yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-3449: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
Key phrases: null pointer dereference, denial of service, crash
CVE-2021-34490: Windows TCP/IP Driver Denial of Service Vulnerability This CVE ID is unique from CVE-2021-31183, CVE-2021-33772.
Key phrases: denial of service
CVE-2021-34491: Win32k Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-34492: Windows Certificate Spoofing Vulnerability
Key phrases: windows certificate spoofing
CVE-2021-34493: Windows Partition Management Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-34494: Windows DNS Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-33746, CVE-2021-33754, CVE-2021-33780, CVE-2021-34525.
Key phrases: remote code execution
CVE-2021-34496: Windows GDI Information Disclosure Vulnerability
Key phrases: windows gdi information disclosure
CVE-2021-34497: Windows MSHTML Platform Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34447.
Key phrases: windows mshtml platform remote code execution
CVE-2021-34498: Windows GDI Elevation of Privilege Vulnerability
Key phrases: windows gdi elevation of privilege
CVE-2021-34499: Windows DNS Server Denial of Service Vulnerability This CVE ID is unique from CVE-2021-33745, CVE-2021-34442, CVE-2021-34444.
Key phrases: denial of service
CVE-2021-3450: The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).
CVE-2021-34500: Windows Kernel Memory Information Disclosure Vulnerability
Key phrases: windows kernel memory information disclosure
CVE-2021-34501: Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34518.
Key phrases: remote code execution
CVE-2021-34503: Microsoft Windows Media Foundation Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34439, CVE-2021-34441.
Key phrases: microsoft windows media foundation remote code execution
CVE-2021-34504: Windows Address Book Remote Code Execution Vulnerability
Key phrases: windows address book remote code execution
CVE-2021-34506: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2021-34507: Windows Remote Assistance Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-34508: Windows Kernel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34458.
Key phrases: windows kernel remote code execution
CVE-2021-34509: Storage Spaces Controller Information Disclosure Vulnerability
Key phrases: controller information disclosure
CVE-2021-3451: A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to be written to non-standard locations.
Key phrases: be written to non-standard locations, denial of service, file write
CVE-2021-34510: Storage Spaces Controller Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33751, CVE-2021-34460, CVE-2021-34512, CVE-2021-34513.
Key phrases: elevation of privilege
CVE-2021-34511: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-34512: Storage Spaces Controller Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33751, CVE-2021-34460, CVE-2021-34510, CVE-2021-34513.
Key phrases: elevation of privilege
CVE-2021-34513: Storage Spaces Controller Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33751, CVE-2021-34460, CVE-2021-34510, CVE-2021-34512.
Key phrases: elevation of privilege
CVE-2021-34514: Windows Kernel Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31979, CVE-2021-33771.
Key phrases: windows kernel elevation of privilege
CVE-2021-34516: Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-34449.
Key phrases: elevation of privilege
CVE-2021-34517: Microsoft SharePoint Server Spoofing Vulnerability
Key phrases: microsoft sharepoint server spoofing
CVE-2021-34518: Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34501.
Key phrases: remote code execution
CVE-2021-34519: Microsoft SharePoint Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-3452: A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Key phrases: execute arbitrary code, system shutdown smi callback function
CVE-2021-34520: Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34467, CVE-2021-34468.
Key phrases: microsoft sharepoint server remote code execution
CVE-2021-34521: Raw Image Extension Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-34522: Microsoft Defender Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34464.
Key phrases: microsoft defender remote code execution
CVE-2021-34523: Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34470.
Key phrases: elevation of privilege
CVE-2021-34524: Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-34525: Windows DNS Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-33746, CVE-2021-33754, CVE-2021-33780, CVE-2021-34494.
Key phrases: remote code execution
CVE-2021-34527: Windows Print Spooler Remote Code Execution Vulnerability
Key phrases: windows print spooler remote code execution
CVE-2021-34528: Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34529.
Key phrases: remote code execution
CVE-2021-34529: Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34528.
Key phrases: visual studio code remote code execution
CVE-2021-3453: Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.
Key phrases: write to the SPI flash storage
CVE-2021-34530: Windows Graphics Component Remote Code Execution Vulnerability
Key phrases: windows graphics component remote code execution
CVE-2021-34532: ASP.NET Core and Visual Studio Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-34533: Windows Graphics Component Font Parsing Remote Code Execution Vulnerability
Key phrases: windows graphics component font parsing remote code execution
CVE-2021-34534: Windows MSHTML Platform Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-34535: Remote Desktop Client Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-34536: Storage Spaces Controller Elevation of Privilege Vulnerability
Key phrases: storage spaces controller elevation of privilege
CVE-2021-34537: Windows Bluetooth Driver Elevation of Privilege Vulnerability
Key phrases: windows bluetooth driver elevation of privilege
CVE-2021-34538: Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.
CVE-2021-34539: An issue was discovered in CubeCoders AMP before 2.1.1.8. A lack of validation of the Java Version setting means that an unintended executable path can be set. The result is that high-privileged users can trigger code execution.
Key phrases: unintended executable path, code execution
CVE-2021-3454: Truncated L2CAP K-frame causes assertion failure. Zephyr versions >= 2.4.0, >= v.2.50 contain Improper Handling of Length Parameter Inconsistency (CWE-130), Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx88-6c29-vrp3
Key phrases: improper handling of length parameter inconsistency, reachable assertion
CVE-2021-34540: Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.
Key phrases: XSS via the username column of the bwRoot.asp, xss
CVE-2021-34543: The web administration server in Solar-Log 500 before 2.8.2 Build 52 does not require authentication, which allows remote attackers to gain administrative privileges by connecting to the server. As a result, the attacker can modify configuration files and change the system status.
Key phrases: gain administrative privileges, gain administrative privileges by connecting to the server, authentication, system status
CVE-2021-34544: An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may allow sensitive information to be read by someone with access to the device.
Key phrases: be read by someone with access to the, cleartext passwords, sensitive information
CVE-2021-34546: An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to file" feature. To accomplish this, the attacker can navigate to cmd.exe.
Key phrases: execute arbitrary commands, pre-logon profile switch button
CVE-2021-34547: PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation.
Key phrases: /editsettings CSRF for user account creation, csrf
CVE-2021-34548: An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.
Key phrases: bypass the intended access control
CVE-2021-34549: An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.
Key phrases: attacker-chosen circuit id, algorithm inefficiency
CVE-2021-3455: Disconnecting L2CAP channel right after invalid ATT request leads freeze. Zephyr versions >= 2.4.0, >= 2.5.0 contain Use After Free (CWE-416). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7g38-3x9v-v7vp
Key phrases: freeze, use after free
CVE-2021-34550: An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor
Key phrases: out-of-bounds memory access, client crash, out of bounds memory
CVE-2021-34551: PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
Key phrases: remote code execution if lang_path is untrusted data
CVE-2021-34552: Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
Key phrases: pass controlled parameters directly into a convert function, buffer overflow
CVE-2021-34553: Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.
Key phrases: get a list of blob files and read, file read
CVE-2021-34555: OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a multi-value From header field.
Key phrases: denial of service (NULL pointer dereference and application crash), cause a denial of service (NULL pointer, null pointer dereference, multi-value from header field
CVE-2021-34556: In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.
Key phrases: Bypass side-channel attack because the protection, Speculative Store Bypass, obtain sensitive information, speculative store bypass side-channel, uninitialized memory locations
CVE-2021-34557: XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
Key phrases: bypass the standard screen, bypass the standard screen lock authentication mechanism by, buffer overflow, crashing, physically disconnect
CVE-2021-34558: The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
Key phrases: cause a TLS client to panic
CVE-2021-34559: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.
Key phrases: rewrite links and URLs in cached pages to, arbitrary strings
CVE-2021-3456: An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.
Key phrases: execute actions that should be limited to the, access and delete limited resources and also causes, improper authorization handling flaw, denial of service, system availability, integrity
CVE-2021-34560: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.
Key phrases: control
CVE-2021-34561: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's browser.
Key phrases: bypass any IP or firewall based access restrictions, dns rebinding
CVE-2021-34562: In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response.
Key phrases: inject arbitrary JavaScript, arbitrary javascript
CVE-2021-34563: In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.
Key phrases: be read or set by client-side
CVE-2021-34564: Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9.
Key phrases: cookie-stealing
CVE-2021-34565: In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.
Key phrases: hard-coded credentials, hard coded credentials
CVE-2021-34566: In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iocheck process and write memory resulting in loss of integrity and DoS.
Key phrases: loss of integrity, dos, crash
CVE-2021-34567: In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service and an limited out-of-bounds read.
Key phrases: denial of service, out-of-bounds read, out of bounds read
CVE-2021-34568: In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service.
Key phrases: denial of service
CVE-2021-34569: In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory.
Key phrases: os commands, crash
CVE-2021-3457: An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.
Key phrases: execute actions that should be limited to the, access and delete limited resources and also causes, improper authorization handling flaw, denial of service, system availability, integrity
CVE-2021-34570: Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests.
Key phrases: dos
CVE-2021-34571: Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn all information that is available in Enbra EWM.
Key phrases: hard-coded credentials, hard coded credentials
CVE-2021-34572: Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data.
Key phrases: replay
CVE-2021-34573: In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events.
CVE-2021-34574: In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server.
CVE-2021-34575: In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the server sends.
CVE-2021-34576: In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists. This may give sensitive information (water consumption without distinct values) to third parties.
Key phrases: information exposure, sensitive information
CVE-2021-34577: In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device.
Key phrases: wireless m-bus mode, hardcoded shared key
CVE-2021-34578: This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07.
Key phrases: the WBM to read and write settings-
CVE-2021-34579: In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles (“ATV profiles”). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections.
Key phrases: network access, sensitive information
CVE-2021-3458: The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified.
Key phrases: be modified, authentication
CVE-2021-34580: In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.
CVE-2021-34581: Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthenticated attacker to cause DoS on the device.
Key phrases: cause DoS on the device, missing release of resource, effective lifetime, dos
CVE-2021-34582: In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated certificate file.
Key phrases: html code (xss)
CVE-2021-34583: Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
Key phrases: heap-based buffer overflow, denial-of- service condition, crash, heap based buffer overflow
CVE-2021-34584: Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
Key phrases: heap memory, denial-of- service condition, crash
CVE-2021-34585: In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation.
Key phrases: pointer dereference, invalid address, denial of service situation
CVE-2021-34586: In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.
Key phrases: null pointer dereference, denial-of-service condition, denial of service
CVE-2021-34587: In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a stack variable.
Key phrases: long url, webserver crash
CVE-2021-34588: In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot .
Key phrases: unprotected data export, reboot
CVE-2021-34589: In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface.
Key phrases: rfid leak
CVE-2021-3459: A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access and/or arbitrary privileged commands to be executed on the adapter.
Key phrases: be executed on the adapter, privilege escalation
CVE-2021-34590: In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed.
Key phrases: cross-site scripting
CVE-2021-34591: In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.
Key phrases: local privilege escalation, root access
CVE-2021-34592: In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.
Key phrases: command injection
CVE-2021-34593: In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
Key phrases: denial-of-service conditions, memory, denial of service, memory leak
CVE-2021-34594: TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system.
Key phrases: create or delete any files on the system, relative path traversal
CVE-2021-34595: A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
Key phrases: invalid offsets, out-of-bounds read or write access, denial-of-service condition, local memory overwrite, out of bounds read, denial of service
CVE-2021-34596: A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
Key phrases: uninitialized pointer, denial-of-service condition, denial of service
CVE-2021-34597: Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory.
Key phrases: unpack arbitrary files, unpack arbitrary files outside of the selected project, improper input validation
CVE-2021-34598: In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active
Key phrases: impaired, memory release
CVE-2021-34599: Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.
Key phrases: man-in-the-middle, man in the middle
CVE-2021-3460: The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker.
Key phrases: communication channel
CVE-2021-34600: Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.
Key phrases: weak seed, predictable aes keys, total loss of trustworthiness
CVE-2021-34601: In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.
Key phrases: gain administrative access, hardcoded credentials, hardcoded ssh credentials
CVE-2021-34602: In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.
Key phrases: command injection, root privilege
CVE-2021-34605: A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure and denial of service of the system running the XINJE XD/E Series PLC Program Tool.
Key phrases: zip slip, remote code execution, information disclosure, denial of service, arbitrary file, arbitrary file write
CVE-2021-34606: A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and sufficient file-write privileges. If exploited, the attacker could place a malicious DLL file on the system, that when running XINJE XD/E Series PLC Program Tool will allow the attacker to execute arbitrary code with the privileges of another user's account.
Key phrases: execute arbitrary code, load a malicious DLL, execute arbitrary code with the privileges of another, file write
CVE-2021-34609: A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Key phrases: sql injection
CVE-2021-3461: A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].
CVE-2021-34610: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Key phrases: remote arbitrary command execution, arbitrary commands
CVE-2021-34611: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Key phrases: remote arbitrary command execution, arbitrary commands
CVE-2021-34612: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Key phrases: remote arbitrary command execution, arbitrary commands
CVE-2021-34613: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Key phrases: remote arbitrary command execution, arbitrary commands
CVE-2021-34614: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Key phrases: remote arbitrary command execution, arbitrary commands
CVE-2021-34615: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Key phrases: remote arbitrary command execution, arbitrary commands
CVE-2021-34616: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Key phrases: remote arbitrary command execution, arbitrary commands
CVE-2021-34617: A remote cross-site scripting (XSS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.13 and below; Aruba Instant 6.5.x: 6.5.4.13 and below; Aruba Instant 8.3.x: 8.3.0.7 and below; Aruba Instant 8.4.x: 8.4.0.5 and below; Aruba Instant 8.5.x: 8.5.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
Key phrases: remote cross-site scripting (xss)
CVE-2021-34618: A remote denial of service (DoS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.4.x: All versions; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
Key phrases: denial of service (DoS), remote denial of service (dos)
CVE-2021-34619: The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocommerce-stock-manager/trunk/admin/views/import-export.php file.
Key phrases: cross-site request forgery, arbitrary file upload
CVE-2021-3462: A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the driver's device object.
Key phrases: the driver's device object, privilege escalation, unauthorized access
CVE-2021-34620: The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
Key phrases: cross-site request forgery, cross-site scripting, privilege escalation
CVE-2021-34621: A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
CVE-2021-34622: A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .
Key phrases: escalate privilege
CVE-2021-34623: A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Key phrases: upload arbitrary files
CVE-2021-34624: A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Key phrases: upload arbitrary files
CVE-2021-34625: A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior.
Key phrases: inject arbitrary web scripts
CVE-2021-34626: A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Key phrases: delete custom extensions added by administrators, versions and prior
CVE-2021-34627: A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Key phrases: view custom extensions added by administrators, versions and prior
CVE-2021-34628: The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7.
Key phrases: inject arbitrary web scripts, cross-site request forgery
CVE-2021-34629: The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/lib/class-sendgrid-statistics.php file which allows authenticated users to export statistic for a WordPress multi-site main site, in versions up to and including 1.11.8.
Key phrases: bypass via the get_ajax_statistics function found in the ~/lib, authorization bypass, export statistic for a WordPress multi-site
CVE-2021-3463: A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause systems to experience a blue screen error.
Key phrases: null pointer dereference, blue screen error
CVE-2021-34630: In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.
Key phrases: reflected xss
CVE-2021-34631: The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18.
Key phrases: inject arbitrary web scripts, cross-site request forgery
CVE-2021-34632: The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1.
Key phrases: inject arbitrary web scripts, cross-site request forgery
CVE-2021-34633: The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feeder.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.1.
Key phrases: inject arbitrary web scripts, cross-site request forgery
CVE-2021-34634: The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23.
Key phrases: inject arbitrary web scripts, cross-site request forgery
CVE-2021-34635: The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2021-34636: The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.7.
Key phrases: inject arbitrary web scripts, cross-site request forgery
CVE-2021-34637: The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.5.
Key phrases: inject arbitrary web scripts, cross-site request forgery
CVE-2021-34638: Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Key phrases: obtain sensitive configuration file information, perform XSS attacks, authenticated directory traversal, xss
CVE-2021-34639: Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Key phrases: upload files with a double extension
CVE-2021-3464: A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow privilege escalation.
Key phrases: privilege escalation, dll search path
CVE-2021-34640: The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2021-34641: The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.
Key phrases: inject arbitrary web scripts, stored cross-site-scripting
CVE-2021-34642: The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2021-34643: The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2021-34644: The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/multiplayergames.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.7.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2021-34645: The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0.
Key phrases: inject arbitrary web scripts, cross-site request forgery
CVE-2021-34646: Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.
Key phrases: bypass via the process_email_verification, authentication bypass, impersonate users and trigger an email address verification, random token generation weakness
CVE-2021-34647: The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.
Key phrases: export all Ninja Forms submissions data via the, sensitive information disclosure
CVE-2021-34648: The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.
Key phrases: send arbitrary emails, send arbitrary emails from the affected server via, arbitrary email sending
CVE-2021-34649: The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `dark` parameter in the ~/titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2021-34650: The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting
CVE-2021-34651: The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Key phrases: inject arbitrary web scripts, reflected cross-site scripting