yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-45998: D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted HNAP1 POST, command injection
CVE-2021-46005: Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter.
Key phrases: cross site scripting (xss)
CVE-2021-46006: In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.
CVE-2021-46007: totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks.
Key phrases: os command injection
CVE-2021-46008: In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, can easily telnet into the target with root shell if the telnet is function turned on.
Key phrases: hard-coded telnet password, root shell
CVE-2021-46009: In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.
Key phrases: admin configurations, cookies
CVE-2021-46010: Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations.
Key phrases: insufficiently random values, malicious operations, hijack
CVE-2021-46013: An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "<?php system($_GET["cmd"]); ?>" gets uploaded it is saved into /uploads/exam_question/ directory, and is accessible by all users.
Key phrases: file upload, remote code execution, unrestricted file upload
CVE-2021-46019: An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
Key phrases: untrusted pointer dereference, segmentation fault, application crash
CVE-2021-46020: An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
Key phrases: untrusted pointer dereference, segmentation fault, application crash
CVE-2021-46021: An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
Key phrases: use-after-free, segmentation fault, application crash
CVE-2021-46022: An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
Key phrases: use-after-free, segmentation fault, application crash
CVE-2021-46023: An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application crash.
Key phrases: untrusted pointer dereference, segmentation fault, application crash
CVE-2021-46024: Projectworlds online-shopping-webvsite-in-php 1.0 suffers from a SQL Injection vulnerability via the "id" parameter in cart_add.php, No login is required.
Key phrases: sql injection
CVE-2021-46025: A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the background.
Key phrases: cross site scripting (xss)
CVE-2021-46026: mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management.
Key phrases: cross site scripting (xss)
CVE-2021-46027: mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, a blog tag will be added
Key phrases: csrf, csrf load
CVE-2021-46028: In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted.
Key phrases: csrf, csrf load, deleted
CVE-2021-46030: There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module.
Key phrases: cross site scripting attack (xss)
CVE-2021-46033: In ForestBlog, as of 2021-12-28, File upload can bypass verification.
Key phrases: bypass verification, file upload
CVE-2021-46034: A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box.
Key phrases: xss
CVE-2021-46036: An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, arbitrary file upload
CVE-2021-46037: MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
Key phrases: arbitrary file deletion
CVE-2021-46038: A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (context-dependent).
Key phrases: Denial of Service (context-dependent), pointer dereference, denial of service
CVE-2021-46039: A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the shift_chunk_offsets.part function, which causes a Denial of Service (context-dependent).
Key phrases: Denial of Service (context-dependent), pointer dereference vulnerabilty, denial of service
CVE-2021-46040: A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the finplace_shift_moov_meta_offsets function, which causes a Denial of Servie (context-dependent).
Key phrases: pointer dereference vulnerabilty, denial of servie
CVE-2021-46041: A Segmentation Fault Vulnerability exists in GPAC 1.0.1 via the co64_box_new function, which causes a Denial of Service.
Key phrases: segmentation fault, denial of service
CVE-2021-46042: A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the _fseeko function, which causes a Denial of Service.
Key phrases: pointer dereference, denial of service
CVE-2021-46043: A Pointer Dereference Vulnerability exits in GPAC 1.0.1 in the gf_list_count function, which causes a Denial of Service.
Key phrases: pointer dereference, denial of service
CVE-2021-46044: A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1via ShiftMetaOffset.isra, which causes a Denial of Service (context-dependent).
Key phrases: Denial of Service (context-dependent), pointer dereference vulnerabilty, denial of service
CVE-2021-46045: GPAC 1.0.1 is affected by: Abort failed. The impact is: cause a denial of service (context-dependent).
Key phrases: denial of service (context-dependent), abort failed
CVE-2021-46046: A Pointer Derefernce Vulnerbility exists GPAC 1.0.1 the gf_isom_box_size function, which could cause a Denial of Service (context-dependent).
Key phrases: Denial of Service (context-dependent), pointer derefernce vulnerbility, denial of service
CVE-2021-46047: A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_hinter_finalize function.
Key phrases: pointer dereference
CVE-2021-46048: A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.
Key phrases: denial of service
CVE-2021-46049: A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_fileio_check function, which could cause a Denial of Service.
Key phrases: pointer dereference, denial of service
CVE-2021-46050: A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.
Key phrases: stack overflow
CVE-2021-46051: A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the Media_IsSelfContained function, which could cause a Denial of Service. .
Key phrases: pointer dereference, denial of service
CVE-2021-46052: A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.
Key phrases: denial of service
CVE-2021-46053: A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL.
Key phrases: denial of service
CVE-2021-46054: A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
Key phrases: denial of service
CVE-2021-46055: A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
Key phrases: denial of service
CVE-2021-46061: An SQL Injection vulnerability exists in Sourcecodester Computer and Mobile Repair Shop Management system (RSMS) 1.0 via the code parameter in /rsms/ node app.
Key phrases: sql injection
CVE-2021-46062: MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
Key phrases: arbitrary file deletion
CVE-2021-46063: MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.
Key phrases: server side template injection (ssti)
CVE-2021-46064: IrfanView 4.59 is vulnerable to buffer overflow via the function at address 0x413c70 (in 32bit version of the binary). The vulnerability triggers when the user opens malicious .tiff image.
Key phrases: buffer overflow
CVE-2021-46065: A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.
Key phrases: inject arbitrary JavaScript code, cross-site scripting (xss)
CVE-2021-46067: In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.
Key phrases: cookies, full account takeover, steal cookie
CVE-2021-46068: A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.
Key phrases: stored cross site scripting (xss)
CVE-2021-46069: A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.
Key phrases: stored cross site scripting (xss)
CVE-2021-46070: A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel.
Key phrases: stored cross site scripting (xss)
CVE-2021-46071: A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.
Key phrases: stored cross site scripting (xss)
CVE-2021-46072: A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.
Key phrases: stored cross site scripting (xss)
CVE-2021-46073: A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section in login panel.
Key phrases: stored cross site scripting (xss)
CVE-2021-46074: A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Settings Section in login panel.
Key phrases: stored cross site scripting (xss)
CVE-2021-46075: A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and perform CRUD Operations.
Key phrases: privilege escalation
CVE-2021-46076: Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. An attacker can upload a malicious php file in multiple endpoints it leading to Code Execution.
Key phrases: file upload, code execution
CVE-2021-46078: An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to a Stored Cross-Site Scripting vulnerability.
Key phrases: unrestricted file upload, stored cross-site scripting
CVE-2021-46079: An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection.
Key phrases: unrestricted file upload, html injection
CVE-2021-46080: A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Scripting Vulnerability.
Key phrases: cross site request forgery (csrf), stored cross site scripting
CVE-2021-46082: Moxa TN-5900 v3.1 series routers, MGate 5109 v2.2 series protocol gateways, and MGate 5101-PBM-MN v2.1 series protocol gateways were discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via crafted packets.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), memory leak, denial of service (dos)
CVE-2021-46083: uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code.
Key phrases: cross site scripting (xss)
CVE-2021-46084: uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box.
Key phrases: cross site scripting (xss)
CVE-2021-46085: OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority.
Key phrases: insecure permissions, delete
CVE-2021-46086: xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnerability in the functional method of submitting examination papers. An attacker can use burpuite to modify parameters in the packet to destroy real data.
Key phrases: insecure permissions, destroy real data
CVE-2021-46087: In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code.
Key phrases: storage xss, system security
CVE-2021-46088: Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.
Key phrases: remote code execution (rce)
CVE-2021-46089: In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.
Key phrases: sql injection, root privileges
CVE-2021-46093: eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php.
Key phrases: insecure permissions
CVE-2021-46097: Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log
Key phrases: remote code execution
CVE-2021-46101: In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.
CVE-2021-46102: From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via "addr = (sym.st_value + refd_pa) as u64";
Key phrases: integer overflow
CVE-2021-46104: An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server.
Key phrases: read arbitrary file information, directory traversal
CVE-2021-46107: Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features.
Key phrases: read any documents via the download features, server side request forgery (ssrf)
CVE-2021-46108: D-Link DSL-2730E CT-20131125 devices allow XSS via the username parameter to the password page in the maintenance configuration.
Key phrases: the password page in the maintenance configuration, xss
CVE-2021-46109: Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack.
Key phrases: invalid input sanitizing, cross site scripting (xss), user session hijack
CVE-2021-46110: Online Shopping Portal v3.1 was discovered to contain multiple time-based SQL injection vulnerabilities via the email and contactno parameters.
Key phrases: time-based sql injection
CVE-2021-46113: In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service.
Key phrases: remote code execution, file upload
CVE-2021-46114: jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
Key phrases: rce
CVE-2021-46115: jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code.
Key phrases: rce
CVE-2021-46116: jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code.
Key phrases: remote code execution
CVE-2021-46117: jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
Key phrases: remote code execution
CVE-2021-46118: jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
Key phrases: remote code execution
CVE-2021-46122: Tp-Link TL-WR840N (EU) v6.20 Firmware (0.9.1 4.17 v0001.0 Build 201124 Rel.64328n) is vulnerable to Buffer Overflow via the Password reset feature.
Key phrases: buffer overflow
CVE-2021-46141: An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.
Key phrases: invalid free operations
CVE-2021-46142: An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.
Key phrases: invalid free operations
CVE-2021-46143: In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
Key phrases: integer overflow
CVE-2021-46144: Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
Key phrases: XSS via an HTML e-mail message, xss
CVE-2021-46145: The keyfob subsystem in Honda Civic 2012 vehicles allows a replay attack for unlocking. This is related to a non-expiring rolling code and counter resynchronization.
Key phrases: a non-expiring rolling code and counter, replay, counter resynchronization
CVE-2021-46146: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file.
Key phrases: xss
CVE-2021-46147: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF.
Key phrases: CSRF, csrf
CVE-2021-46148: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance.
Key phrases: confidential information
CVE-2021-46149: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.
Key phrases: denial of service (resource consumption)
CVE-2021-46150: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October.
Key phrases: CheckUser XSS because of date mishandling, checkuser xss, xss payload
CVE-2021-46151: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14754, ZDI-CAN-15082)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2021-46152: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a type confusion vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14643, ZDI-CAN-14644, ZDI-CAN-14755, ZDI-CAN-15183)
Key phrases: execute code in the context of the current, type confusion
CVE-2021-46153: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a memory corruption vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14645, ZDI-CAN-15305, ZDI-CAN-15589, ZDI-CAN-15599)
Key phrases: execute code in the context of the current, memory corruption
CVE-2021-46154: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14646, ZDI-CAN-14679, ZDI-CAN-15084, ZDI-CAN-15304)
Key phrases: execute code in the context of the current, stack based buffer overflow
CVE-2021-46155: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14683, ZDI-CAN-15283, ZDI-CAN-15303, ZDI-CAN-15593)
Key phrases: execute code in the context of the current, stack based buffer overflow
CVE-2021-46156: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14684)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2021-46157: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a memory corruption vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14757)
Key phrases: execute code in the context of the current, memory corruption
CVE-2021-46158: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15085, ZDI-CAN-15289, ZDI-CAN-15602)
Key phrases: execute code in the context of the current, stack based buffer overflow
CVE-2021-46159: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15050)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2021-46160: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15286)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2021-46161: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15302)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2021-46162: A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15048)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2021-46163: Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem.
Key phrases: the Media Libraries subsystem, xss
CVE-2021-46164: Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module.
Key phrases: the Reports module, remote code execution
CVE-2021-46165: Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined.
CVE-2021-46166: Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.
Key phrases: obtain sensitive information, obtain sensitive information from the database by visiting
CVE-2021-46167: An access control issue in the authentication module of wizplat PD065 v1.19 allows attackers to access sensitive data and cause a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), access sensitive data and cause a Denial of, access control issue, denial of service (dos)
CVE-2021-46168: Spin v6.5.1 was discovered to contain an out-of-bounds write in lex() at spinlex.c.
Key phrases: out-of-bounds write, out of bounds write
CVE-2021-46169: Modex v2.11 was discovered to contain an Use-After-Free vulnerability via the component tcache.
Key phrases: use-after-free
CVE-2021-46170: An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexer_compare_identifier_to_string in js-lexer.c file.
Key phrases: use-after-free
CVE-2021-46171: Modex v2.11 was discovered to contain a NULL pointer dereference in set_create_id() at xtract.c.
Key phrases: null pointer dereference
CVE-2021-46174: Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37.
Key phrases: heap-based buffer overflow
CVE-2021-46179: Reachable Assertion vulnerability in upx before 4.0.0 allows attackers to cause a denial of service via crafted file passed to the the readx function.
Key phrases: cause a denial of service via crafted file, reachable assertion
CVE-2021-46195: GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), uncontrolled recursion, denial of service (dos)
CVE-2021-46198: An SQL Injection vulnerability exists in Sourceodester Courier Management System 1.0 via the email parameter in /cms/ajax.php app.
Key phrases: sql injection
CVE-2021-46200: An SQL Injection vulnerability exists in Sourcecodester Simple Music Clour Community System 1.0 via the email parameter in /music/ajax.php.
Key phrases: sql injection
CVE-2021-46201: An SQL Injection vulnerability exists in Sourcecodester Online Resort Management System 1.0 via the id parameterv in /orms/ node.
Key phrases: sql injection
CVE-2021-46203: Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter.
Key phrases: arbitrary file read
CVE-2021-46204: Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter. SQL injection vulnerability via taocms\\include\\Model\\Article.php.
Key phrases: arbitrary file read, sql injection
CVE-2021-46225: A buffer overflow in the GmfOpenMesh() function of libMeshb v7.61 allows attackers to cause a Denial of Service (DoS) via a crafted MESH file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2021-46226: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wget_test.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the url parameter, command injection
CVE-2021-46227: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function proxy_client.asp. This vulnerability allows attackers to execute arbitrary commands via the proxy_srv, proxy_srvport, proxy_lanip, proxy_lanport parameters.
Key phrases: execute arbitrary commands, execute arbitrary commands via the proxy_srv, command injection
CVE-2021-46228: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd_debug.asp. This vulnerability allows attackers to execute arbitrary commands via the time parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the time parameter, command injection
CVE-2021-46229: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usb_paswd.asp. This vulnerability allows attackers to execute arbitrary commands via the name parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the name parameter, command injection
CVE-2021-46230: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgrade_filter. This vulnerability allows attackers to execute arbitrary commands via the path and time parameters.
Key phrases: execute arbitrary commands, execute arbitrary commands via the path and time, command injection
CVE-2021-46231: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function urlrd_opt.asp. This vulnerability allows attackers to execute arbitrary commands via the url_en parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the url_en parameter, command injection
CVE-2021-46232: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function version_upgrade.asp. This vulnerability allows attackers to execute arbitrary commands via the path parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the path parameter, command injection
CVE-2021-46233: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function msp_info.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the cmd parameter, command injection
CVE-2021-46234: A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), null pointer dereference, denial of service (dos)
CVE-2021-46236: A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_vrml_field_pointer_del () at scenegraph/vrml_tools.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), null pointer dereference, denial of service (dos)
CVE-2021-46237: An untrusted pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), untrusted pointer dereference, denial of service (dos)
CVE-2021-46238: GPAC v1.1.0 was discovered to contain a stack overflow via the function gf_node_get_name () at scenegraph/base_scenegraph.c. This vulnerability can lead to a program crash, causing a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), stack overflow, denial of service (dos), crash
CVE-2021-46239: The binary MP4Box in GPAC v1.1.0 was discovered to contain an invalid free vulnerability via the function gf_free () at utils/alloc.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), invalid free, denial of service (dos)
CVE-2021-46240: A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), null pointer dereference, denial of service (dos)
CVE-2021-46242: HDF5 v1.13.1-1 was discovered to contain a heap-use-after free via the component H5AC_unpin_entry.
Key phrases: heap-use-after free, use after free
CVE-2021-46243: An untrusted pointer dereference vulnerability exists in HDF5 v1.13.1-1 via the function H5O__dtype_decode_helper () at hdf5/src/H5Odtype.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), untrusted pointer dereference, denial of service (dos)
CVE-2021-46244: A Divide By Zero vulnerability exists in HDF5 v1.13.1-1 vis the function H5T__complete_copy () at /hdf5/src/H5T.c. This vulnerability causes an aritmetic exception, leading to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), divide by zero, denial of service (dos)
CVE-2021-46247: The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from ASUS CMAX6000 v1.02.00.
Key phrases: hard-coded cryptographic key, hard coded cryptographic key
CVE-2021-46249: An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.
Key phrases: bypass exploited by a user-controlled, authorization bypass, set flags that indicate whether an app is
CVE-2021-46250: An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2.
Key phrases: authenticate as other users on downstream components that
CVE-2021-46251: A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2021-46252: A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses.
Key phrases: modify account request requirement bypasses, cross-site request forgery (csrf)
CVE-2021-46253: A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, cross-site scripting (xss)
CVE-2021-46255: eyouCMS V1.5.5-UTF8-SP3_1 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename.
Key phrases: arbitrary file deletion
CVE-2021-46262: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the PPPoE module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack buffer overflow, denial of service (dos)
CVE-2021-46263: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiTime module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack buffer overflow, denial of service (dos)
CVE-2021-46264: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the onlineList module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack buffer overflow, denial of service (dos)
CVE-2021-46265: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wanBasicCfg module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack buffer overflow, denial of service (dos)
CVE-2021-46270: JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insufficient permission validation.
Key phrases: broken access control
CVE-2021-46279: Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
Key phrases: perfom session hijacking attacks against users, session fixation, session expiration
CVE-2021-46283: nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace.
Key phrases: denial of service (NULL pointer dereference and general protection fault), cause a denial of service (NULL pointer, null pointer dereference
CVE-2021-46304: A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-8021 MASTER MODULE (All versions), CP-8022 MASTER MODULE WITH GPRS (All versions). The component allows to activate a web server module which provides unauthenticated access to its web pages. This could allow an attacker to retrieve debug-level information from the component such as internal network topology or connected systems.
Key phrases: activate a web server module which provides unauthenticated, retrieve debug-level information from the component, unauthenticated access
CVE-2021-46307: An SQL Injection vulnerability exists in Projectworlds Online Examination System 1.0 via the eid parameter in account.php.
Key phrases: sql injection
CVE-2021-46308: An SQL Injection vulnerability exists in Sourcecodester Online Railway Reservation Sysytem 1.0 via the sid parameter.
Key phrases: sql injection
CVE-2021-46309: An SQL Injection vulnerability exists in Sourcecodester Employee and Visitor Gate Pass Logging System 1.0 via the username parameter.
Key phrases: sql injection
CVE-2021-46310: An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero.
Key phrases: cause a denial of service via divide by
CVE-2021-46311: A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_destroy_routes () at scenegraph/vrml_route.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), null pointer dereference, denial of service (dos)
CVE-2021-46312: An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero.
Key phrases: cause a denial of service via divide by
CVE-2021-46313: The binary MP4Box in GPAC v1.0.1 was discovered to contain a segmentation fault via the function __memmove_avx_unaligned_erms (). This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segmentation fault, denial of service (dos)
CVE-2021-46314: A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for command injection when judging whether it is a reasonable domain name.
Key phrases: remote command execution (rce), command injection
CVE-2021-46315: Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parameters to cause arbitrary command execution. Since CVE-2019-17510 vulnerability has not been patched and improved www/hnap1/control/setwizardconfig.php, can also use line breaks and backquotes to bypass.
Key phrases: cause arbitrary command execution, bypass, remote command execution (rce), shell metacharacters, arbitrary commands
CVE-2021-46319: Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use "\\ " or backticks to bypass the shell metacharacters in the ssid0 or ssid1 parameters to execute arbitrary commands.This vulnerability is due to the fact that CVE-2019-17509 is not fully patched and can be bypassed by using line breaks or backticks on its basis.
Key phrases: execute arbitrary commands, bypass the shell metacharacters in the ssid0 or ssid1 parameters, remote code execution (rce)
CVE-2021-46320: In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.
Key phrases: untrusted non-view external call, reentrancy
CVE-2021-46321: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiBasicCfg module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack buffer overflow, denial of service (dos)
CVE-2021-46322: Duktape v2.99.99 was discovered to contain a SEGV vulnerability via the component duk_push_tval in duktape/duk_api_stack.c.
Key phrases: segv
CVE-2021-46323: Espruino 2v11.251 was discovered to contain a SEGV vulnerability via src/jsinteractive.c in jsiGetDeviceFromClass.
Key phrases: segv
CVE-2021-46324: Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.
Key phrases: stack buffer overflow
CVE-2021-46325: Espruino 2v10.246 was discovered to contain a stack buffer overflow via src/jsutils.c in vcbprintf.
Key phrases: stack buffer overflow
CVE-2021-46326: Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __asan_memcpy.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2021-46327: Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsArray.c in fx_Array_prototype_sort.
Key phrases: segv
CVE-2021-46328: Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __libc_start_main.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2021-46329: Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via the component _fini.
Key phrases: segv
CVE-2021-46330: Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsDataView.c in fx_ArrayBuffer_prototype_concat.
Key phrases: segv
CVE-2021-46331: Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsProxy.c in fxProxyGetPrototype.
Key phrases: segv
CVE-2021-46332: Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via xs/sources/xsDataView.c in fxUint8Getter.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2021-46333: Moddable SDK v11.5.0 was discovered to contain an invalid memory access vulnerability via the component __asan_memmove.
Key phrases: invalid memory access
CVE-2021-46334: Moddable SDK v11.5.0 was discovered to contain a stack buffer overflow via the component __interceptor_strcat.
Key phrases: stack buffer overflow
CVE-2021-46335: Moddable SDK v11.5.0 was discovered to contain a NULL pointer dereference in the component fx_Function_prototype_hasInstance.
Key phrases: null pointer dereference
CVE-2021-46336: There is an Assertion 'opts & PARSER_CLASS_LITERAL_CTOR_PRESENT' failed at /parser/js/js-parser-expr.c(parser_parse_class_body) in JerryScript 3.0.0.
CVE-2021-46337: There is an Assertion 'page_p != NULL' failed at /parser/js/js-parser-mem.c(parser_list_get) in JerryScript 3.0.0.
CVE-2021-46338: There is an Assertion 'ecma_is_lexical_environment (object_p)' failed at /base/ecma-helpers.c(ecma_get_lex_env_type) in JerryScript 3.0.0.
CVE-2021-46339: There is an Assertion 'lit_is_valid_cesu8_string (string_p, string_size)' failed at /base/ecma-helpers-string.c(ecma_new_ecma_string_from_utf8) in JerryScript 3.0.0.
Key phrases: assertion
CVE-2021-46340: There is an Assertion 'context_p->stack_top_uint8 == SCAN_STACK_TRY_STATEMENT || context_p->stack_top_uint8 == SCAN_STACK_CATCH_STATEMENT' failed at /parser/js/js-scanner.c(scanner_scan_statement_end) in JerryScript 3.0.0.
CVE-2021-46342: There is an Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at /jerry-core/ecma/base/ecma-helpers.c in JerryScript 3.0.0.
CVE-2021-46343: There is an Assertion 'context_p->token.type == LEXER_LITERAL' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0.
CVE-2021-46344: There is an Assertion 'flags & PARSER_PATTERN_HAS_REST_ELEMENT' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0.
CVE-2021-46345: There is an Assertion 'cesu8_cursor_p == cesu8_end_p' failed at /jerry-core/lit/lit-strings.c in JerryScript 3.0.0.
Key phrases: assertion
CVE-2021-46346: There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in JerryScript 3.0.0.
CVE-2021-46347: There is an Assertion 'ecma_object_check_class_name_is_object (obj_p)' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript 3.0.0.