yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-43188: In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.
Key phrases: access token protection
CVE-2021-43189: In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete.
Key phrases: access token protection
CVE-2021-4319: Use after free in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
Key phrases: perform arbitrary read, use after free
CVE-2021-43190: In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.
Key phrases: task hijacking
CVE-2021-43191: JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS.
CVE-2021-43192: In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.
Key phrases: ios url scheme hijacking
CVE-2021-43193: In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.
Key phrases: remote code execution
CVE-2021-43194: In JetBrains TeamCity before 2021.1.2, user enumeration was possible.
Key phrases: user enumeration
CVE-2021-43195: In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.
Key phrases: http security headers
CVE-2021-43196: In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.
Key phrases: information disclosure
CVE-2021-43197: In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.
Key phrases: xss
CVE-2021-43198: In JetBrains TeamCity before 2021.1.2, stored XSS is possible.
Key phrases: xss
CVE-2021-43199: In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.
Key phrases: permission checks
CVE-2021-4320: Use after free in Blink in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
Key phrases: perform arbitrary read, use after free, arbitrary read write
CVE-2021-43200: In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.
Key phrases: permission checks
CVE-2021-43201: In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.
CVE-2021-43202: In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.
Key phrases: x-frame-options header
CVE-2021-43203: In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.
Key phrases: nonce verification
CVE-2021-43204: A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and below allows attacker to cause a complete denial of service of its components via changes of directory access permissions.
Key phrases: cause a complete denial of service of its, directory access permissions
CVE-2021-43205: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries.
Key phrases: access the confighandler webserver via external binaries, cwe-200, exposure of sensitive information
CVE-2021-43206: A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's client username and IP via same origin HTTP requests triggering proxy-generated HTTP status codes pages.
Key phrases: retrieve a web proxy's client username and, sensitive information
CVE-2021-43207: Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-43226.
Key phrases: windows common log file system driver elevation of privilege
CVE-2021-43208: 3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-43209.
Key phrases: remote code execution
CVE-2021-43209: 3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-43208.
Key phrases: remote code execution
CVE-2021-4321: Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
Key phrases: bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed, bypass content security policy, Policy bypass, policy bypass
CVE-2021-43211: Windows 10 Update Assistant Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42297.
Key phrases: windows update assistant elevation of privilege
CVE-2021-43214: Web Media Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-43215: iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution
Key phrases: isns server memory corruption, remote code execution
CVE-2021-43216: Microsoft Local Security Authority Server (lsasrv) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-43217: Windows Encrypting File System (EFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-43219: DirectX Graphics Kernel File Denial of Service Vulnerability
Key phrases: directx graphics kernel file denial of service
CVE-2021-4322: Use after free in DevTools in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
Key phrases: execute arbitrary code, use after free, convince
CVE-2021-43220: Microsoft Edge for iOS Spoofing Vulnerability
Key phrases: spoofing
CVE-2021-43221: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-43222: Microsoft Message Queuing Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-43236.
Key phrases: microsoft message queuing information disclosure
CVE-2021-43223: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Key phrases: windows remote access connection manager elevation of privilege
CVE-2021-43224: Windows Common Log File System Driver Information Disclosure Vulnerability
Key phrases: driver information disclosure
CVE-2021-43225: Bot Framework SDK Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-43226: Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-43207.
Key phrases: windows common log file system driver elevation of privilege
CVE-2021-43227: Storage Spaces Controller Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-43235.
Key phrases: information disclosure
CVE-2021-43228: SymCrypt Denial of Service Vulnerability
Key phrases: denial of service
CVE-2021-43229: Windows NTFS Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-43230, CVE-2021-43231.
Key phrases: windows ntfs elevation of privilege
CVE-2021-4323: Insufficient validation of untrusted input in Extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to access local files via a crafted Chrome Extension. (Chromium security severity: Medium)
Key phrases: insufficient validation of untrusted input, convince
CVE-2021-43230: Windows NTFS Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-43229, CVE-2021-43231.
Key phrases: windows ntfs elevation of privilege
CVE-2021-43231: Windows NTFS Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-43229, CVE-2021-43230.
Key phrases: windows ntfs elevation of privilege
CVE-2021-43232: Windows Event Tracing Remote Code Execution Vulnerability
Key phrases: windows event tracing remote code execution
CVE-2021-43233: Remote Desktop Client Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-43234: Windows Fax Service Remote Code Execution Vulnerability
Key phrases: windows fax service remote code execution
CVE-2021-43235: Storage Spaces Controller Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-43227.
Key phrases: information disclosure
CVE-2021-43236: Microsoft Message Queuing Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-43222.
Key phrases: microsoft message queuing information disclosure
CVE-2021-43237: Windows Setup Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-43238: Windows Remote Access Elevation of Privilege Vulnerability
Key phrases: windows remote access elevation of privilege
CVE-2021-43239: Windows Recovery Environment Agent Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-4324: Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files via a malicious file. (Chromium security severity: Medium)
Key phrases: read arbitrary files, malicious file
CVE-2021-43240: NTFS Set Short Name Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-43242: Microsoft SharePoint Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-42320.
Key phrases: spoofing
CVE-2021-43243: VP9 Video Extensions Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-43244: Windows Kernel Information Disclosure Vulnerability
Key phrases: windows kernel information disclosure
CVE-2021-43245: Windows Digital TV Tuner Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-43246: Windows Hyper-V Denial of Service Vulnerability
Key phrases: denial of service
CVE-2021-43247: Windows TCP/IP Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-43248: Windows Digital Media Receiver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-4325: A vulnerability, which was classified as problematic, has been found in NHN TOAST UI Chart 4.1.4. This issue affects some unknown processing of the component Legend Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 4.2.0 is able to address this issue. The identifier of the patch is 1a3f455d17df379e11b501bb5ba1dd1bcc41d63e. It is recommended to upgrade the affected component. The identifier VDB-221501 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2021-43255: Microsoft Office Trust Center Spoofing Vulnerability
Key phrases: spoofing
CVE-2021-43256: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2021-43257: Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.
Key phrases: gain access, execute code or gain access to information when, lack of neutralization of formula elements
CVE-2021-43258: CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchInfo application. Once authenticated, a user can add names to their cart, and compose an email. Uploading an attachment for the email stores the attachment on the site in the /tmp_attach/ folder where it can be accessed with a GET request. There are no limitations on files that can be attached, allowing for malicious PHP code to be uploaded and interpreted by the server.
Key phrases: achieve remote code execution through insecure uploads, be uploaded and interpreted by the server
CVE-2021-4326: A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.
Key phrases: execute arbitrary shell commands, execute arbitrary shell commands via plugin install/, zowe cli
CVE-2021-43264: In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character.
Key phrases: bypass the intended access control, bypass the intended access control for HTML files, directory traversal
CVE-2021-43265: In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element.
Key phrases: xss
CVE-2021-43266: In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution
Key phrases: code execution, shell metacharacters
CVE-2021-43267: An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
Key phrases: exploit insufficient validation of user-supplied sizes
CVE-2021-43268: An issue was discovered in VxWorks 6.9 through 7. In the IKE component, a specifically crafted packet may lead to reading beyond the end of a buffer, or a double free.
Key phrases: reading beyond the end of a buffer, double free
CVE-2021-43269: In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config (PAC) file, leading to arbitrary code execution. This affects Incydr Basic, Advanced, and Gov F1; CrashPlan Cloud; and CrashPlan for Small Business. (Incydr Professional and Enterprise are unaffected.)
Key phrases: change a device’s proxy configuration to use, eval injection, arbitrary code execution
CVE-2021-4327: A vulnerability was found in SerenityOS. It has been rated as critical. Affected by this issue is the function initialize_typed_array_from_array_buffer in the library Userland/Libraries/LibJS/Runtime/TypedArray.cpp. The manipulation leads to integer overflow. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as f6c6047e49f1517778f5565681fb64750b14bf60. It is recommended to apply a patch to fix this issue. VDB-222074 is the identifier assigned to this vulnerability.
Key phrases: integer overflow
CVE-2021-43270: Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where encryption on port 465 was intended.
Key phrases: cleartext smtp
CVE-2021-43271: Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a (when configured to use local, RADIUS, or TACACS authentication) logs usernames and passwords if either is entered incorrectly. If a user enters an incorrect username and/or password when logging into the WebUI, these attempted credentials are included in an error message that is logged in the WebUI log file. A log entry does not appear if the username and password provided correctly match a valid set of credentials. This also does not happen if AppResponse is configured to use SAML authentication. The WebUI log file is included in subsequent diagnostic system dumps that are generated. (Only users with Full Control access to the System Configuration permission can generate system dumps. By default, only System Administrators have Full Control access to the System Configuration permission.)
CVE-2021-43272: An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process invalid or malicious DWF files instead of stopping upon an exception. An attacker can leverage this vulnerability to execute code in the context of the current process.
Key phrases: improper handling of exceptional conditions, execute code
CVE-2021-43273: An Out-of-bounds Read vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.11. Crafted data in a DGN file and lack of verification of input data can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Key phrases: out-of-bounds read, execute code
CVE-2021-43274: A Use After Free Vulnerability exists in the Open Design Alliance Drawings SDK before 2022.11. The specific flaw exists within the parsing of DWF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Key phrases: execute arbitrary code, use after free
CVE-2021-43275: A Use After Free vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.
Key phrases: use after free, execute code
CVE-2021-43276: An Out-of-bounds Read vulnerability exists in Open Design Alliance ODA Viewer before 2022.8. Crafted data in a DWF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process
Key phrases: execute arbitrary code, out-of-bounds read
CVE-2021-43277: An out-of-bounds read vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Key phrases: execute arbitrary code, out-of-bounds read, out of bounds read
CVE-2021-43278: An Out-of-bounds Read vulnerability exists in the OBJ file reading procedure in Open Design Alliance Drawings SDK before 2022.11. The lack of validating the input length can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Key phrases: out-of-bounds read, file read, execute code
CVE-2021-43279: An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2021-4328: A vulnerability has been found in ???CMS and classified as critical. Affected by this vulnerability is the function goods_detail of the file ApiController.class.php. The manipulation of the argument goods_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222223.
Key phrases: sql injection
CVE-2021-43280: A stack-based buffer overflow vulnerability exists in the DWF file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Key phrases: stack-based buffer overflow, stack based buffer overflow, execute code
CVE-2021-43281: MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.
Key phrases: add settings of supported type "php", remote code injection
CVE-2021-43282: An issue was discovered on Victure WR1200 devices through 1.0.3. The default Wi-Fi WPA2 key is advertised to anyone within Wi-Fi range through the router's MAC address. The device default Wi-Fi password corresponds to the last 4 bytes of the MAC address of its 2.4 GHz network interface controller (NIC). An attacker within scanning range of the Wi-Fi network can thus scan for Wi-Fi networks to obtain the default key.
Key phrases: obtain the default key.
CVE-2021-43283: An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device, allowing an attacker with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges. This occurs in the ping and traceroute features. An attacker would thus be able to use this vulnerability to open a reverse shell on the device with root privileges.
Key phrases: inject arbitrary shell commands, inject arbitrary shell commands to be executed by, command injection, root privilege
CVE-2021-43284: An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an attacker to gain control of the device through SSH (regardless of whether the admin password was changed on the web interface).
Key phrases: gain control
CVE-2021-43286: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection" feature to execute arbitrary code.
Key phrases: execute arbitrary code, command-line injection
CVE-2021-43287: An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers.
CVE-2021-43288: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report.
Key phrases: failed job report
CVE-2021-43289: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename.
CVE-2021-4329: A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227. It is recommended to upgrade the affected component. VDB-222266 is the identifier assigned to this vulnerability.
Key phrases: command injection
CVE-2021-43290: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control.
CVE-2021-43293: Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF).
Key phrases: potentially perform network enumeration via Server Side Request, server side request forgery (ssrf)
CVE-2021-43294: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
Key phrases: reflected xss
CVE-2021-43295: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
Key phrases: reflected xss
CVE-2021-43296: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
Key phrases: ssrf
CVE-2021-43297: A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Key phrases: deserialization, code execution, remote command execution
CVE-2021-43298: The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.
Key phrases: brute-force
CVE-2021-43299: Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
Key phrases: stack overflow, buffer overflow
CVE-2021-4330: The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for attackers with contributor-lever permissions and above to upload arbitrary files and potentially gain remote code execution in versions up to and including 1.0.13 of Template Kit – Import and versions up to and including 2.0.10 of Envato Elements & Download.
Key phrases: upload arbitrary files, gain remote code execution, arbitrary file uploads
CVE-2021-43300: Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
Key phrases: stack overflow, buffer overflow
CVE-2021-43301: Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
Key phrases: stack overflow, buffer overflow
CVE-2021-43302: Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.
Key phrases: read out-of-bounds, out-of-bounds read, out of bounds read
CVE-2021-43303: Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied
Key phrases: buffer overflow
CVE-2021-43304: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), dont exceed the destination buffers limits.
Key phrases: heap buffer overflow
CVE-2021-43305: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), dont exceed the destination buffers limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call.
Key phrases: heap buffer overflow
CVE-2021-43306: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
Key phrases: supply arbitrary input,  ReDoS (Regular Expression Denial of Service), redos
CVE-2021-43307: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Key phrases: supply arbitrary input,  ReDoS (Regular Expression Denial of Service), exponential redos
CVE-2021-43308: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
Key phrases: supply arbitrary input,  ReDoS (Regular Expression Denial of Service), redos
CVE-2021-43309: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method
Key phrases: supply arbitrary input,  ReDoS (Regular Expression Denial of Service), redos
CVE-2021-4331: The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin adds a registration form to the Elementor page builders functionality. As part of the registration form, users can choose which role to set as the default for users upon registration. This field is not hidden for lower-level users so any user with access to the Elementor page builder, such as contributors, can set the default role to administrator. Since contributors can not publish posts, only author+ users can elevate privileges without interaction via a site administrator (to approve a post).
Key phrases: privilege escalation, elevate privileges
CVE-2021-43310: A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remote code execution.
Key phrases: craft a request to the agent that resets, remote code execution
CVE-2021-43311: A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5382.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2021-43312: A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf64::invert_pt_dynamic at p_lx_elf.cpp:5239.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2021-43313: A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf32::invert_pt_dynamic at p_lx_elf.cpp:1688.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2021-43314: A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5368
Key phrases: heap-based buffer overflows, heap based buffer overflow
CVE-2021-43315: A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5349
Key phrases: heap-based buffer overflows, heap based buffer overflow
CVE-2021-43316: A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le64().
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2021-43317: A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf64::elf_lookup() at p_lx_elf.cpp:5404
Key phrases: heap-based buffer overflows, heap based buffer overflow
CVE-2021-43319: Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.
Key phrases: command injection
CVE-2021-4332: The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.
Key phrases: read arbitrary files, arbitrary file reads
CVE-2021-43323: An issue was discovered in UsbCoreDxe in Insyde InsydeH2O with kernel 5.5 before 05.51.45, 5.4 before 05.43.45, 5.3 before 05.35.45, 5.2 before 05.26.45, 5.1 before 05.16.45, and 5.0 before 05.08.45. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.
Key phrases: hijack execution flow of code running in System, smm callout, escalating privileges, escalate privilege
CVE-2021-43324: LibreNMS through 21.10.2 allows XSS via a widget title.
Key phrases: XSS via a widget title, xss
CVE-2021-43325: Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression.
Key phrases: regression
CVE-2021-43326: Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.
CVE-2021-43327: An issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can extract the security ID key from the device. Then, the protected firmware can be extracted.
Key phrases: vcc glitch
CVE-2021-43329: A SQL injection vulnerability in license_update.php in Mumara Classic through 2.93 allows a remote unauthenticated attacker to execute arbitrary SQL commands via the license parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the license parameter, sql injection
CVE-2021-4333: The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: deactivate arbitrary plugins, cross-site request forgery
CVE-2021-43331: In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
Key phrases: execute arbitrary JavaScript, xss
CVE-2021-43332: In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
Key phrases: csrf token, offline brute-force
CVE-2021-43333: The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings.
Key phrases: configuration changes, disclosure of configuration settings
CVE-2021-43334: BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.
Key phrases: XSS via the Group Name or Group Description, xss
CVE-2021-43336: An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF and DWG files. Crafted data in a DXF or DWG file (an invalid number of properties) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Key phrases: out-of-bounds write, execute code
CVE-2021-43337: SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options, the access control rules in SlurmDBD may permit users to request job scripts and environment files to which they should not have access.
Key phrases: incorrect access control
CVE-2021-43339: In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality. For example, a new admin user could be created.
CVE-2021-4334: The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_options function in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify site options, including setting the default role to administrator which can allow privilege escalation.
Key phrases: privilege escalation, unauthorized modification of site options, missing capability check
CVE-2021-4335: The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account.
Key phrases: retrieving arbitrary order information, unauthorized access to data, missing capability check, sensitive information
CVE-2021-43350: An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.
Key phrases: unsanitized content
CVE-2021-43353: The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.
Key phrases: inject arbitrary web scripts, cross-site request forgery
CVE-2021-43355: Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the client-side control and login with service privileges.
Key phrases: bypass the client-side checks, intentionally bypass, be validated on the client side without authentication
CVE-2021-43358: Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files.
Key phrases: perform path traversal attacks without authentication
CVE-2021-43359: Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt services.
Key phrases: execute arbitrary code, access account management page after being authenticated as, access control, interrupt services, broken access control, privilege escalation
CVE-2021-4336: A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file modules/reports/models/scheduled_reports.php. The manipulation leads to sql injection. Upgrading to version 2021.11.30 is able to address this issue. The name of the patch is 6da9080faec9bca1ca5342386c0421dca0a6c0cc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230084.
Key phrases: sql injection
CVE-2021-43360: Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access privilege, to execute arbitrary code and control the system or interrupt services.
Key phrases: execute arbitrary code, execute arbitrary code and control the system or, input object validation, interrupt services
CVE-2021-43361: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS: from unspecified before 1.1.
Key phrases: SQL Injection, sql command, sql injection, unspecified
CVE-2021-43362: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS: from unspecified before 1.1.
Key phrases: SQL Injection, sql command, sql injection, unspecified
CVE-2021-4337: Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
Key phrases: bypass due to a missing capability check, authorization bypass
CVE-2021-4338: The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in versions up to, and including, 3.0.7. This makes it possible for authenticated attackers to view, create and edit redirections.
Key phrases: bypass due to missing capability checks, authorization bypass
CVE-2021-43388: Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag (in the manifest) is False.
Key phrases: cleartext, sensitive information
CVE-2021-43389: An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c.
Key phrases: array-index-out-of-bounds flaw
CVE-2021-4339: The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to retrieve the list of all users and their email address in the database.
Key phrases: bypass due to a missing capability check, authorization bypass
CVE-2021-43390: An Out-of-Bounds Write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation of input data can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Key phrases: out-of-bounds write, execute code
CVE-2021-43391: An Out-of-Bounds Read vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file (an invalid dash counter in line types) can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Key phrases: out-of-bounds read, execute code
CVE-2021-43392: STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.
Key phrases: obtain information, obtain information on cryptographic secrets, exploitable
CVE-2021-43393: STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.
Key phrases: abuse signature verification, exploitable
CVE-2021-43394: Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation of an Authentication Algorithm. An LDAP password is not properly validated.
Key phrases: incorrect implementation of an authentication algorithm
CVE-2021-43395: An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 2021.04, and SmartOS 20210923. A local unprivileged user can cause a deadlock and kernel panic via crafted rename and rmdir calls on tmpfs filesystems. Oracle Solaris 10 and 11 is also affected.
CVE-2021-43396: In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\\\\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
Key phrases: integrity
CVE-2021-43397: LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.
Key phrases: elevate their privileges from Admin (or User, liquidfiles, elevate privileges