rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-42854 Directory Traversal Read/Write/Delete at PluginServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/plugin/pmx" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Aternity
product: SteelCentral AppInternals Dynamic Sampling Agent
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Darrel Huang, Bjorn Lim, Leng Kang Hao from Government Technology Agency of Singapore
Published: 2022-03-09T16:52:02.819Z
CVE-2021-42855 Local privilege escalation due to misconfigured write permission on .debug_command.config file
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Aternity
product: SteelCentral AppInternals Dynamic Sampling Agent
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Darrel Huang, Bjorn Lim, Leng Kang Hao from Government Technology Agency of Singapore
Published: 2022-03-09T16:51:38.176Z
CVE-2021-42856 Reflected Cross-site Scripting at DsaDataTest
It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger a XSS vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Aternity
product: SteelCentral AppInternals Dynamic Sampling Agent
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Darrel Huang, Bjorn Lim, Leng Kang Hao from Government Technology Agency of Singapore
Published: 2022-03-09T16:51:56.184Z
CVE-2021-42857 Directory Traversal Partial Write at AgentDaServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/da/pcf" API. The affected endpoint does not have any validation of the user's input that allows a malicious payload to be injected.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Aternity
product: SteelCentral AppInternals Dynamic Sampling Agent
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Darrel Huang, Bjorn Lim, Leng Kang Hao from Government Technology Agency of Singapore
Published: 2022-03-09T16:51:44.553Z
CVE-2021-42859 
A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the issue in both the 3.2 release and in the October 2021 development code, but others not seeing the issue in the 3.2 release
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T11:02:54.000Z
CVE-2021-42860 
A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml_string_getc:2611. NOTE: it is unclear whether this input is allowed by the API specification
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T11:23:28.000Z
CVE-2021-42863 
A buffer overflow in ecma_builtin_typedarray_prototype_filter() in JerryScript version fe3a5c0 allows an attacker to construct a fake object or a fake arraybuffer with unlimited size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T12:33:16.000Z
CVE-2021-42866 
A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T17:52:59.000Z
CVE-2021-42867 
A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T17:53:05.000Z
CVE-2021-42868 
A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/insert, (2) patient_report, (3) appointment_report, (4) visit_report, and (5) bill_detail_report pages. .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T17:53:11.000Z
CVE-2021-42869 
A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patient/insert, (2) patient_report, (3) /appointment_report, (4) visit_report, and (5) /bill_detail_report pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T17:51:11.000Z
CVE-2021-42870 
ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-16T14:01:21.000Z
CVE-2021-42872 
TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T23:15:28.000Z
CVE-2021-42875 
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T18:52:02.000Z
CVE-2021-42877 
TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T19:18:46.000Z
CVE-2021-42884 
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceName to attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T10:35:20.000Z
CVE-2021-42885 
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T10:50:27.000Z
CVE-2021-42886 
TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, and usernames and passwords can be found in the decoded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T11:13:38.000Z
CVE-2021-42887 
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T11:40:42.000Z
CVE-2021-42888 
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can control langType to attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T13:51:17.000Z
CVE-2021-42889 
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, wifiname, etc.) without authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T14:08:41.000Z
CVE-2021-42890 
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime to attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T14:57:19.000Z
CVE-2021-42891 
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T15:17:08.000Z
CVE-2021-42892 
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T16:53:53.000Z
CVE-2021-42893 
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T17:12:36.000Z
CVE-2021-42897 
A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $mysqlstr and is executed by exec.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-16T13:32:29.000Z
CVE-2021-42911 
A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T19:30:16.000Z
CVE-2021-42912 
FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T16:54:08.000Z
CVE-2021-42913 
The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by reading the HTML source code. Authentication is not required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-20T08:23:40.000Z
CVE-2021-42917 
Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T00:00:00.000Z
CVE-2021-42923 
ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability. If an attacker overwrites the file %temp%\ShowMyPC\-ShowMyPC3606\wodVPN.dll, it will run any malicious code contained in that file. The code will run with normal user privileges unless the user specifically runs ShowMyPC as administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T23:25:15.000Z
CVE-2021-42940 
A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T15:54:30.000Z
CVE-2021-42943 
Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-17T10:47:03.000Z
CVE-2021-42945 
A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T06:27:18.000Z
CVE-2021-42946 
A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T17:53:17.000Z
CVE-2021-42948 
HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T15:14:35.000Z
CVE-2021-42949 
The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:45:36.000Z
CVE-2021-42950 
Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional users can be added for various collaboration abilities, which allows malicious user to create new Zepl Notebooks with various languages, contexts, and deployment scenarios. Upon creating a new notebook with specially crafted malicious code, a user can then launch remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-03T02:10:57.000Z
CVE-2021-42951 
A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new, specially crafted Algorithm and subsequently launch remote code execution with their desired result.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T01:40:31.000Z
CVE-2021-42952 
Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, users can then use that to subsequently escape the running context sandbox and proceed to access internal Zepl assets including cloud metadata services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T19:43:22.000Z
CVE-2021-42954 
Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group (non-admin or any guest users), thereby allowing privilege escalation, unauthorized password reset, stealing of sensitive data, access to credentials in plaintext, access to registry values, tampering with configuration files, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N
version: 3.1
Published: 2021-11-17T12:13:26.000Z
CVE-2021-42955 
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:L/C:N/I:H/PR:L/S:C/UI:N
version: 3.1
Published: 2021-11-17T12:26:22.000Z
CVE-2021-42956 
Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump can be done by non-admin also. Remotely, an attacker can dump all sensitive information including DB Connection string, entire IT infrastructure details, commands executed by IT admin including credentials, secrets, private keys and more.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N
version: 3.1
Published: 2021-11-17T11:51:58.000Z
CVE-2021-42967 
Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-13T11:05:10.000Z
CVE-2021-42969 
Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercustomize.py. When the user opens the terminal or activates Anaconda, the command will be executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-13T11:39:43.000Z
CVE-2021-42970 
Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T17:19:54.000Z
CVE-2021-42972 
NoMachine Server is affected by Buffer Overflow. IOCTL Handler 0x22001B in the NoMachine Server above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:22:22.000Z
CVE-2021-42973 
NoMachine Server is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Server above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:24:08.000Z
CVE-2021-42976 
NoMachine Enterprise Desktop is affected by Buffer Overflow. IOCTL Handler 0x22001B in the NoMachine Enterprise Desktop above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:26:40.000Z
CVE-2021-42977 
NoMachine Enterprise Desktop is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Enterprise Desktop above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:30:48.000Z
CVE-2021-42979 
NoMachine Cloud Server is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Cloud Server above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:33:47.000Z
CVE-2021-42980 
NoMachine Cloud Server is affected by Buffer Overflow. IOCTL Handler 0x22001B in the NoMachine Cloud Server above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:35:34.000Z
CVE-2021-42983 
NoMachine Enterprise Client is affected by Buffer Overflow. IOCTL Handler 0x22001B in the NoMachine Enterprise Client above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:37:32.000Z
CVE-2021-42986 
NoMachine Enterprise Client is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Enterprise Client above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:39:42.000Z
CVE-2021-42987 
Eltima USB Network Gate is affected by Integer Overflow. IOCTL Handler 0x22001B in the USB Network Gate above 7.0.1370 below 9.2.2420 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:41:24.000Z
CVE-2021-42988 
Eltima USB Network Gate is affected by Buffer Overflow. IOCTL Handler 0x22001B in the USB Network Gate above 7.0.1370 below 9.2.2420 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:46:10.000Z
CVE-2021-42990 
FlexiHub For Windows is affected by Buffer Overflow. IOCTL Handler 0x22001B in the FlexiHub For Windows above 2.0.4340 below 5.3.14268 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:47:36.000Z