rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-38688 Improper Authentication in Qfile
An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and access information We have already fixed this vulnerability in the following versions of Qfile: Qfile 3.0.0.1105 and later
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: QNAP Systems Inc.
product: Qfile
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Code Ninja
Published: 2021-12-29T13:05:16.235Z
CVE-2021-38689 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard
A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Guard
vendor: QNAP Systems Inc.
product: QVR Guard
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: crixer
Published: 2022-01-14T01:00:20.676Z
CVE-2021-38690 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard
A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Guard
vendor: QNAP Systems Inc.
product: QVR Guard
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: crixer
Published: 2022-01-14T01:00:22.078Z
CVE-2021-38691 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard
A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Guard
vendor: QNAP Systems Inc.
product: QVR Guard
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: crixer
Published: 2022-01-14T01:00:23.562Z
CVE-2021-38692 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard
A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Guard
vendor: QNAP Systems Inc.
product: QVR Guard
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: crixer
Published: 2022-01-14T01:00:24.925Z
CVE-2021-38693 Path Traversal in thttpd
A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: QNAP Systems Inc.
product: QuTScloud
vendor: QNAP Systems Inc.
product: QuTS hero
vendor: QNAP Systems Inc.
product: QTS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Giles, Guido and Simas, Iury from Thomson Reuters
Published: 2022-05-05T16:50:19.054Z
CVE-2021-38694 
SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T14:00:31.000Z
CVE-2021-38695 
SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject, description) of the document form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T14:05:18.000Z
CVE-2021-38696 
SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the application without any authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T14:11:13.000Z
CVE-2021-38697 
SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T14:13:59.000Z
CVE-2021-38698 
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T11:45:14.000Z
CVE-2021-38699 
TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-15T17:32:36.000Z
CVE-2021-38701 
Certain Motorola Solutions Avigilon devices allow XSS in the administrative UI. This affects T200/201 before 4.10.0.68; T290 before 4.4.0.80; T008 before 2.2.0.86; T205 before 4.12.0.62; T204 before 3.28.0.166; and T100, T101, T102, and T103 before 2.6.0.180.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T06:53:15.000Z
CVE-2021-38702 
Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-17T19:28:16.000Z
CVE-2021-38703 
Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be exploited in conjunction with CVE-2021-20090.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-01T11:15:22.000Z
CVE-2021-38704 
Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T19:21:49.000Z
CVE-2021-38705 
ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF). A successful attack would consist of an authenticated user following a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user. This can be exploited to create a secondary administrator account for the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T19:25:03.000Z
CVE-2021-38706 
messages_load.php in ClinicCases 7.3.3 suffers from a blind SQL injection vulnerability, which allows low-privileged attackers to execute arbitrary SQL commands through a vulnerable parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T19:13:15.000Z
CVE-2021-38707 
Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T19:16:29.000Z
CVE-2021-38708 
In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T02:40:06.000Z
CVE-2021-38709 
In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system for XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T02:39:55.000Z
CVE-2021-38710 
Static (Persistent) XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITE_NAME parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-18T14:41:18.000Z
CVE-2021-38711 
In gitit before 0.15.0.0, the Export feature can be exploited to leak information from files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T03:18:14.000Z
CVE-2021-38712 
OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. NOTE: the vendor's recommended solution is to block the access via an NGINX configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T03:35:45.000Z
CVE-2021-38713 
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T03:35:34.000Z
CVE-2021-38714 
In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-24T13:57:43.000Z
CVE-2021-38721 
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T14:35:37.000Z
CVE-2021-38723 
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T14:33:49.000Z
CVE-2021-38725 
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T14:30:16.000Z
CVE-2021-38727 
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-09T15:14:08.000Z
CVE-2021-38728 
SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38729 
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38730 
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38731 
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38732 
SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38733 
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38734 
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38736 
SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38737 
SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-28T00:00:00.000Z
CVE-2021-38745 
Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-21T20:39:45.000Z
CVE-2021-38751 
A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T13:53:19.000Z
CVE-2021-38752 
A cross-site scripting (XSS) vulnerability in Online Catering Reservation System using PHP on Sourcecodester allows an attacker to arbitrarily inject code in the search bar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T13:53:26.000Z
CVE-2021-38753 
An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain unauthorized access to the server hosting the web app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T13:53:32.000Z
CVE-2021-38754 
SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T13:53:38.000Z
CVE-2021-38755 
Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T13:53:43.000Z
CVE-2021-38756 
Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T13:53:49.000Z
CVE-2021-38757 
Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T13:53:55.000Z
CVE-2021-38758 
Directory traversal vulnerability in Online Catering Reservation System 1.0 exists due to lack of validation in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-16T13:54:03.000Z
CVE-2021-38759 
Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T20:51:04.000Z
CVE-2021-38772 
Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T18:57:11.000Z
CVE-2021-38783 
There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedar_dev" through iotcl cmd IOCTL_SET_PROC_INFO and IOCTL_COPY_PROC_INFO, which could cause a system crash or EoP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T12:43:46.000Z
CVE-2021-38784 
There is a NULL pointer dereference in the syscall open_exec function of Allwinner R818 SoC Android Q SDK V1.0 that could executable a malicious file to cause a system crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T13:10:09.000Z
CVE-2021-38785 
There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedar_dev that could use the ioctl cmd IOCTL_GET_IOMMU_ADDR to cause a system crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T13:46:23.000Z
CVE-2021-38786 
There is a NULL pointer dereference in media/libcedarc/vdecoder of Allwinner R818 SoC Android Q SDK V1.0, which could cause a media crash (denial of service).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T11:53:31.000Z
CVE-2021-38787 
There is an integer overflow in the ION driver "/dev/ion" of Allwinner R818 SoC Android Q SDK V1.0 that could use the ioctl cmd "COMPAT_ION_IOC_SUNXI_FLUSH_RANGE" to cause a system crash (denial of service).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T12:46:44.000Z
CVE-2021-38788 
The Background service in Allwinner R818 SoC Android Q SDK V1.0 is used to manage background applications. Malicious apps can use the interface provided by the service to set the number of applications allowed to run in the background to 0 and add themselves to the whitelist, so that once other applications enter the background, they will be forcibly stopped by the system, causing a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T15:23:02.000Z
CVE-2021-38789 
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T18:40:26.000Z
CVE-2021-38819 
A SQL injection vulnerability exits on the Simple Image Gallery System 1.0 application through "id" parameter on the album page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-16T00:00:00.000Z
CVE-2021-38822 
A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary execution of JavaScript commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T13:46:44.000Z
CVE-2021-38823 
The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is opened in a different browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T13:47:24.000Z
CVE-2021-38827 
Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2021-38828 
Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2021-38833 
SQL injection vulnerability in PHPGurukul Apartment Visitors Management System (AVMS) v. 1.0 allows attackers to execute arbitrary SQL statements and to gain RCE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-13T17:09:35.000Z