rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-35234 Exposed Dangerous Functions - Privileged Escalation
Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information.
Problem types: cwe_id: CWE-89
description: CWE-89 Exposed Dangerous Method or Function
Affected products: vendor: SolarWinds
product: Orion Core
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Trend Micro, Zero Day Initiative
Published: 2021-12-20T20:08:25.522Z
CVE-2021-35235 ASP.NET Debug Feature Enabled
The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely monitor and control the execution of an application. If an attacker could successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in targeting SWI with malicious intent.
Problem types: cwe_id: CWE-11
description: CWE-11: ASP.NET Misconfiguration: Creating Debug Binary
Affected products: vendor: SolarWinds
product: Kiwi Syslog Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-10-27T00:55:43.038Z
CVE-2021-35236 Missing Secure Flag From SSL Cookie
The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: SolarWinds
product: Kiwi Syslog Server
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-10-27T00:57:02.178Z
CVE-2021-35237 Clickjacking Vulnerability
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.
Problem types: cwe_id: CWE-1021
description: CWE-1021 Protection Mechanism Failure
Affected products: vendor: SolarWinds
product: Kiwi Syslog Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2021-10-29T13:32:18.489Z
CVE-2021-35238 Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability
User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: SolarWinds
product: Orion Platform
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Kajetan Rostojek for reporting on the issue in a responsible manner.
Published: 2021-09-01T11:02:35.000Z
CVE-2021-35239 Stored XSS in Maps text box hyperlink Vulnerability
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: SolarWinds
product: Orion Platform
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Kajetan Rostojek for reporting on the issue in a responsible manner.
Published: 2021-08-31T15:56:08.000Z
CVE-2021-35240 Stored XSS via Help Server settings
A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: SolarWinds
product: Orion Platform
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Kajetan Rostojek for reporting on the issue in a responsible manner.
Published: 2021-08-31T15:57:21.000Z
CVE-2021-35242 A valid CSRF token is present in response to an invalid request
Serv-U server responds with valid CSRFToken when the request contains only Session.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: SolarWinds
product: Serv-U Server
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-12-06T16:53:22.000Z
CVE-2021-35243 HTTP PUT & DELETE Methods Enabled
The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity.
Problem types: cwe_id: CWE-749
description: CWE-749 Exposed Dangerous Method or Function
Affected products: vendor: SolarWinds
product: Web Help Desk
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-12-23T19:48:34.603Z
CVE-2021-35244 Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
Problem types: description: https://cwe.mitre.org/data/definitions/1031.html
Affected products: vendor: SolarWinds
product: Orion Platform
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: dibs working with Trend Micro's Zero Day Initiative.
Published: 2021-12-20T20:08:24.786Z
CVE-2021-35245 Broken Access Control Vulnerability for SolarWinds Serv-U
When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: SolarWinds
product: Serv-U FTP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-12-06T16:52:02.411Z
CVE-2021-35246 Unprotected Transport of Credentials (HSTS) Vulnerability
The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users.
Problem types: cwe_id: CWE-319
description: CWE-319 Inappropriate Encoding for Output Context
Affected products: vendor: SolarWinds
product: Engineer's Toolset
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Justo Socarras
Published: 2022-11-23T16:48:18.061Z
CVE-2021-35247 Improper Input Validation Vulnerability in Serv-U
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: SolarWinds
product: Serv-U
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Jonathan Bar Or of Microsoft (@yo_yo_yo_jbo) for reporting this vulnerability
Published: 2022-01-07T22:39:50.564Z
CVE-2021-35248 Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users
It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.
Problem types: cwe_id: CWE-732
description: CWE-732 Improper Access Control
Affected products: vendor: SolarWinds
product: Orion
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: N/A
Published: 2021-12-20T20:08:24.068Z
CVE-2021-35249 Domain Admin Broken Access Control
This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: SolarWinds
product: Serv-U
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-05-17T19:44:55.183Z
CVE-2021-35250 Directory Transversal Vulnerability in Serv-U 15.3
A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1.
Problem types: cwe_id: CWE-22
description: CWE-22 File and Directory Information Exposure
Affected products: vendor: SolarWinds
product: Serv-U
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-04-25T19:47:54.688Z
CVE-2021-35251 Sensitive Data Disclosure Vulnerability
Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web Help Desk installation.
Problem types: cwe_id: CWE-209
description: CWE-209 Information Exposure Through an Error Message
Affected products: vendor: SolarWinds
product: Web Help Desk
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank for Anthony Meluso reporting this vulnerability.
Published: 2022-03-09T15:38:01.677Z
CVE-2021-35252 Common Key Vulnerability in Serv-U FTP Server
Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: SolarWinds
product: Serv-U FTP Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: SecureWorks Disclosure Team
Published: 2022-12-16T00:00:00.000Z
CVE-2021-35254 Authenticated Remote Code Execution in WebHelpDesk 12.7.8
SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: SolarWinds
product: WebHelpDesk
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Published: 2022-03-25T18:02:27.000Z
CVE-2021-35261 
File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary remote code via the Upfile function of the extend/tools/Ueditor endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2021-35265 
A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T11:55:07.000Z
CVE-2021-35266 
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T00:00:00.000Z
CVE-2021-35267 
NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation of privileges when setuid-root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T00:00:00.000Z
CVE-2021-35268 
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T00:00:00.000Z
CVE-2021-35269 
NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation of privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T00:00:00.000Z
CVE-2021-35283 
SQL Injection vulnerability in product_admin.php in atoms183 CMS 1.0, allows attackers to execute arbitrary commands via the Name, Fname, and ID parameters to search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T19:07:36.000Z
CVE-2021-35284 
SQL Injection vulnerability in function get_user in login_manager.php in rizalafani cms-php v1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-23T00:00:00.000Z
CVE-2021-35290 
File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-24T00:00:00.000Z
CVE-2021-35296 
An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the cookie value and Response Path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T16:39:47.000Z
CVE-2021-35297 
Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow. An attacker can use the Structured Exception Handler (SEH) records and redirect execution to attacker-controlled code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-01T12:54:26.000Z
CVE-2021-35298 
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T19:07:00.000Z
CVE-2021-35299 
Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T19:06:53.000Z
CVE-2021-35300 
Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T19:06:44.000Z
CVE-2021-35301 
Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T19:06:34.000Z
CVE-2021-35302 
Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T19:06:26.000Z
CVE-2021-35303 
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T19:06:17.000Z
CVE-2021-35306 
An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::WriteFields located in Ap4StszAtom.cpp. It allows an attacker to cause a denial of service (DOS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-05T19:08:28.000Z
CVE-2021-35307 
An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Test component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-05T19:08:31.000Z
CVE-2021-35309 
An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2021-35312 
A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Service.exe" has incorrect permissions, allowing a local unprivileged user to replace it with a malicious file that will be executed with "LocalSystem" privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-06T18:53:21.000Z
CVE-2021-35323 
Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-19T17:21:56.000Z
CVE-2021-35324 
A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-05T20:39:11.000Z
CVE-2021-35325 
A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-05T20:39:19.000Z
CVE-2021-35326 
A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sending a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-05T20:39:16.000Z