rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-40828 TLS hostname validation issues within AWS IoT Device SDKs on Windows
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.
Problem types: description: Connections initialized by the AWS IoT Device SDK v2 for Java, Python, C++ and Node.js did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows.
Affected products: vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for Java
vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for Python
vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for C++
vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for Node.js
vendor: Amazon Web Services
product: AWS-C-IO
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: F-Secure
Published: 2021-11-22T23:41:16.000Z
CVE-2021-40829 TLS hostname validation issues within AWS IoT Device SDKs on macOS
Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.
Problem types: description: Connections initialized by the AWS IoT Device SDK v2 for Java, Python, C++ and Node.js did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows.
Affected products: vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for Java
vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for Python
vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for C++
vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for Node.js
vendor: Amazon Web Services
product: AWS-C-IO
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: F-Secure
Published: 2021-11-22T23:41:17.000Z
CVE-2021-40830 Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems
The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.
Problem types: description: The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker.
Affected products: vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for Java
vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for Python
vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for C++
vendor: Amazon Web Services
product: AWS IoT Device SDK v2 for Node.js
vendor: Amazon Web Services
product: AWS-C-IO
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: F-Secure
Published: 2021-11-22T23:41:18.000Z
CVE-2021-40832 Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVRDL unpacking module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: F-Secure
product: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit)  F-Secure Linux Security 64  F-Secure Atlant  F-Secure Cloud Protection for Salesforce and Cloud Protection for Microsoft Office 365
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2021-10-08T09:45:34.000Z
CVE-2021-40833 Denial-of-Service (DoS) Vulnerability
A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: F-Secure
product: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit)  F-Secure Linux Security 64 F-Secure Internet Gatekeeper & F-Secure Atlant
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2021-11-26T16:39:54.000Z
CVE-2021-40834 User interface Spoofing in F-Secure SAFE browser for Android
A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack.
Problem types: description: User interface Spoofing in F-Secure SAFE browser for Android
Affected products: vendor: F-Secure
product: F-Secure Mobile Security
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2021-12-10T13:38:46.000Z
CVE-2021-40835 URL Address Bar Spoofing in F-Secure SAFE Browser for iOS
An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially crafted a malicious URL, if user does not carefully pay attention to url, user may be tricked to think content may be coming from a valid domain, while it comes from another. This is performed by using a very long username part of the url so that user cannot see the domain name. A remote attacker can leverage this to perform url address bar spoofing attack. The fix is, browser no longer shows the user name part in address bar.
Problem types: description: URL Address Bar Spoofing in F-Secure SAFE Browser for iOS
Affected products: vendor: F-Secure
product: F-Secure Mobile Security
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2021-12-16T10:58:55.000Z
CVE-2021-40836 Denial-of-Service (DoS) Vulnerability
A vulnerability affecting F-Secure antivirus engine was discovered whereby scanning MS outlook .pst files can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: F-Secure
product: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit)  F-Secure Linux Security 64  F-Secure Atlant & F-Secure Internet Gatekeeper
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
version: 3.1
Published: 2021-12-22T11:14:42.000Z
CVE-2021-40837 Denial-of-Service (DoS) Vulnerability
A vulnerability affecting F-Secure antivirus engine before Capricorn update 2022-02-01_01 was discovered whereby decompression of ACE file causes the scanner service to stop. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: F-Secure
product: F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, F-Secure Internet Gatekeeper & F-Secure Security Cloud
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
version: 3.1
Published: 2022-02-09T12:10:46.000Z
CVE-2021-40839 
The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-10T01:03:33.000Z
CVE-2021-40840 
A Stored XSS issue exists in the admin/users user administration form in LiveConfig 2.12.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T20:27:37.000Z
CVE-2021-40841 
A Path Traversal vulnerability for a log file in LiveConfig 2.12.2 allows authenticated attackers to read files on the underlying server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T20:27:35.000Z
CVE-2021-40842 
Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the server could be used to blindly execute arbitrary SQL statements on the backend database. Version 7.12.0 and all versions prior to 7.11.2 are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-13T17:17:01.000Z
CVE-2021-40843 
Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local database could cause arbitrary code to execute with SYSTEM privileges on the underlying server when a Web Console user triggers retrieval of that data. When chained with a SQL injection vulnerability, the vulnerability could be exploited remotely if Web Console users click a series of maliciously crafted URLs. All versions prior to 7.11.2 are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-13T17:10:53.000Z
CVE-2021-40845 
The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T12:39:43.000Z
CVE-2021-40846 
An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-04T21:33:05.000Z
CVE-2021-40847 
The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled by default. This daemon connects to Circle and NETGEAR to obtain version information and updates to the circled daemon and its filtering database. However, database updates from NETGEAR are unsigned and downloaded via cleartext HTTP. As such, an attacker with the ability to perform a MitM attack on the device can respond to circled update requests with a crafted, compressed database file, the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code. This affects R6400v2 1.0.4.106, R6700 1.0.2.16, R6700v3 1.0.4.106, R6900 1.0.2.16, R6900P 1.3.2.134, R7000 1.0.11.123, R7000P 1.3.2.134, R7850 1.0.5.68, R7900 1.0.4.38, R8000 1.0.4.68, and RS400 1.5.0.68.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-21T17:04:54.000Z
CVE-2021-40848 
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T10:11:45.000Z
CVE-2021-40849 
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T10:14:53.000Z
CVE-2021-40850 TCMAN GIM SQL injection vulnerability
TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TCMAN
product: GIM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Francisco Palma, Luis Vázquez and Diego León
Published: 2021-12-17T16:10:31.282Z
CVE-2021-40851 TCMAN GIM SQL injection vulnerability
TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: TCMAN
product: GIM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Francisco Palma, Luis Vázquez and Diego León
Published: 2021-12-17T16:10:32.086Z
CVE-2021-40852 TCMAN GIM open redirect vulnerability
TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: TCMAN
product: GIM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Victor Fidalgo Villar
Published: 2021-12-17T16:10:32.835Z
CVE-2021-40853 TCMAN GIM missing authorization vulnerability
TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL that require privileges without having them. The exploitation of this vulnerability might allow a remote attacker to obtain sensible information.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Victor Fidalgo Villar
Published: 2021-12-17T16:10:33.560Z
CVE-2021-40854 
AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to launch a privileged Notepad process that can launch other applications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-14T04:16:09.000Z
CVE-2021-40855 
The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key certificate could have been used in production.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-21T15:33:20.000Z
CVE-2021-40856 
Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-13T03:20:39.000Z
CVE-2021-40857 
Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-13T03:24:17.000Z
CVE-2021-40858 
Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileName=../../etc/passwd substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-13T03:27:51.000Z
CVE-2021-40859 
Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T18:59:10.000Z
CVE-2021-40860 
A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) before 9.0.013.11 allows an attacker to execute arbitrary SQL queries via the ql_expression parameter, with which all data in the database can be extracted and OS command execution is possible depending on the permissions and/or database engine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-08T14:45:59.000Z
CVE-2021-40861 
A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) 9.0.017.07 allows an attacker to execute arbitrary SQL queries via the value attribute, with which all data in the database can be extracted and OS command execution is possible depending on the permissions and/or database engine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-08T14:58:13.000Z
CVE-2021-40862 
HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties, which could be used for privilege escalation or unauthorized modification of a Terraform configuration. Fixed in v202109-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T18:03:45.000Z
CVE-2021-40864 
The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-10T18:07:04.000Z