rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-45018 
Cross Site Scripting (XSS) vulnerability exists in Catfish <=6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.htmland then the .html file on the website that uses this editor (the file suffix is allowed).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T22:24:42.000Z
CVE-2021-45024 
ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-17T11:57:47.000Z
CVE-2021-45025 
ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Information in a Cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-17T11:57:54.000Z
CVE-2021-45026 
ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-17T11:58:12.000Z
CVE-2021-45027 
An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-01T17:47:24.000Z
CVE-2021-45029 Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection
Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Apache Software Foundation
product: Apache ShenYu (incubating)
Published: 2022-01-25T13:00:21.000Z
CVE-2021-45031 Weak Authentication in Login Function of USC+
A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: Mepsan
product: USC+
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
Credits: lang: en
value: Kürşat ÇETİN
Published: 2022-03-30T19:55:10.646Z
CVE-2021-45033 
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). An undocumented debug port uses hard-coded default credentials. If this port is enabled by a privileged user, an attacker aware of the credentials could access an administrative debug shell on the affected device.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: Siemens
product: CP-8000 MASTER MODULE WITH I/O -25/+70°C
vendor: Siemens
product: CP-8000 MASTER MODULE WITH I/O -40/+70°C
vendor: Siemens
product: CP-8021 MASTER MODULE
vendor: Siemens
product: CP-8022 MASTER MODULE WITH GPRS
Published: 2022-01-11T11:27:17.000Z
CVE-2021-45034 
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged user. An unauthenticated attacker could access the files by knowing the corresponding download links.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: CP-8000 MASTER MODULE WITH I/O -25/+70°C
vendor: Siemens
product: CP-8000 MASTER MODULE WITH I/O -40/+70°C
vendor: Siemens
product: CP-8021 MASTER MODULE
vendor: Siemens
product: CP-8022 MASTER MODULE WITH GPRS
Published: 2022-01-11T11:27:17.000Z
CVE-2021-45035 Velneo vClient Improper authentication
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Velneo
product: Velneo vClient
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-09-23T15:02:18.737Z
CVE-2021-45036 Velneo vClient improper authentication
Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server.
Problem types: cwe_id: CWE-290
description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Velneo
product: Velneo vClient
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Jesús Ródenas Huerta, @Marmeus
Published: 2022-11-28T15:29:02.063Z
CVE-2021-45038 
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-17T00:00:00.000Z
CVE-2021-45039 
Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumented UDP service on port 7788 that allows a remote unauthenticated attacker to overflow an internal buffer and achieve code execution. By using this buffer overflow, a remote attacker can start the telnetd service. This service has a hardcoded default username and password (root/123456). Although it has a restrictive shell, this can be easily bypassed via the built-in ECHO shell command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-31T00:00:00.000Z
CVE-2021-45040 
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T20:22:52.000Z
CVE-2021-45041 
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_date.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-19T08:34:10.000Z
CVE-2021-45042 
In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-17T13:38:51.000Z
CVE-2021-45043 
HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T07:13:03.000Z
CVE-2021-45046 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Problem types: cwe_id: CWE-917
description: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Log4j
Published: 2021-12-14T16:55:09.000Z
CVE-2021-45051 Adobe Bridge JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability
Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Bridge
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-01-14T19:04:58.575Z
CVE-2021-45052 Adobe Bridge TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: Bridge
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-01-14T19:04:53.893Z
CVE-2021-45053 Adobe InCopy JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: InCopy
Published: 2022-01-13T20:27:32.838Z
CVE-2021-45054 Adobe InCopy JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability
Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: InCopy
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-01-13T20:27:31.538Z
CVE-2021-45055 Adobe InCopy TIF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: InCopy
Published: 2022-01-13T20:27:35.140Z
CVE-2021-45056 Adobe InCopy JPEG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: InCopy
Published: 2022-01-13T20:27:33.948Z
CVE-2021-45057 Adobe InDesign JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPEG2000 file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: InDesign
Published: 2022-01-13T20:27:37.525Z
CVE-2021-45058 Adobe InDesign JPEG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPEG file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: InDesign
Published: 2022-01-13T20:27:36.330Z
CVE-2021-45059 Adobe InDesign JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability
Adobe InDesign version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: InDesign
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-01-13T20:27:38.735Z
CVE-2021-45060 Adobe Acrobat Reader DC TTF Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: Acrobat Reader
Published: 2022-01-14T19:05:19.381Z
CVE-2021-45061 Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Acrobat Reader
Published: 2022-01-14T19:05:22.191Z
CVE-2021-45062 Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
Published: 2022-01-14T19:05:05.488Z
CVE-2021-45063 Adobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
Published: 2022-01-14T19:05:16.567Z
CVE-2021-45064 Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
Published: 2022-01-14T19:05:23.583Z
CVE-2021-45067 Adobe Acrobat Reader Memory Corruption could lead to Information Disclosure
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-788
description: Access of Memory Location After End of Buffer (CWE-788)
Affected products: vendor: Adobe
product: Acrobat Reader
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-01-14T19:05:35.776Z
CVE-2021-45068 Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Acrobat Reader
Published: 2022-01-14T19:05:09.071Z
CVE-2021-45071 
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS)
Affected products: vendor: Odoo
product: Odoo Community
default_status: unaffected
vendor: Odoo
product: Odoo Enterprise
default_status: unaffected
Credits: lang: eng
value: Lauri Vakkala
lang: eng
value: Anıl Yüksel
lang: eng
value: Agustin Maio
lang: eng
value: Johannes Moritz
Published: 2023-04-25T18:29:52.108Z
CVE-2021-45074 
JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: JFrog
product: JFrog Artifactory
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2022-03-02T21:20:11.000Z
CVE-2021-45077 
Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device.
Problem types: description: Plaintext Password Storage
Affected products: vendor: n/a
product: Netgear Nighthawk R6700
Published: 2021-12-30T21:31:21.000Z
CVE-2021-45078 
stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T19:37:46.000Z
CVE-2021-45079 
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-31T07:15:52.000Z
CVE-2021-45081 
An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-20T17:52:52.000Z
CVE-2021-45082 
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:23:30.000Z