stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-46013 (severity: CRITICAL, weakness: CWE-434)
An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "<?php system($_GET["cmd"]); ?>" gets uploaded it is saved into /uploads/exam_question/ directory, and is accessible by all users.
CVE-2021-46019 (severity: MEDIUM, weakness: CWE-476)
An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
CVE-2021-46020 (severity: HIGH, weakness: CWE-119)
An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
CVE-2021-46021 (severity: MEDIUM, weakness: CWE-416)
An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
CVE-2021-46022 (severity: MEDIUM, weakness: CWE-416)
An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
CVE-2021-46023 (severity: HIGH, weakness: CWE-119)
An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application crash.
CVE-2021-46024 (severity: CRITICAL, weakness: CWE-89)
Projectworlds online-shopping-webvsite-in-php 1.0 suffers from a SQL Injection vulnerability via the "id" parameter in cart_add.php, No login is required.
CVE-2021-46025 (severity: MEDIUM, weakness: CWE-79)
A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the background.
CVE-2021-46026 (severity: MEDIUM, weakness: CWE-79)
mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management.
CVE-2021-46027 (severity: MEDIUM, weakness: CWE-352)
mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, a blog tag will be added
CVE-2021-46028 (severity: MEDIUM, weakness: CWE-352)
In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted.
CVE-2021-46030 (severity: MEDIUM, weakness: CWE-79)
There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module.
CVE-2021-46033 (severity: CRITICAL, weakness: CWE-434)
In ForestBlog, as of 2021-12-28, File upload can bypass verification.
CVE-2021-46034 (severity: MEDIUM, weakness: CWE-79)
A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box.
CVE-2021-46036 (severity: CRITICAL, weakness: CWE-434)
An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
CVE-2021-46037 (severity: HIGH, weakness: NVD-CWE-Other)
MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
CVE-2021-46038 (severity: MEDIUM, weakness: CWE-476)
A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (context-dependent).
CVE-2021-46039 (severity: MEDIUM, weakness: CWE-476)
A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the shift_chunk_offsets.part function, which causes a Denial of Service (context-dependent).
CVE-2021-46040 (severity: MEDIUM, weakness: CWE-476)
A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the finplace_shift_moov_meta_offsets function, which causes a Denial of Servie (context-dependent).
CVE-2021-46041 (severity: MEDIUM, weakness: NVD-CWE-Other)
A Segmentation Fault Vulnerability exists in GPAC 1.0.1 via the co64_box_new function, which causes a Denial of Service.
CVE-2021-46042 (severity: MEDIUM, weakness: CWE-476)
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the _fseeko function, which causes a Denial of Service.
CVE-2021-46043 (severity: MEDIUM, weakness: CWE-476)
A Pointer Dereference Vulnerability exits in GPAC 1.0.1 in the gf_list_count function, which causes a Denial of Service.
CVE-2021-46044 (severity: MEDIUM, weakness: CWE-476)
A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1via ShiftMetaOffset.isra, which causes a Denial of Service (context-dependent).
CVE-2021-46045 (severity: MEDIUM, weakness: NVD-CWE-Other)
GPAC 1.0.1 is affected by: Abort failed. The impact is: cause a denial of service (context-dependent).
CVE-2021-46046 (severity: MEDIUM, weakness: CWE-476)
A Pointer Derefernce Vulnerbility exists GPAC 1.0.1 the gf_isom_box_size function, which could cause a Denial of Service (context-dependent).
CVE-2021-46047 (severity: MEDIUM, weakness: CWE-476)
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_hinter_finalize function.
CVE-2021-46048 (severity: MEDIUM, weakness: CWE-617)
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.
CVE-2021-46049 (severity: MEDIUM, weakness: CWE-476)
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_fileio_check function, which could cause a Denial of Service.
CVE-2021-46050 (severity: MEDIUM, weakness: CWE-770)
A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.
CVE-2021-46051 (severity: MEDIUM, weakness: CWE-476)
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the Media_IsSelfContained function, which could cause a Denial of Service. .
CVE-2021-46052 (severity: MEDIUM, weakness: CWE-617)
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.
CVE-2021-46053 (severity: MEDIUM, weakness: CWE-119)
A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL.
CVE-2021-46054 (severity: MEDIUM, weakness: CWE-617)
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
CVE-2021-46055 (severity: MEDIUM, weakness: CWE-617)
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
CVE-2021-46061 (severity: CRITICAL, weakness: CWE-89)
An SQL Injection vulnerability exists in Sourcecodester Computer and Mobile Repair Shop Management system (RSMS) 1.0 via the code parameter in /rsms/ node app.
CVE-2021-46062 (severity: HIGH, weakness: NVD-CWE-Other)
MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
CVE-2021-46063 (severity: CRITICAL, weakness: CWE-94)
MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.
CVE-2021-46064 (severity: HIGH, weakness: CWE-120)
IrfanView 4.59 is vulnerable to buffer overflow via the function at address 0x413c70 (in 32bit version of the binary). The vulnerability triggers when the user opens malicious .tiff image.
CVE-2021-46065 (severity: MEDIUM, weakness: CWE-79)
A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.
CVE-2021-46067 (severity: CRITICAL, weakness: NVD-CWE-Other)
In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.
CVE-2021-46068 (severity: MEDIUM, weakness: CWE-79)
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.
CVE-2021-46069 (severity: MEDIUM, weakness: CWE-79)
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.
CVE-2021-46070 (severity: MEDIUM, weakness: CWE-79)
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel.
CVE-2021-46071 (severity: MEDIUM, weakness: CWE-79)
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.
CVE-2021-46072 (severity: MEDIUM, weakness: CWE-79)
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.
CVE-2021-46073 (severity: MEDIUM, weakness: CWE-79)
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section in login panel.
CVE-2021-46074 (severity: MEDIUM, weakness: CWE-79)
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Settings Section in login panel.
CVE-2021-46075 (severity: HIGH, weakness: CWE-862)
A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and perform CRUD Operations.
CVE-2021-46076 (severity: HIGH, weakness: CWE-434)
Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. An attacker can upload a malicious php file in multiple endpoints it leading to Code Execution.
CVE-2021-46078 (severity: MEDIUM, weakness: CWE-434)
An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to a Stored Cross-Site Scripting vulnerability.
CVE-2021-46079 (severity: HIGH, weakness: CWE-434)
An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection.
CVE-2021-46080 (severity: MEDIUM, weakness: CWE-79)
A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Scripting Vulnerability.
CVE-2021-46082 (severity: HIGH, weakness: CWE-401)
Moxa TN-5900 v3.1 series routers, MGate 5109 v2.2 series protocol gateways, and MGate 5101-PBM-MN v2.1 series protocol gateways were discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via crafted packets.
CVE-2021-46083 (severity: MEDIUM, weakness: CWE-79)
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code.
CVE-2021-46084 (severity: MEDIUM, weakness: CWE-79)
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box.
CVE-2021-46085 (severity: MEDIUM, weakness: CWE-276)
OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority.
CVE-2021-46086 (severity: HIGH, weakness: CWE-276)
xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnerability in the functional method of submitting examination papers. An attacker can use burpuite to modify parameters in the packet to destroy real data.
CVE-2021-46087 (severity: MEDIUM, weakness: CWE-79)
In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code.
CVE-2021-46088 (severity: HIGH, weakness: NVD-CWE-Other)
Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.
CVE-2021-46089 (severity: CRITICAL, weakness: CWE-89)
In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.
CVE-2021-46093 (severity: CRITICAL, weakness: CWE-276)
eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php.
CVE-2021-46097 (severity: HIGH, weakness: CWE-434)
Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log
CVE-2021-46101 (severity: HIGH, weakness: NVD-CWE-Other)
In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.
CVE-2021-46102 (severity: HIGH, weakness: CWE-190)
From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via "addr = (sym.st_value + refd_pa) as u64";
CVE-2021-46104 (severity: HIGH, weakness: CWE-22)
An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server.
CVE-2021-46107 (severity: HIGH, weakness: CWE-918)
Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features.
CVE-2021-46108 (severity: MEDIUM, weakness: CWE-79)
D-Link DSL-2730E CT-20131125 devices allow XSS via the username parameter to the password page in the maintenance configuration.
CVE-2021-46109 (severity: MEDIUM, weakness: CWE-79)
Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack.
CVE-2021-46110 (severity: CRITICAL, weakness: CWE-89)
Online Shopping Portal v3.1 was discovered to contain multiple time-based SQL injection vulnerabilities via the email and contactno parameters.
CVE-2021-46113 (severity: HIGH, weakness: CWE-434)
In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service.
CVE-2021-46114 (severity: HIGH, weakness: CWE-94)
jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
CVE-2021-46115 (severity: HIGH, weakness: CWE-434)
jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code.
CVE-2021-46116 (severity: HIGH, weakness: CWE-434)
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code.
CVE-2021-46117 (severity: HIGH, weakness: CWE-94)
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
CVE-2021-46118 (severity: HIGH, weakness: CWE-94)
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
CVE-2021-46122 (severity: HIGH, weakness: CWE-120)
Tp-Link TL-WR840N (EU) v6.20 Firmware (0.9.1 4.17 v0001.0 Build 201124 Rel.64328n) is vulnerable to Buffer Overflow via the Password reset feature.
CVE-2021-46141 (severity: MEDIUM, weakness: CWE-416)
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.
CVE-2021-46142 (severity: MEDIUM, weakness: CWE-416)
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.
CVE-2021-46143 (severity: HIGH, weakness: CWE-190)
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
CVE-2021-46144 (severity: MEDIUM, weakness: CWE-79)
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
CVE-2021-46145 (severity: MEDIUM, weakness: CWE-294)
The keyfob subsystem in Honda Civic 2012 vehicles allows a replay attack for unlocking. This is related to a non-expiring rolling code and counter resynchronization.
CVE-2021-46146 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file.
CVE-2021-46147 (severity: HIGH, weakness: CWE-352)
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF.
CVE-2021-46148 (severity: MEDIUM, weakness: CWE-200)
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance.
CVE-2021-46149 (severity: HIGH, weakness: CWE-400)
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.
CVE-2021-46150 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October.
CVE-2021-46151 (severity: HIGH, weakness: CWE-787)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14754, ZDI-CAN-15082)
CVE-2021-46152 (severity: HIGH, weakness: CWE-843)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a type confusion vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14643, ZDI-CAN-14644, ZDI-CAN-14755, ZDI-CAN-15183)
CVE-2021-46153 (severity: HIGH, weakness: CWE-119)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a memory corruption vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14645, ZDI-CAN-15305, ZDI-CAN-15589, ZDI-CAN-15599)
CVE-2021-46154 (severity: HIGH, weakness: CWE-121)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14646, ZDI-CAN-14679, ZDI-CAN-15084, ZDI-CAN-15304)
CVE-2021-46155 (severity: HIGH, weakness: CWE-121)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14683, ZDI-CAN-15283, ZDI-CAN-15303, ZDI-CAN-15593)
CVE-2021-46156 (severity: HIGH, weakness: CWE-787)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14684)
CVE-2021-46157 (severity: HIGH, weakness: CWE-119)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a memory corruption vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14757)
CVE-2021-46158 (severity: HIGH, weakness: CWE-121)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15085, ZDI-CAN-15289, ZDI-CAN-15602)
CVE-2021-46159 (severity: HIGH, weakness: CWE-787)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15050)
CVE-2021-46160 (severity: HIGH, weakness: CWE-787)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15286)
CVE-2021-46161 (severity: HIGH, weakness: CWE-787)
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15302)
CVE-2021-46162 (severity: HIGH, weakness: CWE-787)
A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15048)
CVE-2021-46163 (severity: MEDIUM, weakness: CWE-79)
Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem.
CVE-2021-46164 (severity: HIGH, weakness: NVD-CWE-Other)
Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module.
CVE-2021-46165 (severity: HIGH, weakness: NVD-CWE-Other)
Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined.
CVE-2021-46166 (severity: MEDIUM, weakness: CWE-200)
Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.
CVE-2021-46167 (severity: HIGH, weakness: NVD-CWE-Other)
An access control issue in the authentication module of wizplat PD065 v1.19 allows attackers to access sensitive data and cause a Denial of Service (DoS).
CVE-2021-46168 (severity: MEDIUM, weakness: CWE-787)
Spin v6.5.1 was discovered to contain an out-of-bounds write in lex() at spinlex.c.
CVE-2021-46169 (severity: MEDIUM, weakness: CWE-416)
Modex v2.11 was discovered to contain an Use-After-Free vulnerability via the component tcache.