stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-33365 (severity: MEDIUM, weakness: CWE-401)
Memory leak in the gf_isom_get_root_od function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
CVE-2021-33366 (severity: MEDIUM, weakness: CWE-401)
Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
CVE-2021-33367 (severity: MEDIUM, weakness: CWE-125)
Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker to cause a denial of service via a crafted JXR file.
CVE-2021-3337 (severity: HIGH, weakness: CWE-863)
The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on reply or quote in the postbit.
CVE-2021-33371 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in /nav_bar_action.php of Student Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat box.
CVE-2021-33387 (severity: CRITICAL, weakness: CWE-79)
Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.
CVE-2021-33388 (severity: CRITICAL, weakness: CWE-787)
dpic 2021.04.10 has a Heap Buffer Overflow in themakevar() function in dpic.y
CVE-2021-3339 (severity: MEDIUM, weakness: CWE-287)
ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the Profile Screen.
CVE-2021-33390 (severity: CRITICAL, weakness: CWE-416)
dpic 2021.04.10 has a use-after-free in thedeletestringbox() function in dpic.y. A different vulnerablility than CVE-2021-32421.
CVE-2021-33391 (severity: CRITICAL, weakness: CWE-416)
An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.
CVE-2021-33393 (severity: HIGH, weakness: NVD-CWE-Other)
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.
CVE-2021-33394 (severity: MEDIUM, weakness: CWE-384)
Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session.
CVE-2021-33396 (severity: MEDIUM, weakness: CWE-352)
Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php.
CVE-2021-3340 (severity: MEDIUM, weakness: CWE-79)
A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogon or modules/admin/DELETEIMAGES.php.
CVE-2021-33403 (severity: HIGH, weakness: CWE-190)
An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses between two large accounts during a transaction.
CVE-2021-33408 (severity: MEDIUM, weakness: CWE-319)
Local File Inclusion vulnerability in Ab Initio Control>Center before 4.0.2.6 allows remote attackers to retrieve arbitrary files. Fixed in v4.0.2.6 and v4.0.3.1.
CVE-2021-3341 (severity: HIGH, weakness: CWE-22)
A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows, version 19.5 through 20.x before 20.0.219.0, allows an attacker to read any file on the host file system via an HTTP request.
CVE-2021-3342 (severity: CRITICAL, weakness: CWE-78)
EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex= URI.
CVE-2021-33420 (severity: CRITICAL, weakness: CWE-502)
A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.
CVE-2021-33425 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers to inject arbitrary Javascript in the OpenWRT Hostname via the Hostname Change operation.
CVE-2021-33430 (severity: MEDIUM, weakness: CWE-120)
A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user
CVE-2021-33436 (severity: HIGH, weakness: NVD-CWE-Other)
NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL Hijacking via any writable directory listed under the system path and ultimately execute code as NT AUTHORITY\SYSTEM.
CVE-2021-33437 (severity: MEDIUM, weakness: CWE-401)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks in frozen_cb() in mjs.c.
CVE-2021-33438 (severity: MEDIUM, weakness: CWE-787)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in json_parse_array() in mjs.c.
CVE-2021-33439 (severity: MEDIUM, weakness: CWE-190)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is Integer overflow in gc_compact_strings() in mjs.c.
CVE-2021-3344 (severity: HIGH, weakness: CWE-522)
A privilege escalation flaw was found in OpenShift builder. During build time, credentials outside the build context are automatically mounted into the container image under construction. An OpenShift user, able to execute code during build time inside this container can re-use the credentials to overwrite arbitrary container images in internal registries and/or escalate their privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This affects github.com/openshift/builder v0.0.0-20210125201112-7901cb396121 and before.
CVE-2021-33440 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs.c.
CVE-2021-33441 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in exec_expr() in mjs.c.
CVE-2021-33442 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in json_printf() in mjs.c.
CVE-2021-33443 (severity: MEDIUM, weakness: CWE-787)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in mjs_execute() in mjs.c.
CVE-2021-33444 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in getprop_builtin_foreign() in mjs.c.
CVE-2021-33445 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_string_char_code_at() in mjs.c.
CVE-2021-33446 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_next() in mjs.c.
CVE-2021-33447 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_print() in mjs.c.
CVE-2021-33448 (severity: MEDIUM, weakness: CWE-787)
An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow at 0x7fffe9049390.
CVE-2021-33449 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offset() in mjs.c.
CVE-2021-3345 (severity: HIGH, weakness: CWE-787)
_gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. It is recommended to upgrade to 1.9.1 or later.
CVE-2021-33450 (severity: MEDIUM, weakness: CWE-401)
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
CVE-2021-33451 (severity: MEDIUM, weakness: CWE-401)
An issue was discovered in lrzip version 0.641. There are memory leaks in fill_buffer() in stream.c.
CVE-2021-33452 (severity: MEDIUM, weakness: CWE-401)
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_malloc() in nasmlib/alloc.c.
CVE-2021-33453 (severity: HIGH, weakness: CWE-416)
An issue was discovered in lrzip version 0.641. There is a use-after-free in ucompthread() in stream.c:1538.
CVE-2021-33454 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libyasm/expr.c.
CVE-2021-33455 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33456 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33457 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33458 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33459 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c.
CVE-2021-3346 (severity: CRITICAL, weakness: NVD-CWE-Other)
Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template.
CVE-2021-33460 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33461 (severity: MEDIUM, weakness: CWE-416)
An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c.
CVE-2021-33462 (severity: MEDIUM, weakness: CWE-416)
An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/expr.c.
CVE-2021-33463 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c.
CVE-2021-33464 (severity: MEDIUM, weakness: CWE-787)
An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33465 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33466 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33467 (severity: MEDIUM, weakness: CWE-416)
An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33468 (severity: MEDIUM, weakness: CWE-416)
An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c.
CVE-2021-33469 (severity: MEDIUM, weakness: CWE-79)
COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.
CVE-2021-3347 (severity: HIGH, weakness: CWE-416)
An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
CVE-2021-33470 (severity: CRITICAL, weakness: CWE-89)
COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
CVE-2021-33473 (severity: CRITICAL, weakness: CWE-88)
An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
CVE-2021-33477 (severity: HIGH, weakness: CWE-755)
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
CVE-2021-33478 (severity: MEDIUM, weakness: CWE-119)
The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. This, for example, affects certain Cisco IP Phone and Wireless IP Phone products before 2021-07-07. Exploitation is possible only when the attacker can disassemble the device in order to control the voltage/current for chip pins.
CVE-2021-33479 (severity: HIGH, weakness: CWE-119)
A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measure_pitch() in pgm2asc.c.
CVE-2021-3348 (severity: HIGH, weakness: CWE-362)
nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
CVE-2021-33480 (severity: MEDIUM, weakness: CWE-416)
An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in context_correction() in pgm2asc.c.
CVE-2021-33481 (severity: HIGH, weakness: CWE-119)
A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in try_to_divide_boxes() in pgm2asc.c.
CVE-2021-33483 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment.
CVE-2021-33484 (severity: HIGH, weakness: CWE-798)
An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted encryption key (sent as a parameter in the comment form request) by setting this encrypted value as the username, which will appear on the comment page in its decrypted form. Using these two values (combined with the encryption functionality discovered in the decompiled installer), the attacker can encrypt another user's ID and username. These values can be used as part of the comment posting request in order to spoof the user.
CVE-2021-33485 (severity: CRITICAL, weakness: CWE-787)
CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
CVE-2021-33486 (severity: HIGH, weakness: CWE-755)
All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.
CVE-2021-33488 (severity: MEDIUM, weakness: CWE-20)
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook.
CVE-2021-33489 (severity: MEDIUM, weakness: CWE-79)
OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.
CVE-2021-3349 (severity: LOW, weakness: CWE-345)
GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior
CVE-2021-33490 (severity: MEDIUM, weakness: CWE-79)
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.
CVE-2021-33491 (severity: MEDIUM, weakness: CWE-22)
OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.
CVE-2021-33492 (severity: MEDIUM, weakness: CWE-79)
OX App Suite 7.10.5 allows XSS via an OX Chat room name.
CVE-2021-33493 (severity: MEDIUM, weakness: CWE-94)
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.
CVE-2021-33494 (severity: MEDIUM, weakness: CWE-79)
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
CVE-2021-33495 (severity: MEDIUM, weakness: CWE-79)
OX App Suite 7.10.5 allows XSS via an OX Chat system message.
CVE-2021-33496 (severity: MEDIUM, weakness: CWE-79)
Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.
CVE-2021-33497 (severity: CRITICAL, weakness: CWE-22)
Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.
CVE-2021-33498 (severity: HIGH, weakness: CWE-20)
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).
CVE-2021-33499 (severity: HIGH, weakness: CWE-20)
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).
CVE-2021-3350 (severity: MEDIUM, weakness: CWE-79)
deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.
CVE-2021-33500 (severity: HIGH, weakness: NVD-CWE-Other)
PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. NOTE: the same attack methodology may affect some OS-level GUIs on Linux or other platforms for similar reasons.
CVE-2021-33501 (severity: CRITICAL, weakness: CWE-79)
Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL.
CVE-2021-33502 (severity: HIGH, weakness: CWE-1333)
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
CVE-2021-33503 (severity: HIGH, weakness: CWE-400)
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
CVE-2021-33504 (severity: MEDIUM, weakness: NVD-CWE-Other)
Couchbase Server before 7.1.0 has Incorrect Access Control.
CVE-2021-33505 (severity: HIGH, weakness: CWE-269)
A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters arguments of system calls being executed. Issue is fixed in Falco versions >= 0.29.1.
CVE-2021-33506 (severity: HIGH, weakness: CWE-276)
jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This can allow an attacker to circumvent conference moderation.
CVE-2021-33507 (severity: MEDIUM, weakness: CWE-79)
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
CVE-2021-33508 (severity: MEDIUM, weakness: CWE-79)
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.
CVE-2021-33509 (severity: CRITICAL, weakness: CWE-732)
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
CVE-2021-3351 (severity: MEDIUM, weakness: CWE-79)
OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page.
CVE-2021-33510 (severity: MEDIUM, weakness: CWE-918)
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.
CVE-2021-33511 (severity: HIGH, weakness: CWE-918)
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
CVE-2021-33512 (severity: MEDIUM, weakness: CWE-79)
Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.
CVE-2021-33513 (severity: MEDIUM, weakness: CWE-79)
Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.
CVE-2021-33514 (severity: CRITICAL, weakness: CWE-78)
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as demonstrated by setup.cgi?token=';$HTTP_USER_AGENT;' with an OS command in the User-Agent field. This affects GC108P before 1.0.7.3, GC108PP before 1.0.7.3, GS108Tv3 before 7.0.6.3, GS110TPPv1 before 7.0.6.3, GS110TPv3 before 7.0.6.3, GS110TUPv1 before 1.0.4.3, GS710TUPv1 before 1.0.4.3, GS716TP before 1.0.2.3, GS716TPP before 1.0.2.3, GS724TPPv1 before 2.0.4.3, GS724TPv2 before 2.0.4.3, GS728TPPv2 before 6.0.6.3, GS728TPv2 before 6.0.6.3, GS752TPPv1 before 6.0.6.3, GS752TPv2 before 6.0.6.3, MS510TXM before 1.0.2.3, and MS510TXUP before 1.0.2.3.
CVE-2021-33515 (severity: MEDIUM, weakness: CWE-77)
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
CVE-2021-33516 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.
CVE-2021-3352 (severity: CRITICAL, weakness: NVD-CWE-Other)
The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacker to access (view and modify) user data without authorization due to improper handling of tokens.