stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-32068 (severity: LOW, weakness: CWE-770)
The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to modify application data and state.
CVE-2021-32069 (severity: MEDIUM, weakness: CWE-295)
The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.
CVE-2021-32070 (severity: MEDIUM, weakness: CWE-1021)
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response. A successful exploit could allow an attacker to modify the browser header and redirect users.
CVE-2021-32071 (severity: CRITICAL, weakness: NVD-CWE-Other)
The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful exploit could allow an attacker to view and modify application data, and cause a denial of service for users.
CVE-2021-32072 (severity: MEDIUM, weakness: CWE-116)
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods.
CVE-2021-32073 (severity: HIGH, weakness: CWE-352)
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-32074 (severity: HIGH, weakness: CWE-532)
HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.
CVE-2021-32075 (severity: CRITICAL, weakness: CWE-502)
Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.
CVE-2021-32076 (severity: MEDIUM, weakness: CWE-290)
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.
CVE-2021-32077 (severity: HIGH, weakness: NVD-CWE-Other)
Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (SSN) values via a brute-force attack on a (sometimes hidden) search field, because the last four SSN digits are part of the supported combination of search selectors. This discloses doctors' and nurses' social security numbers and PII.
CVE-2021-32078 (severity: HIGH, weakness: CWE-125)
An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4.
CVE-2021-32089 (severity: CRITICAL, weakness: CWE-434)
An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. An unauthenticated attacker can upload arbitrary files to the filesystem that can then be accessed through the web interface. This can lead to information disclosure and code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-32090 (severity: CRITICAL, weakness: CWE-78)
The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.
CVE-2021-32091 (severity: MEDIUM, weakness: CWE-79)
A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.
CVE-2021-32092 (severity: MEDIUM, weakness: CWE-79)
A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter.
CVE-2021-32093 (severity: MEDIUM, weakness: CWE-862)
The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter.
CVE-2021-32094 (severity: HIGH, weakness: CWE-434)
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.
CVE-2021-32095 (severity: HIGH, weakness: CWE-862)
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.
CVE-2021-32096 (severity: HIGH, weakness: CWE-352)
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.
CVE-2021-32098 (severity: CRITICAL, weakness: CWE-502)
Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.
CVE-2021-32099 (severity: CRITICAL, weakness: CWE-89)
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.
CVE-2021-3210 (severity: CRITICAL, weakness: CWE-79)
components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter.
CVE-2021-32100 (severity: MEDIUM, weakness: NVD-CWE-Other)
A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user.
CVE-2021-32101 (severity: HIGH, weakness: CWE-732)
The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient.
CVE-2021-32102 (severity: HIGH, weakness: CWE-89)
A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.
CVE-2021-32103 (severity: MEDIUM, weakness: CWE-79)
A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter.
CVE-2021-32104 (severity: HIGH, weakness: CWE-89)
A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.
CVE-2021-32106 (severity: MEDIUM, weakness: CWE-79)
In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.
CVE-2021-32122 (severity: HIGH, weakness: CWE-352)
Certain NETGEAR devices are affected by CSRF. This affects EX3700 before 1.0.0.90, EX3800 before 1.0.0.90, EX6120 before 1.0.0.64, and EX6130 before 1.0.0.44.
CVE-2021-32132 (severity: MEDIUM, weakness: CWE-476)
The abst_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32134 (severity: MEDIUM, weakness: CWE-476)
The gf_odf_desc_copy function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32135 (severity: MEDIUM, weakness: CWE-476)
The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32136 (severity: HIGH, weakness: CWE-787)
Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
CVE-2021-32137 (severity: MEDIUM, weakness: CWE-787)
Heap buffer overflow in the URL_GetProtocolType function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
CVE-2021-32138 (severity: MEDIUM, weakness: CWE-476)
The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32139 (severity: MEDIUM, weakness: CWE-476)
The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32142 (severity: HIGH, weakness: CWE-787)
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.
CVE-2021-32156 (severity: HIGH, weakness: CWE-352)
A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
CVE-2021-32157 (severity: CRITICAL, weakness: CWE-79)
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
CVE-2021-32158 (severity: MEDIUM, weakness: CWE-79)
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
CVE-2021-32159 (severity: HIGH, weakness: CWE-352)
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
CVE-2021-32160 (severity: MEDIUM, weakness: CWE-79)
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.
CVE-2021-32161 (severity: MEDIUM, weakness: CWE-79)
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.
CVE-2021-32162 (severity: HIGH, weakness: CWE-352)
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.
CVE-2021-32163 (severity: CRITICAL, weakness: CWE-863)
Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.
CVE-2021-32172 (severity: CRITICAL, weakness: CWE-862)
Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.
CVE-2021-32198 (severity: CRITICAL, weakness: NVD-CWE-Other)
EmTec ZOC through 8.02.4 allows remote servers to cause a denial of service (Windows GUI hang) by telling the ZOC window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon processing a title change.
CVE-2021-32202 (severity: MEDIUM, weakness: CWE-79)
In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page.
CVE-2021-3223 (severity: HIGH, weakness: CWE-22)
Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.
CVE-2021-32233 (severity: MEDIUM, weakness: CWE-79)
SmarterTools SmarterMail before Build 7776 allows XSS.
CVE-2021-32234 (severity: CRITICAL, weakness: NVD-CWE-Other)
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.
CVE-2021-32238 (severity: HIGH, weakness: CWE-787)
Epic Games / Psyonix Rocket League <=1.95 is affected by Buffer Overflow. Stack-based buffer overflow occurs when Rocket League handles UPK object files that can result in code execution and denial of service scenario.
CVE-2021-3224 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter.
CVE-2021-32243 (severity: HIGH, weakness: CWE-434)
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).
CVE-2021-32244 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
CVE-2021-32245 (severity: MEDIUM, weakness: CWE-79)
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.
CVE-2021-32256 (severity: MEDIUM, weakness: CWE-787)
An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.
CVE-2021-32263 (severity: HIGH, weakness: CWE-787)
ok-file-formats through 2021-04-29 has a heap-based buffer overflow in the ok_csv_circular_buffer_read function in ok_csv.c.
CVE-2021-32265 (severity: HIGH, weakness: CWE-120)
An issue was discovered in Bento4 through v1.6.0-637. A global-buffer-overflow exists in the function AP4_MemoryByteStream::WritePartial() located in Ap4ByteStream.cpp. It allows an attacker to cause code execution or information disclosure.
CVE-2021-32268 (severity: HIGH, weakness: CWE-787)
Buffer overflow vulnerability in function gf_fprintf in os_file.c in gpac before 1.0.1 allows attackers to execute arbitrary code. The fixed version is 1.0.1.
CVE-2021-32269 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function ilst_item_box_dump located in box_dump.c. It allows an attacker to cause Denial of Service.
CVE-2021-32270 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function vwid_box_del located in box_code_base.c. It allows an attacker to cause Denial of Service.
CVE-2021-32271 (severity: HIGH, weakness: CWE-787)
An issue was discovered in gpac through 20200801. A stack-buffer-overflow exists in the function DumpRawUIConfig located in odf_dump.c. It allows an attacker to cause code Execution.
CVE-2021-32272 (severity: HIGH, weakness: CWE-787)
An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin located in mp4read.c. It allows an attacker to cause Code Execution.
CVE-2021-32273 (severity: HIGH, weakness: CWE-787)
An issue was discovered in faad2 through 2.10.0. A stack-buffer-overflow exists in the function ftypin located in mp4read.c. It allows an attacker to cause Code Execution.
CVE-2021-32274 (severity: HIGH, weakness: CWE-787)
An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVE-2021-32275 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in faust through v2.30.5. A NULL pointer dereference exists in the function CosPrim::computeSigOutput() located in cosprim.hh. It allows an attacker to cause Denial of Service.
CVE-2021-32276 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
CVE-2021-32277 (severity: HIGH, weakness: CWE-787)
An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_analysis_32 located in sbr_qmf.c. It allows an attacker to cause code Execution.
CVE-2021-32278 (severity: HIGH, weakness: CWE-787)
An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function lt_prediction located in lt_predict.c. It allows an attacker to cause code Execution.
CVE-2021-32280 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in fig2dev before 3.2.8.. A NULL pointer dereference exists in the function compute_closed_spline() located in trans_spline.c. It allows an attacker to cause Denial of Service. The fixed version of fig2dev is 3.2.8.
CVE-2021-32281 (severity: HIGH, weakness: CWE-787)
An issue was discovered in gravity through 0.8.1. A heap-buffer-overflow exists in the function gnode_function_add_upvalue located in gravity_ast.c. It allows an attacker to cause code Execution.
CVE-2021-32282 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function ircode_add_check() located in gravity_ircode.c. It allows an attacker to cause Denial of Service.
CVE-2021-32283 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function gravity_string_to_value() located in gravity_value.c. It allows an attacker to cause Denial of Service.
CVE-2021-32284 (severity: HIGH, weakness: CWE-476)
An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function ircode_register_pop_context_protect() located in gravity_ircode.c. It allows an attacker to cause Denial of Service.
CVE-2021-32285 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function list_iterator_next() located in gravity_core.c. It allows an attacker to cause Denial of Service.
CVE-2021-32286 (severity: HIGH, weakness: CWE-787)
An issue was discovered in hcxtools through 6.1.6. A global-buffer-overflow exists in the function pcapngoptionwalk located in hcxpcapngtool.c. It allows an attacker to cause code Execution.
CVE-2021-32287 (severity: HIGH, weakness: CWE-787)
An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicWidth() located in hevcdecoderconfigrecord.cpp. It allows an attacker to cause code Execution.
CVE-2021-32288 (severity: HIGH, weakness: CWE-787)
An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicHeight() located in hevcdecoderconfigrecord.cpp. It allows an attacker to cause code Execution.
CVE-2021-32289 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in heif through through v3.6.2. A NULL pointer dereference exists in the function convertByteStreamToRBSP() located in nalutil.cpp. It allows an attacker to cause Denial of Service.
CVE-2021-3229 (severity: HIGH, weakness: NVD-CWE-Other)
Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.384_10177 and earlier versions allows an attacker to disrupt the use of device setup services via continuous login error.
CVE-2021-32292 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.
CVE-2021-32294 (severity: HIGH, weakness: CWE-787)
An issue was discovered in libgig through 20200507. A heap-buffer-overflow exists in the function RIFF::List::GetSubList located in RIFF.cpp. It allows an attacker to cause code Execution.
CVE-2021-32297 (severity: HIGH, weakness: CWE-787)
An issue was discovered in LIEF through 0.11.4. A heap-buffer-overflow exists in the function main located in pe_reader.c. It allows an attacker to cause code Execution.
CVE-2021-32298 (severity: HIGH, weakness: CWE-787)
An issue was discovered in libiff through 20190123. A global-buffer-overflow exists in the function IFF_errorId located in error.c. It allows an attacker to cause code Execution.
CVE-2021-32299 (severity: HIGH, weakness: CWE-787)
An issue was discovered in pbrt through 20200627. A stack-buffer-overflow exists in the function pbrt::ParamSet::ParamSet() located in paramset.h. It allows an attacker to cause code Execution.
CVE-2021-32302 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter.
CVE-2021-32305 (severity: CRITICAL, weakness: CWE-78)
WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.
CVE-2021-3236 (severity: MEDIUM, weakness: CWE-476)
vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method.
CVE-2021-3239 (severity: CRITICAL, weakness: CWE-89)
E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code on the hosting web server and gain a reverse shell.
CVE-2021-32399 (severity: HIGH, weakness: CWE-362)
net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.
CVE-2021-32402 (severity: HIGH, weakness: CWE-352)
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and modules.
CVE-2021-32403 (severity: HIGH, weakness: CWE-352)
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token protection and unsafe inputs and modules.
CVE-2021-32415 (severity: HIGH, weakness: NVD-CWE-Other)
EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in installers it creates.
CVE-2021-32419 (severity: MEDIUM, weakness: CWE-787)
An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt_mtm_load_song function in fmt/mtm.c.
CVE-2021-3242 (severity: CRITICAL, weakness: CWE-89)
DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.
CVE-2021-32420 (severity: HIGH, weakness: CWE-787)
dpic 2021.01.01 has a Heap-based Buffer Overflow in thestorestring function in dpic.y.
CVE-2021-32421 (severity: HIGH, weakness: CWE-416)
dpic 2021.01.01 has a Heap Use-After-Free in thedeletestringbox() function in dpic.y.
CVE-2021-32422 (severity: HIGH, weakness: CWE-120)
dpic 2021.01.01 has a Global buffer overflow in theyylex() function in main.c and reads out of the bound array.
CVE-2021-32424 (severity: HIGH, weakness: CWE-352)
In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. If an authenticated user were to interact with a malicious web page it could allow for a complete takeover of the router.
CVE-2021-32426 (severity: MEDIUM, weakness: CWE-79)
In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command.
CVE-2021-32428 (severity: CRITICAL, weakness: CWE-89)
SQL Injection vulnerability in viaviwebtech Android EBook App (Books App, PDF, ePub, Online Book Reading, Download Books) 10 via the author_id parameter to api.php.
CVE-2021-3243 (severity: MEDIUM, weakness: CWE-79)
Wfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability. An attacker in the same LAN can craft a packet with a malicious User-Agent header to inject a payload in its logs, where an attacker can take over the system by through its plugin-running function.
CVE-2021-32434 (severity: MEDIUM, weakness: CWE-125)
abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c.
CVE-2021-32435 (severity: MEDIUM, weakness: CWE-787)
Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.
CVE-2021-32436 (severity: MEDIUM, weakness: CWE-125)
An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.