rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-44875 
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the password recovery procedure for a given user, where a difference in messages could allow an attacker to determine if the given user is valid or not, enabling a brute force attack with valid users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T16:20:34.000Z
CVE-2021-44876 
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the identification of the correct tenant for a given user, where a difference in messages could allow an attacker to determine if the given user is valid or not, enabling a brute force attack with valid users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T16:20:52.000Z
CVE-2021-44877 
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability has been found while using a temporary generated token in order to consume api resources. The vulnerability allows an unauthenticated attacker to use an api endpoint to generate a temporary JWT token that is designed to reference the correct tenant prior to authentication, to request system configuration parameters using direct api requests. The correct exploitation of this vulnerability causes sensitive information exposure. In case the tenant has an smtp credential set, the full credential information is disclosed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T16:17:42.000Z
CVE-2021-44878 
If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using "none" as the value of "alg" key in the header with an empty signature value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T12:52:04.000Z
CVE-2021-44879 
In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-13T00:00:00.000Z
CVE-2021-44880 
D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_882 DIR_882_FW1.30B06_Hotfix_02 were discovered to contain a command injection vulnerability in the system function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:34:02.000Z
CVE-2021-44881 
D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:34:01.000Z
CVE-2021-44882 
D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:34:00.000Z
CVE-2021-44886 
In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T14:21:17.000Z
CVE-2021-44892 
A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-10T16:05:25.000Z
CVE-2021-44896 
DMP Roadmap before 3.0.4 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-01T22:45:29.000Z
CVE-2021-44899 
Micro-Star International (MSI) Center <= 1.0.31.0 is vulnerable to multiple Privilege Escalation vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T10:56:40.000Z
CVE-2021-44900 
Micro-Star International (MSI) App Player <= 4.280.1.6309 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the NTIOLib_X64.sys and BstkDrv_msi2.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T10:57:59.000Z
CVE-2021-44901 
Micro-Star International (MSI) Dragon Center <= 2.0.116.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T10:59:51.000Z
CVE-2021-44903 
Micro-Star International (MSI) Center Pro <= 2.0.16.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T11:01:54.000Z
CVE-2021-44905 
Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the lock via an unauthenticated edit to the lock name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T20:29:50.000Z
CVE-2021-44906 
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T13:05:57.000Z
CVE-2021-44908 
SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T11:47:52.000Z
CVE-2021-44911 
XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-09T15:40:49.000Z
CVE-2021-44912 
In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is improper, for example before the XE 1.11.2 version, you can upload the PHP type file to GETSHELL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-09T15:55:05.000Z
CVE-2021-44915 
Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-05T17:12:57.000Z
CVE-2021-44916 
Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-20T11:31:48.000Z
CVE-2021-44917 
A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T19:57:14.000Z
CVE-2021-44918 
A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function, which can cause a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:08:23.000Z
CVE-2021-44919 
A Null Pointer Dereference vulnerability exists in the gf_sg_vrml_mf_alloc function in gpac 1.1.0-DEV, which causes a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:13:05.000Z
CVE-2021-44920 
An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dump_od_to_saf.isra function, which causes a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:16:04.000Z
CVE-2021-44921 
A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_isom_parse_movie_boxes_internal function, which causes a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:19:55.000Z
CVE-2021-44922 
A null pointer dereference vulnerability exists in gpac 1.1.0 in the BD_CheckSFTimeOffset function, which causes a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:22:38.000Z
CVE-2021-44923 
A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:25:01.000Z
CVE-2021-44924 
An infinite loop vulnerability exists in gpac 1.1.0 in the gf_log function, which causes a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:28:01.000Z
CVE-2021-44925 
A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_svg_get_attribute_name function, which causes a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:31:11.000Z
CVE-2021-44926 
A null pointer dereference vulnerability exists in gpac 1.1.0-DEV in the gf_node_get_tag function, which causes a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:35:22.000Z
CVE-2021-44927 
A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_sg_vrml_mf_append function, which causes a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-21T20:38:56.000Z
CVE-2021-44935 
glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php. The attacker can complete the attack remotely without interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T12:03:59.000Z
CVE-2021-44937 
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T12:43:21.000Z
CVE-2021-44942 
glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php. Using the CSRF vulnerability to trick the administrator to click, an attacker can add a blacklist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T20:06:25.000Z
CVE-2021-44949 
glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T14:14:05.000Z
CVE-2021-44954 
In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfiguration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T23:27:18.000Z
CVE-2021-44956 
Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issues that are in the jfif_decode function at ffjpeg/src/jfif.c (line 552) could cause a Denial of Service by using a crafted jpeg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-08T14:13:22.000Z
CVE-2021-44957 
Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in the jfif_encode function at ffjpeg/src/jfif.c (line 708) could cause a Denial of Service by using a crafted jpeg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-08T14:10:58.000Z
CVE-2021-44960 
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-15T00:00:00.000Z
CVE-2021-44961 
A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. Specially crafted stl files can exhaust available memory. An attacker can provide malicious files to trigger this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T01:45:47.000Z
CVE-2021-44962 
An out-of-bounds read vulnerability exists in the GCode::extrude() functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. A specially crafted stl file could lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T01:54:52.000Z
CVE-2021-44964 
Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-14T14:24:51.000Z
CVE-2021-44965 
Directory traversal vulnerability in /admin/includes/* directory for PHPGURUKUL Employee Record Management System 1.2 The attacker can retrieve and download sensitive information from the vulnerable server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-13T14:43:24.000Z
CVE-2021-44966 
SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account of this system and can destroy, change or manipulate all sensitive information on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-13T14:20:43.000Z
CVE-2021-44967 
A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T21:17:32.000Z
CVE-2021-44968 
A Use after Free vulnerability exists in IOBit Advanced SystemCare 15 pro via requests sent in sequential order using the IOCTL driver codes, which could let a malicious user execute arbitrary code or a Denial of Service (system crash). IOCTL list: iobit_ioctl = [0x8001e01c, 0x8001e020, 0x8001e024, 0x8001e040,0x8001e044, 0x8001e048, 0x8001e04c, 0x8001e000, 0x8001e004, 0x8001e008, 0x8001e00c, 0x8001e010, 0x8001e014, 0x8001e018]
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T17:25:16.000Z
CVE-2021-44969 
Taocms v3.0.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Management Column component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-10T22:39:10.000Z
CVE-2021-44970 
MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-10T22:39:11.000Z
CVE-2021-44971 
Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T18:17:04.000Z
CVE-2021-44974 
radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-25T11:56:49.000Z
CVE-2021-44975 
radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/anal_objc.c mach-o parser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T14:40:08.000Z
CVE-2021-44977 
In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T15:35:33.000Z
CVE-2021-44978 
iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T15:29:52.000Z
CVE-2021-44981 
In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without properly sanitizing any shell arguments, therefore remote code execution is possible. Additionally, as the media server is running as root by default attackers can use the sudo command within this shell_exec(''); function, which allows for privilege escalation by means of RCE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-24T12:26:11.000Z
CVE-2021-44983 
In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T13:57:59.000Z
CVE-2021-44988 
Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T00:23:51.000Z
CVE-2021-44992 
There is an Assertion ''ecma_object_is_typedarray (obj_p)'' failed at /jerry-core/ecma/operations/ecma-typedarray-object.c in Jerryscript 3.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T00:23:52.000Z
CVE-2021-44993 
There is an Assertion ''ecma_is_value_boolean (base_value)'' failed at /jerry-core/ecma/operations/ecma-get-put-value.c in Jerryscript 3.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T00:23:53.000Z
CVE-2021-44994 
There is an Assertion ''JERRY_CONTEXT (jmem_heap_allocated_size) == 0'' failed at /jerry-core/jmem/jmem-heap.c in Jerryscript 3.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T00:23:55.000Z
CVE-2021-45003 
Laundry Booking Management System 1.0 (Latest) and previous versions are affected by a remote code execution (RCE) vulnerability in profile.php through the "image" parameter that can execute a webshell payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-10T12:19:26.000Z
CVE-2021-45005 
Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T21:47:16.000Z
CVE-2021-45007 
Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-20T11:13:54.000Z
CVE-2021-45008 
Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-21T11:12:50.000Z
CVE-2021-45010 
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T11:13:26.000Z
CVE-2021-45014 
There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&id=26
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T13:32:03.000Z
CVE-2021-45015 
taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-14T13:36:55.000Z
CVE-2021-45017 
Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T22:18:29.000Z