rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-42064 
If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values.
Problem types: description: SQL Injection
Affected products: vendor: SAP SE
product: SAP Commerce
Published: 2021-12-14T15:44:14.000Z
CVE-2021-42066 
SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker to discover vulnerable function in-depth application knowledge is required, but once exploited the attacker may be able to completely compromise confidentiality, integrity, and availability of the application.
Problem types: cwe_id: CWE-312
description: CWE-312
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2021-12-14T15:44:11.000Z
CVE-2021-42067 
In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information alteration or denial of service is possible.
Problem types: description: SSRF
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for ABAP and ABAP Platform
Published: 2022-01-14T19:11:31.000Z
CVE-2021-42068 
When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper input validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-12-14T15:44:15.000Z
CVE-2021-42069 
When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application
Problem types: description: Improper input validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-12-14T15:44:12.000Z
CVE-2021-42070 
When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application
Problem types: description: Improper input validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-12-14T15:44:14.000Z
CVE-2021-42071 
In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T16:15:14.000Z
CVE-2021-42072 
An issue was discovered in Barrier before 2.4.0. The barriers component (aka the server-side implementation of Barrier) does not sufficiently verify the identify of connecting clients. Clients can thus exploit weaknesses in the provided protocol to cause denial-of-service or stage further attacks that could lead to information leaks or integrity corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T03:44:37.000Z
CVE-2021-42073 
An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation of Barrier) simply by supplying a client label that identifies a valid client configuration. This label is "Unnamed" by default but could instead be guessed from hostnames or other publicly available information. In the active session state, an attacker can capture input device events from the server, and also modify the clipboard content on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T00:00:00.000Z
CVE-2021-42074 
An issue was discovered in Barrier before 2.3.4. An unauthenticated attacker can cause a segmentation fault in the barriers component (aka the server-side implementation of Barrier) by quickly opening and closing TCP connections while sending a Hello message for each TCP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T03:52:01.000Z
CVE-2021-42075 
An issue was discovered in Barrier before 2.3.4. The barriers component (aka the server-side implementation of Barrier) does not correctly close file descriptors for established TCP connections. An unauthenticated remote attacker can thus cause file descriptor exhaustion in the server process, leading to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T03:55:26.000Z
CVE-2021-42076 
An issue was discovered in Barrier before 2.3.4. An attacker can cause memory exhaustion in the barriers component (aka the server-side implementation of Barrier) and barrierc by sending long TCP messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T03:56:33.000Z
CVE-2021-42077 
PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T04:01:18.000Z
CVE-2021-42078 
PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T04:07:18.000Z
CVE-2021-42080 Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355
An attacker is able to launch a Reflected XSS attack using a crafted URL.

POC:

Visit the following URL
https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: OSNEXUS
product: QuantaStor
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Wietse Boonstra (DIVD)
lang: en
value: Frank Breedijk (DIVD)
lang: en
value: Victor Pasman (DIVD)
lang: en
value: Victor Gevers (DIVD)
lang: en
value: Max van der Horst (DIVD)
lang: en
value: Célistine Oosting (DIVD)
Published: 2023-07-10T06:29:48.166Z
CVE-2021-42081 Authenticated Remote Command Execution vulnerability in OSNEXUS QuantaStor before 6.0.0.355
An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API.

POC
http://<IP_ADDRESS>/qstorapi/storageSystemModify?storageSystem=&newName=quantastor&newDescription=;ls${IFS}-al&newLocation=4&newEnclosureLayoutId=5&newDnsServerList=;ls${IFS}-al&externalHostName=&newNTPServerList=;ls${IFS}-al
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: OSNEXUS
product: QuantaStor
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Wietse Boonstra (DIVD)
lang: en
value: Frank Breedijk (DIVD)
lang: en
value: Victor Pasman (DIVD)
lang: en
value: Victor Gevers (DIVD)
lang: en
value: Max van der Horst (DIVD)
lang: en
value: Célistine Oosting (DIVD)
Published: 2023-07-10T06:29:48.514Z
CVE-2021-42082 Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355
Local users are able to execute scripts under root privileges.

POC

On the local host run the following command:

curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: OSNEXUS
product: QuantaStor
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Wietse Boonstra (DIVD)
lang: en
value: Frank Breedijk (DIVD)
lang: en
value: Victor Pasman (DIVD)
lang: en
value: Victor Gevers (DIVD)
lang: en
value: Max van der Horst (DIVD)
lang: en
value: Célistine Oosting (DIVD)
Published: 2023-07-10T06:29:47.984Z
CVE-2021-42083 Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335
An authenticated attacker is able to create alerts that trigger a stored XSS attack.

POC


  *  go to the alert manager


  *  open the ITSM tab
  *  add a webhook with the URL/service token value 

'	-h	&&	id	|	tee	/tmp/ttttttddddssss	#' (whitespaces are tab characters)


  *  click add


  *  click apply


  *  create a test alert


  *  The test alert will run the command 

“id	|	tee	/tmp/ttttttddddssss” as root.


  *  after the test alert inspect 

/tmp/ttttttddddssss it'll contain the ids of the root user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: OSNEXUS
product: QuantaStor
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Wietse Boonstra (DIVD)
lang: en
value: Frank Breedijk (DIVD)
lang: en
value: Victor Pasman (DIVD)
lang: en
value: Victor Gevers (DIVD)
lang: en
value: Max van der Horst (DIVD)
lang: en
value: Célistine Oosting (DIVD)
Published: 2023-07-10T06:29:47.782Z
CVE-2021-42084 
An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:37:13.000Z
CVE-2021-42085 
An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:36:50.000Z
CVE-2021-42086 
An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:36:39.000Z
CVE-2021-42087 
An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:36:27.000Z
CVE-2021-42088 
An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:36:07.000Z
CVE-2021-42089 
An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:35:54.000Z
CVE-2021-42090 
An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:35:41.000Z
CVE-2021-42091 
An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:35:28.000Z
CVE-2021-42092 
An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:35:17.000Z
CVE-2021-42093 
An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:35:02.000Z
CVE-2021-42094 
An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T19:34:41.000Z
CVE-2021-42095 
Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-07T20:14:10.000Z
CVE-2021-42096 
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-21T00:40:34.000Z
CVE-2021-42097 
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-21T00:45:13.000Z
CVE-2021-42098 
An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerShell.
Problem types: description: Insecure Permissions
Affected products: vendor: Devolutions
product: Remote Desktop Manager
Published: 2021-10-18T13:22:57.000Z
CVE-2021-42099 
Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T18:47:17.000Z
CVE-2021-42101 
An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42103.
Problem types: description: Uncontrolled Search Path Element Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2021-10-21T07:46:04.000Z
CVE-2021-42102 
An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Uncontrolled Search Path Element Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2021-10-21T07:46:05.000Z
CVE-2021-42103 
An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42101.
Problem types: description: Uncontrolled Search Path Element Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2021-10-21T07:46:06.000Z
CVE-2021-42104 
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42105, 42106 and 42107.
Problem types: description: Unnecessary Privileges Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-10-21T07:46:07.000Z
CVE-2021-42105 
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42104, 42106 and 42107.
Problem types: description: Unnecessary Privileges Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-10-21T07:46:08.000Z
CVE-2021-42106 
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42104, 42105 and 42107.
Problem types: description: Unnecessary Privileges Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-10-21T07:46:09.000Z
CVE-2021-42107 
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42104, 42105 and 42106.
Problem types: description: Unnecessary Privileges Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-10-21T07:46:10.000Z
CVE-2021-42108 
Unnecessary privilege vulnerabilities in the Web Console of Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Unnecessary Privileges Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-10-21T07:46:11.000Z
CVE-2021-42109 
VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-08T17:45:26.000Z
CVE-2021-42110 
An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. A standard user can escalate privileges to SYSTEM if the FTP module is installed, because of DLL hijacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:H/I:L/PR:N/S:U/UI:N
version: 3.1
Published: 2021-12-08T15:42:31.000Z
CVE-2021-42111 
An issue was discovered in the RCDevs OpenOTP app 1.4.13 and 1.4.14 for iOS. If it is installed on a jailbroken device, it is possible to retrieve the PIN code used to access the application. The IOS app version 1.4.1631262629 resolves this issue by storing a hash PIN code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:N/C:H/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2021-11-10T18:03:00.000Z
CVE-2021-42112 
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-08T20:45:23.000Z
CVE-2021-42113 
An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-03T01:46:08.000Z