rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-37254 
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-28T13:07:33.000Z
CVE-2021-37262 
JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-16T18:07:18.000Z
CVE-2021-37267 
Cross Site Scripting (XSS) vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to obtain user cookie information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T18:14:19.000Z
CVE-2021-37270 
There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T20:40:54.000Z
CVE-2021-37271 
Cross Site Scripting (XSS) vulnerability exists in UEditor v1.4.3.3, which can be exploited by an attacker to obtain user cookie information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T18:09:07.000Z
CVE-2021-37273 
A Denial of Service issue exists in China Telecom Corporation EPON Tianyi Gateway ZXHN F450(EPON ONU) 3.0. Tianyi Gateway is a hardware terminal of "Optical Modem Smart Router." Attackers can use this vulnerability to restart the device multiple times.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-28T18:00:01.000Z
CVE-2021-37274 
Kingdee KIS Professional Edition has a privilege escalation vulnerability. Attackers can use the vulnerability to gain computer administrator rights via unspecified loopholes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T20:56:41.000Z
CVE-2021-37289 
Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-22T14:34:20.000Z
CVE-2021-37291 
An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T18:03:58.000Z
CVE-2021-37292 
An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T18:13:14.000Z
CVE-2021-37293 
A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T18:08:30.000Z
CVE-2021-37304 
An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37305 
An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37306 
An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: api uri:/sys/user/checkOnlyUser?username=admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37311 
Buffer Overflow vulnerability in fcitx5 5.0.8 allows attackers to cause a denial of service via crafted message to the application's listening port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37315 
Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the source for COPY and MOVE operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37316 
SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive information via /etc/shadow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37317 
Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the target for COPY and MOVE operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37322 
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-18T21:11:21.000Z
CVE-2021-37326 
NetSarang Xshell 7 before Build 0077 includes unintended code strings in paste operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-15T15:06:18.000Z
CVE-2021-37330 
Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting (XSS). The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigger.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T13:35:50.000Z
CVE-2021-37331 
Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control. On the Verifications page, after uploading an ID Card or Trade License and viewing it, ID Cards and Trade Licenses of other vendors/users can be viewed by changing the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T13:37:30.000Z
CVE-2021-37333 
Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T13:39:03.000Z
CVE-2021-37334 
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a temporary directory. By default, files are stored within the application directory structure at %BASEDIR%/APP_DATA/TEMP/FileUploads/. Whilst access to this directory is restricted by the root web.config file, it is possible to override this restriction by uploading another specially crafted web.config file to the temporary directory. It is possible to exploit this flaw to upload a malicious script file to execute arbitrary code and system commands on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-25T21:16:01.000Z
CVE-2021-37343 
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:32:28.000Z
CVE-2021-37344 
Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:32:19.000Z
CVE-2021-37345 
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:32:09.000Z
CVE-2021-37346 
Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:30:46.000Z
CVE-2021-37347 
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:30:39.000Z
CVE-2021-37348 
Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:30:32.000Z
CVE-2021-37349 
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:30:24.000Z
CVE-2021-37350 
Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:30:17.000Z
CVE-2021-37351 
Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:29:50.000Z
CVE-2021-37352 
An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:29:41.000Z
CVE-2021-37353 
Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T11:29:35.000Z
CVE-2021-37354 
Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-15T19:08:27.000Z
CVE-2021-37358 
SQL Injection in SEACMS v210530 (2021-05-30) allows remote attackers to execute arbitrary code via the component "admin_ajax.php?action=checkrepeat&v_name=".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-18T14:32:45.000Z
CVE-2021-37363 
An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-26T13:20:45.000Z
CVE-2021-37364 
OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-26T13:23:06.000Z
CVE-2021-37365 
CTparental before 4.45.03 is vulnerable to cross-site scripting (XSS) in the CTparental admin panel. In bl_categires_help.php, the 'categories' variable is assigned with the content of the query string param 'cat' without sanitization or encoding, enabling an attacker to inject malicious code into the output webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T15:15:02.000Z
CVE-2021-37366 
CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link that cancels the filtering for all standard users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T15:12:41.000Z
CVE-2021-37367 
CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. Because The file "bl_categories_help.php" is vulnerable to directory traversal, an attacker can create a file that contains scripts and run arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T15:10:09.000Z
CVE-2021-37371 
Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-26T12:12:34.000Z
CVE-2021-37372 
Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can upload malicious PHP files by updating their profile image to gain remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-26T12:12:39.000Z
CVE-2021-37373 
Cross Site Scripting (XSS) vulnerability in Teradek Slice 1st generation firmware 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37374 
Cross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37375 
Cross Site Scripting (XSS) vulnerability in Teradek VidiU / VidiU Mini firmware version 3.0.8 and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37376 
Cross Site Scripting (XSS) vulnerability in Teradek Bond, Bond 2 and Bond Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37377 
Cross Site Scripting (XSS) vulnerability in Teradek Brik firmware version 7.2.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37378 
Cross Site Scripting (XSS) vulnerability in Teradek Cube and Cube Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37379 
Cross Site Scripting (XSS) vulnerability in Teradek Sphere all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2021-37381 
Southsoft GMIS 5.0 is vulnerable to CSRF attacks. Attackers can access other users' private information such as photos through CSRF. For example: any student's photo information can be accessed through /gmis/(S([1]))/student/grgl/PotoImageShow/?bh=[2]. Among them, the code in [1] is a random string generated according to the user's login related information. It can protect the user's identity, but it can not effectively prevent unauthorized access. The code in [2] is the student number of any student. The attacker can carry out CSRF attack on the system by modifying [2] without modifying [1].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-06T12:52:42.000Z
CVE-2021-37384 
RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-17T00:00:00.000Z
CVE-2021-37386 
Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injection vulnerability via the serial number update function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-17T00:00:00.000Z
CVE-2021-37388 
A buffer overflow in D-Link DIR-615 C2 3.03WW. The ping_ipaddr parameter in ping_response.cgi POST request allows an attacker to crash the webserver and might even gain remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-06T11:22:23.000Z
CVE-2021-37389 
Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T19:02:52.000Z
CVE-2021-37390 
A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T19:02:41.000Z
CVE-2021-37391 
A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-10T19:02:34.000Z
CVE-2021-37392 
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T17:03:20.000Z
CVE-2021-37393 
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T17:05:38.000Z
CVE-2021-37394 
In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T17:07:26.000Z
CVE-2021-37400 
An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-28T12:09:59.000Z
CVE-2021-37401 
An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-28T12:09:52.000Z
CVE-2021-37402 
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:19:12.000Z
CVE-2021-37403 
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:19:27.000Z
CVE-2021-37404 Heap buffer overflow in libhdfs native library
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Apache Software Foundation
product: Apache Hadoop
Credits: lang: en
value: This issue was discovered by Igor Chervatyuk.
Published: 2022-06-13T07:00:16.000Z
CVE-2021-37409 
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
Published: 2022-08-18T00:00:00.000Z