eugene Lim from Government Technology Agency of Singapore
Published: 2021-11-23T21:37:56.000Z
CVE-2021-42784 OS Command Injection in debug_fcgi in D-Link DWR-932C E1 Firmware 1.0.0.4
OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: D-Link
product: DWR-932C E1
Credits: lang: en
value: Eugene Lim from Government Technology Agency of Singapore
Published: 2021-11-23T21:37:35.000Z
CVE-2021-42785 Buffer Overflow in tvnviewer.exe via Crafted Packet in TightVNC Viewer 2.8.59
Buffer Overflow vulnerability in tvnviewer.exe of TightVNC Viewer allows a remote attacker to execute arbitrary instructions via a crafted FramebufferUpdate packet from a VNC server.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: GlavSoft LLC
product: TightVNC Viewer
Credits: lang: en
value: Eugene Lim from Government Technology Agency of Singapore
Published: 2021-11-23T21:37:07.000Z
CVE-2021-42786 Remote Code Execution at AgentControllerServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple instances of the API requests. The affected endpoints do not have any input validation of the user's input that allowed a malicious payload to be injected.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Aternity
product: SteelCentral AppInternals Dynamic Sampling Agent
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Darrel Huang, Bjorn Lim, Leng Kang Hao from Government Technology Agency of Singapore
Published: 2022-03-09T16:51:32.667Z
CVE-2021-42787 Directory Traversal Write/Delete/Partial Read at AgentConfigurationServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/configuration" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Aternity
product: SteelCentral AppInternals Dynamic Sampling Agent
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Credits: lang: en
value: Darrel Huang, Bjorn Lim, Leng Kang Hao from Government Technology Agency of Singapore
Published: 2022-03-09T16:51:50.594Z
CVE-2021-42791 
An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user's login certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T13:01:22.000Z
CVE-2021-42794 
An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2023-12-16T00:00:00.000Z
CVE-2021-42796 
An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-16T00:00:00.000Z
CVE-2021-42797 
Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-16T00:00:00.000Z
CVE-2021-42808 The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions.
Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Thales
product: Sentinel Protection Installer
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Intel Corp
Published: 2021-12-20T20:19:10.000Z
CVE-2021-42809 The Sentinel Protection Installer 7.7.0 does not properly restrict loading Dynamic Link Library
Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code.
Problem types: cwe_id: CWE-913
description: CWE-913 Improper Control of Dynamically-Managed Code Resources
Affected products: vendor: Thales
product: Sentinel Protection Installer
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Intel Corp
Published: 2021-12-20T20:19:09.000Z
CVE-2021-42810 Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users
A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed.
Problem types: cwe_id: CWE-336
description: CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)
Affected products: vendor: Thales
product: SafeNet Authentication Service
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ronnie Salomonsen, Mandiant
Published: 2022-01-19T17:12:02.882Z
CVE-2021-42811 Vulnerability in SafeNet KeySecure
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Thales DIS
product: SafeNet KeySecure
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: We thank the Dell Security Assurance Team for reporting these vulnerabilities.
Published: 2022-06-10T10:20:32.246Z
CVE-2021-42833 Use of hardcoded credentials impacting AquaView versions 1.60, 7.x, 8.x
A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-02-07T19:01:29.628Z
CVE-2021-42835 
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local, or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-08T14:34:35.000Z
CVE-2021-42836 
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T17:22:47.000Z
CVE-2021-42837 
An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login page. Any valid user from the SAML/OAuth provider can be used as the username with an arbitrary password, and login will succeed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-05T17:20:39.000Z
CVE-2021-42838 Grand Vice info Co. webopac7 - Reflected XSS
Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Grand Vice info Co.
product: webopac7
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-11-15T09:30:18.944Z
CVE-2021-42839 Grand Vice info Co. webopac7 - Arbitrary File Upload
Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Grand Vice info Co.
product: webopac7
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-15T09:30:20.399Z
CVE-2021-42840 
SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T18:20:23.000Z
CVE-2021-42841 
Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T20:04:34.000Z
CVE-2021-42847 
Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-11T00:00:00.000Z
CVE-2021-42848 
An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Lenovo
product: Personal Cloud Storage A1
vendor: Lenovo
product: Personal Cloud Storage T1
vendor: Lenovo
product: Personal Cloud Storage X1
vendor: Lenovo
product: Personal Cloud Storage T2
vendor: Lenovo
product: Personal Cloud Storage T2Pro
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Lenovo thanks Kais and KT of 360 Vulcan Team for reporting these issues.
Published: 2022-05-18T16:10:27.000Z
CVE-2021-42849 
A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Lenovo
product: Personal Cloud Storage A1
vendor: Lenovo
product: Personal Cloud Storage T1
vendor: Lenovo
product: Personal Cloud Storage X1
vendor: Lenovo
product: Personal Cloud Storage T2
vendor: Lenovo
product: Personal Cloud Storage T2Pro
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Kais and KT of 360 Vulcan Team for reporting this issue.
Published: 2022-05-18T16:10:28.000Z
CVE-2021-42850 
A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Lenovo
product: Personal Cloud Storage A1
vendor: Lenovo
product: Personal Cloud Storage T1
vendor: Lenovo
product: Personal Cloud Storage X1
vendor: Lenovo
product: Personal Cloud Storage T2
vendor: Lenovo
product: Personal Cloud Storage T2Pro
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Kais and KT of 360 Vulcan Team for reporting this issue.
Published: 2022-05-18T16:10:30.000Z
CVE-2021-42851 
A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Lenovo
product: Personal Cloud Storage A1
vendor: Lenovo
product: Personal Cloud Storage T1
vendor: Lenovo
product: Personal Cloud Storage X1
vendor: Lenovo
product: Personal Cloud Storage T2
vendor: Lenovo
product: Personal Cloud Storage T2Pro
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Lenovo thanks Kais and KT of 360 Vulcan Team for reporting this issue.
Published: 2022-05-18T16:10:32.000Z
CVE-2021-42852 
A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Lenovo
product: Personal Cloud Storage A1
vendor: Lenovo
product: Personal Cloud Storage T1
vendor: Lenovo
product: Personal Cloud Storage X1
vendor: Lenovo
product: Personal Cloud Storage T2
vendor: Lenovo
product: Personal Cloud Storage T2Pro
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Kais and KT of 360 Vulcan Team for reporting this issue.
Published: 2022-05-18T16:10:34.000Z
CVE-2021-42853 Directory Traversal Delete/Read at AgentDiagnosticServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Aternity
product: SteelCentral AppInternals Dynamic Sampling Agent
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
version: 3.1
Credits: lang: en
value: Darrel Huang, Bjorn Lim, Leng Kang Hao from Government Technology Agency of Singapore
Published: 2022-03-09T16:51:28.521Z