rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-3770 Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2021-09-06T00:00:00.000Z
CVE-2021-3772 
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.
Problem types: cwe_id: CWE-354
description: CWE-354 - Improper Validation of Integrity Check Value
Affected products: vendor: n/a
product: kernel
Published: 2022-03-02T00:00:00.000Z
CVE-2021-3773 
A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: kernel
Published: 2022-02-16T18:35:30.000Z
CVE-2021-3774 Meross MSS550X Missing Encryption of Sensitive Data
Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X), on its 3.1.3 version and before, creates an open Wi-Fi Access Point without the required security measures in its initial setup. This could allow a remote attacker to obtain the Wi-Fi SSID as well as the password configured by the user from Meross app via Http/JSON plain request.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Meross
product: Meross Smart Wi-Fi 2 Way Wall Switch
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Gerard Fuguet Morales
Published: 2021-11-05T19:41:27.000Z
CVE-2021-3775 Cross-Site Request Forgery (CSRF) in star7th/showdoc
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2021-11-13T09:25:10.000Z
CVE-2021-3776 Cross-Site Request Forgery (CSRF) in star7th/showdoc
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2021-11-13T09:20:10.000Z
CVE-2021-3777 Inefficient Regular Expression Complexity in daaku/nodejs-tmpl
nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: daaku
product: daaku/nodejs-tmpl
Published: 2021-09-15T07:15:11.000Z
CVE-2021-3778 Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2021-09-15T00:00:00.000Z
CVE-2021-3779 Ruby-MySQL Gem Client File Read
A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later.
Problem types: cwe_id: CWE-610
description: CWE-610 Externally Controlled Reference to a Resource in Another Sphere
Affected products: vendor: Tomita Masahiro
product: ruby-mysql
Credits: lang: en
value: Discovered by Hans-Martin Münch of MOGWAI LABS GmbH, reported by Rapid7, coordinated by CERT/CC and JPCERT/CC
Published: 2022-06-28T16:30:15.611Z
CVE-2021-3780 Cross-site Scripting (XSS) - Stored in chocobozzz/peertube
peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: chocobozzz
product: chocobozzz/peertube
Published: 2021-09-15T11:15:11.000Z
CVE-2021-3781 
A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: ghostscript
Published: 2022-02-16T00:00:00.000Z
CVE-2021-3782 
An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.
Problem types: cwe_id: CWE-190
description: (CWE-190|CWE-911)->CWE-416
Affected products: vendor: n/a
product: wayland
Published: 2022-09-23T15:26:59.000Z
CVE-2021-3783 Cross-site Scripting (XSS) - Reflected in yourls/yourls
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: yourls
product: yourls/yourls
Published: 2021-09-15T12:00:18.000Z
CVE-2021-3784 Garuda Linux Improper Authorization
Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda settings manager', an insecure procedure is performed that keeps the created user without an assigned password during some seconds. This could allow a potential attacker to exploit this vulnerability in order to authenticate without knowing the password.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Garuda Linux
product: Garuda Linux
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Jesús Olmos
Published: 2023-10-04T15:00:49.765Z
CVE-2021-3785 Cross-site Scripting (XSS) - Stored in yourls/yourls
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: yourls
product: yourls/yourls
Published: 2021-09-15T12:05:13.000Z
CVE-2021-3786 
A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: Notebook and ThinkPad BIOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Itai Liba and Assaf Carlsbad from SentinelOne for reporting these issues.
Published: 2021-11-12T22:05:41.000Z
CVE-2021-3787 
A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MQTT credentials that could result in unauthorized access to backend Hubble services.
Problem types: cwe_id: CWE-256
description: CWE-256 Unprotected Storage of Credentials
Affected products: vendor: Motorola
product: Binatone Hubble Cameras
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Motorola thanks Randy Westergren for reporting this issue.
Published: 2021-11-12T22:05:43.000Z
CVE-2021-3788 
An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access to the device.
Problem types: cwe_id: CWE-1299
description: CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface
Affected products: vendor: Motorola
product: Binatone Hubble Cameras
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Motorola thanks Lennert Wouters and Günes Acar, imec-COSIC, KU Leuven, Belgium for reporting this issue.
Published: 2021-11-12T22:05:44.000Z
CVE-2021-3789 
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Motorola
product: Binatone Hubble Cameras
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Motorola thanks Lennert Wouters and Günes Acar, imec-COSIC, KU Leuven, Belgium for reporting this issue.
Published: 2021-11-12T22:05:46.000Z
CVE-2021-3790 
A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same network to perform a denial-of-service attack against the device.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Motorola
product: Binatone Hubble Cameras
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Motorola thanks Lennert Wouters and Günes Acar, imec-COSIC, KU Leuven, Belgium for reporting this issue.
Published: 2021-11-12T22:05:48.000Z
CVE-2021-3791 
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such as WiFi SSID and password.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Motorola
product: Binatone Hubble Cameras
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Motorola thanks Lennert Wouters and Günes Acar, imec-COSIC, KU Leuven, Belgium for reporting this issue.
Published: 2021-11-12T22:05:49.000Z
CVE-2021-3792 
Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead to the communication channel being accessible by an attacker.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Motorola
product: Binatone Hubble Cameras
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Motorola thanks Lenovo Global Security Lab for reporting these issues.
Published: 2021-11-12T22:05:51.000Z
CVE-2021-3793 
An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the same network as the device to access administrative pages that could result in information disclosure or device firmware update with verified firmware.
Problem types: cwe_id: CWE-424
description: CWE-424 Improper Protection of Alternate Path
Affected products: vendor: Motorola
product: Binatone Hubble Cameras
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Motorola thanks Lenovo Global Security Lab for reporting these issues.
Published: 2021-11-12T22:05:52.000Z
CVE-2021-3794 Inefficient Regular Expression Complexity in vuelidate/vuelidate
vuelidate is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: vuelidate
product: vuelidate/vuelidate
Published: 2021-09-15T12:25:09.000Z
CVE-2021-3795 Inefficient Regular Expression Complexity in sindresorhus/semver-regex
semver-regex is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: sindresorhus
product: sindresorhus/semver-regex
Published: 2021-09-15T16:23:49.000Z
CVE-2021-3796 Use After Free in vim/vim
vim is vulnerable to Use After Free
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2021-09-15T00:00:00.000Z
CVE-2021-3797 Use of Wrong Operator in String Comparison in hestiacp/hestiacp
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
Problem types: cwe_id: CWE-597
description: CWE-597 Use of Wrong Operator in String Comparison
Affected products: vendor: hestiacp
product: hestiacp/hestiacp
Published: 2021-09-15T13:05:11.000Z
CVE-2021-3798 
A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.
Problem types: cwe_id: CWE-200
description: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: opencryptoki
Published: 2022-08-23T15:48:58.000Z
CVE-2021-3799 Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin
grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: getgrav
product: getgrav/grav-plugin-admin
Published: 2021-09-27T12:25:22.000Z
CVE-2021-3800 
A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.
Problem types: cwe_id: CWE-200
description: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: Glib
Published: 2022-08-23T00:00:00.000Z
CVE-2021-3801 Inefficient Regular Expression Complexity in prismjs/prism
prism is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: prismjs
product: prismjs/prism
Published: 2021-09-15T12:40:11.000Z
CVE-2021-3802 
A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: udisks2
Published: 2021-11-29T00:00:00.000Z
CVE-2021-3803 Inefficient Regular Expression Complexity in fb55/nth-check
nth-check is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: fb55
product: fb55/nth-check
Published: 2021-09-17T00:00:00.000Z
CVE-2021-3804 Inefficient Regular Expression Complexity in nervjs/taro
taro is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: nervjs
product: nervjs/taro
Published: 2021-09-17T06:15:21.000Z
CVE-2021-3805 Prototype Pollution in mariocasciaro/object-path
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Problem types: cwe_id: CWE-1321
description: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: mariocasciaro
product: mariocasciaro/object-path
Published: 2021-09-17T00:00:00.000Z
CVE-2021-3806 Path Traversal in Pardus Software Center
A path traversal vulnerability on Pardus Software Center's "extractArchive" function could allow anyone on the same network to do a man-in-the-middle and write files on the system.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: TUBITAK
product: Pardus Software Center
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Credits: lang: en
value: Mehmet INCE from PRODAFT
Published: 2021-09-18T13:20:11.941Z
CVE-2021-3807 Inefficient Regular Expression Complexity in chalk/ansi-regex
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: chalk
product: chalk/ansi-regex
Published: 2021-09-17T00:00:00.000Z
CVE-2021-3808 
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2023-01-30T20:52:16.761Z
CVE-2021-3809 
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2023-01-30T20:53:00.162Z
CVE-2021-3810 Inefficient Regular Expression Complexity in cdr/code-server
code-server is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: cdr
product: cdr/code-server
Published: 2021-09-17T06:15:24.000Z
CVE-2021-3811 Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte
adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pi-hole
product: pi-hole/adminlte
Published: 2021-09-17T06:15:26.000Z
CVE-2021-3812 Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte
adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pi-hole
product: pi-hole/adminlte
Published: 2021-09-17T06:15:28.000Z
CVE-2021-3813 Improper Privilege Management in chatwoot/chatwoot
Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: chatwoot
product: chatwoot/chatwoot
Published: 2022-02-09T14:15:11.000Z
CVE-2021-3814 
It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: n/a
product: 3scale
Published: 2022-03-25T18:02:50.000Z
CVE-2021-3815 Prototype Pollution in fabiocaccamo/utils.js
utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Problem types: cwe_id: CWE-1321
description: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: fabiocaccamo
product: fabiocaccamo/utils.js
Published: 2021-12-08T16:15:11.000Z
CVE-2021-3816 
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via "Copy" method at user_group_admin.php.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Cacti
Published: 2022-01-19T20:38:50.000Z
CVE-2021-3817 SQL Injection in wbce/wbce_cms
wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: wbce
product: wbce/wbce_cms
Published: 2021-12-09T10:50:10.000Z
CVE-2021-3818 Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking
Problem types: cwe_id: CWE-565
description: CWE-565 Reliance on Cookies without Validation and Integrity Checking
Affected products: vendor: getgrav
product: getgrav/grav
Published: 2021-09-27T12:25:23.000Z
CVE-2021-3819 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: firefly-iii
product: firefly-iii/firefly-iii
Published: 2021-09-27T12:25:25.000Z