yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-33440: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs.c.
Key phrases: null pointer dereference
CVE-2021-33441: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in exec_expr() in mjs.c.
Key phrases: null pointer dereference
CVE-2021-33442: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in json_printf() in mjs.c.
Key phrases: null pointer dereference
CVE-2021-33443: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in mjs_execute() in mjs.c.
Key phrases: stack buffer overflow
CVE-2021-33444: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in getprop_builtin_foreign() in mjs.c.
Key phrases: null pointer dereference
CVE-2021-33445: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_string_char_code_at() in mjs.c.
Key phrases: null pointer dereference
CVE-2021-33446: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_next() in mjs.c.
Key phrases: null pointer dereference
CVE-2021-33447: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_print() in mjs.c.
Key phrases: null pointer dereference
CVE-2021-33448: An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow at 0x7fffe9049390.
Key phrases: stack buffer overflow
CVE-2021-33449: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offset() in mjs.c.
Key phrases: null pointer dereference
CVE-2021-3345: _gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. It is recommended to upgrade to 1.9.1 or later.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2021-33450: An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
Key phrases: memory leaks
CVE-2021-33451: An issue was discovered in lrzip version 0.641. There are memory leaks in fill_buffer() in stream.c.
Key phrases: memory leaks
CVE-2021-33452: An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_malloc() in nasmlib/alloc.c.
Key phrases: memory leaks
CVE-2021-33453: An issue was discovered in lrzip version 0.641. There is a use-after-free in ucompthread() in stream.c:1538.
Key phrases: use-after-free, use after free
CVE-2021-33454: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libyasm/expr.c.
Key phrases: null pointer dereference
CVE-2021-33455: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: null pointer dereference
CVE-2021-33456: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: null pointer dereference
CVE-2021-33457: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: null pointer dereference
CVE-2021-33458: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: null pointer dereference
CVE-2021-33459: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c.
Key phrases: null pointer dereference
CVE-2021-3346: Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template.
Key phrases: html escaping
CVE-2021-33460: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: null pointer dereference
CVE-2021-33461: An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c.
Key phrases: use-after-free, use after free
CVE-2021-33462: An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/expr.c.
Key phrases: use-after-free, use after free
CVE-2021-33463: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c.
Key phrases: null pointer dereference
CVE-2021-33464: An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2021-33465: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: null pointer dereference
CVE-2021-33466: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: null pointer dereference
CVE-2021-33467: An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: use-after-free, use after free
CVE-2021-33468: An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c.
Key phrases: use-after-free, use after free
CVE-2021-33469: COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.
Key phrases: cross site scripting (xss)
CVE-2021-3347: An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
Key phrases: execute code in the kernel, kernel stack use-after-free, use after free
CVE-2021-33470: COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
Key phrases: sql injection
CVE-2021-33473: An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
Key phrases: write arbitrary files, read and write arbitrary files when the verify_url, argument injection
CVE-2021-33477: rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
Key phrases: (potentially remote) code execution because of, remote code execution
CVE-2021-33478: The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. This, for example, affects certain Cisco IP Phone and Wireless IP Phone products before 2021-07-07. Exploitation is possible only when the attacker can disassemble the device in order to control the voltage/current for chip pins.
Key phrases: achieve arbitrary code execution, achieve arbitrary code execution in the TrustZone Trusted, exploitation
CVE-2021-33479: A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measure_pitch() in pgm2asc.c.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2021-3348: nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
Key phrases: ndb_queue_rq use-after-free, use after free
CVE-2021-33480: An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in context_correction() in pgm2asc.c.
Key phrases: use-after-free, use after free
CVE-2021-33481: A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in try_to_divide_boxes() in pgm2asc.c.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2021-33483: An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment.
Key phrases: add an XSS payload to the JSON request, xss payload
CVE-2021-33484: An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted encryption key (sent as a parameter in the comment form request) by setting this encrypted value as the username, which will appear on the comment page in its decrypted form. Using these two values (combined with the encryption functionality discovered in the decompiled installer), the attacker can encrypt another user's ID and username. These values can be used as part of the comment posting request in order to spoof the user.
Key phrases: hardcoded, spoofing
CVE-2021-33485: CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
Key phrases: heap-based buffer overflow
CVE-2021-33486: All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.
Key phrases: improper handling of exceptional conditions
CVE-2021-33488: chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook.
Key phrases: improper input validation
CVE-2021-33489: OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.
Key phrases: XSS via JavaScript code in a shared XCF, xss
CVE-2021-3349: GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior
CVE-2021-33490: OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.
Key phrases: XSS via a crafted snippet in a shared, xss
CVE-2021-33491: OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.
Key phrases: Directory Traversal via ../ in an OOXML, directory traversal
CVE-2021-33492: OX App Suite 7.10.5 allows XSS via an OX Chat room name.
Key phrases: XSS via an OX Chat room name, xss
CVE-2021-33493: The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.
Key phrases: Code Injection via Java classes in a YAML, code injection
CVE-2021-33494: OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
Key phrases: XSS via an OX Chat room title during, xss
CVE-2021-33495: OX App Suite 7.10.5 allows XSS via an OX Chat system message.
Key phrases: XSS via an OX Chat system message, xss
CVE-2021-33496: Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.
Key phrases: XSS via an inline view, xss
CVE-2021-33497: Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.
Key phrases: Directory Traversal for deleting files, directory traversal
CVE-2021-33498: Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).
Key phrases: remote denial of service because of missing H.264, input validation
CVE-2021-33499: Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).
Key phrases: remote denial of service because of missing H.264, input validation
CVE-2021-3350: deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.
Key phrases: XSS via the deletereason parameter, xss
CVE-2021-33500: PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. NOTE: the same attack methodology may affect some OS-level GUIs on Linux or other platforms for similar reasons.
Key phrases: denial of service (Windows GUI hang), cause a denial of service (Windows GUI, attack methodology
CVE-2021-33501: Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL.
Key phrases: XSS, xss, remote code execution
CVE-2021-33502: The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Key phrases:  ReDoS (regular expression denial of service), redos
CVE-2021-33503: An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
Key phrases: catastrophic backtracking, denial of service
CVE-2021-33504: Couchbase Server before 7.1.0 has Incorrect Access Control.
Key phrases: incorrect access control
CVE-2021-33505: A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters arguments of system calls being executed. Issue is fixed in Falco versions >= 0.29.1.
CVE-2021-33506: jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This can allow an attacker to circumvent conference moderation.
Key phrases: circumvent conference moderation
CVE-2021-33507: Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
Key phrases: Reflected XSS, reflected xss
CVE-2021-33508: Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.
Key phrases: XSS via a full name that is mishandled, xss
CVE-2021-33509: Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
Key phrases: perform disk I/O via crafted keyword
CVE-2021-3351: OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page.
Key phrases: the web server's Add New Device page, xss
CVE-2021-33510: Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.
Key phrases: conduct SSRF attacks via an event ical URL, ssrf, event ical url, one line of a file
CVE-2021-33511: Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
Key phrases: SSRF via the lxml parser, ssrf
CVE-2021-33512: Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.
Key phrases: stored XSS attacks (by a Contributor), stored xss
CVE-2021-33513: Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.
Key phrases: XSS via the inline_diff methods in Products, xss
CVE-2021-33514: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as demonstrated by setup.cgi?token=';$HTTP_USER_AGENT;' with an OS command in the User-Agent field. This affects GC108P before 1.0.7.3, GC108PP before 1.0.7.3, GS108Tv3 before 7.0.6.3, GS110TPPv1 before 7.0.6.3, GS110TPv3 before 7.0.6.3, GS110TUPv1 before 1.0.4.3, GS710TUPv1 before 1.0.4.3, GS716TP before 1.0.2.3, GS716TPP before 1.0.2.3, GS724TPPv1 before 2.0.4.3, GS724TPv2 before 2.0.4.3, GS728TPPv2 before 6.0.6.3, GS728TPv2 before 6.0.6.3, GS752TPPv1 before 6.0.6.3, GS752TPv2 before 6.0.6.3, MS510TXM before 1.0.2.3, and MS510TXUP before 1.0.2.3.
Key phrases: command injection
CVE-2021-33515: The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
Key phrases: an attacker-controlled address, command injection, sensitive information
CVE-2021-33516: An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.
Key phrases: trick a victim's browser into triggering actions, dns rebinding, data exfiltration, data tempering
CVE-2021-3352: The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacker to access (view and modify) user data without authorization due to improper handling of tokens.
Key phrases: access (view and modify) user data, improper handling of tokens
CVE-2021-33523: MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the underlying host. This occurs in com.idsscheer.ppmmashup.business.jdbc.DriverUploadController.
Key phrases: execute arbitrary commands, the admin console
CVE-2021-33525: EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution (by authenticated users) via shell metacharacters in the nagios_path parameter to lilac/export.php, as demonstrated by %26%26+curl to insert an "&& curl" substring for the shell.
Key phrases: lilac/export.php, remote command execution, shell metacharacters
CVE-2021-33526: In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\\\\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.
Key phrases: arbitrary code execution
CVE-2021-33527: In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\\\\SYSTEM that will not correctly validate the input. This can lead to an arbitrary code execution with the privileges of the service.
Key phrases: arbitrary code execution
CVE-2021-33528: In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
Key phrases: exploitable privilege escalation, system access
CVE-2021-33529: In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryption of captured traffic across the network from or to the device.
Key phrases: the device, hard-coded cryptographic keys, hard coded cryptographic key
CVE-2021-33530: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the devices. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed, resulting in remote control over the device. An attacker can send diagnostic while authenticated as a low privilege user to trigger this vulnerability.
Key phrases: cause arbitrary busybox commands, exploitable command injection, remote control
CVE-2021-33531: In Weidmueller Industrial WLAN devices in multiple versions an exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts. An attacker can send diagnostic scripts while authenticated as a low privilege user to trigger this vulnerability.
Key phrases: trigger this vulnerability, hard-coded credentials, hard coded credentials
CVE-2021-33532: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
Key phrases: exploitable command injection, remote control
CVE-2021-33533: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted iw_serverip parameter can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
Key phrases: exploitable command injection, remote control
CVE-2021-33534: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send various requests while authenticated as a high privilege user to trigger this vulnerability.
Key phrases: exploitable command injection, full control
CVE-2021-33535: In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
Key phrases: format string, overflow, remote code execution
CVE-2021-33536: In Weidmueller Industrial WLAN devices in multiple versions an exploitable denial-of-service vulnerability exists in ServiceAgent functionality. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can send this packet while unauthenticated to trigger this vulnerability.
Key phrases: denial-of-service, integer underflow, denial of service, out of bounds memory
CVE-2021-33537: In Weidmueller Industrial WLAN devices in multiple versions an exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality. A specially crafted user name entry can cause an overflow of an error message buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
Key phrases: remote code execution
CVE-2021-33538: In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functionality. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
Key phrases: improper access control, remote shell access
CVE-2021-33539: In Weidmueller Industrial WLAN devices in multiple versions an exploitable authentication bypass vulnerability exists in the hostname processing. A specially configured device hostname can cause the device to interpret selected remote traffic as local traffic, resulting in a bypass of web authentication. An attacker can send authenticated SNMP requests to trigger this vulnerability.
Key phrases: bypass of web authentication, authentication bypass
CVE-2021-33540: In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.
Key phrases: undocumented password protected ftp access
CVE-2021-33541: Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of service on the PLC's network communication module. A successful attack stops all network communication. To restore the network connectivity the device needs to be restarted. The automation task is not affected.
Key phrases: denial-of-service, denial of service
CVE-2021-33542: Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.
Key phrases: remote code execution, integrity, confidentiality
CVE-2021-33543: Multiple camera devices by UDP Technology, Geutebrck and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service.
Key phrases: sensitive files due to default user authentication settings, unauthenticated remote access, denial of service
CVE-2021-33544: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, command injection
CVE-2021-33545: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to a stack-based buffer overflow condition in the counter parameter which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, stack-based buffer overflow, stack based buffer overflow
CVE-2021-33546: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to a stack-based buffer overflow condition in the name parameter, which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, stack-based buffer overflow, stack based buffer overflow
CVE-2021-33547: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to a stack-based buffer overflow condition in the profile parameter which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, stack-based buffer overflow, stack based buffer overflow
CVE-2021-33548: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, command injection
CVE-2021-33549: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, stack-based buffer overflow, stack based buffer overflow
CVE-2021-3355: A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.
Key phrases: execute HTML or JavaScript code in a vulnerable, stored-self xss
CVE-2021-33550: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, command injection
CVE-2021-33551: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, command injection
CVE-2021-33552: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, command injection
CVE-2021-33553: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, command injection
CVE-2021-33554: Multiple camera devices by UDP Technology, Geutebrck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Key phrases: execute arbitrary code, remotely execute arbitrary code, command injection
CVE-2021-33555: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server.
Key phrases: filename parameter, unauthenticated path traversal, read access, arbitrary file
CVE-2021-33557: An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
Key phrases: inject code into a hidden input field, xss
CVE-2021-33558: Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not part of Boa.
Key phrases: obtain sensitive information, obtain sensitive information via a misconfiguration involving backup.html, site-specific issue
CVE-2021-33560: Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
Key phrases: side-channel
CVE-2021-33561: A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via customer_name, cross-site scripting (xss)
CVE-2021-33562: A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, reflected cross-site scripting (xss)
CVE-2021-33563: Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
Key phrases: login throttling, failed login attempt
CVE-2021-33564: An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Key phrases: read and write to arbitrary files via a, argument injection, code execution
CVE-2021-33570: Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.
Key phrases: stored XSS via the onerror attribute of an, stored xss
CVE-2021-33571: In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
Key phrases: bypass of access control, a bypass of access control that is based
CVE-2021-33572: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure products can crash while scanning larger packages/fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
Key phrases: denial-of-service (dos), crash
CVE-2021-33574: The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.
Key phrases: denial of service (application crash), use-after-free, unspecified other impact, use after free, unspecified impact
CVE-2021-33575: The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
Key phrases: execute arbitrary code, execute arbitrary code because of the Plist gem
CVE-2021-33576: An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.
Key phrases: be written to an arbitrary location on disk, path traversal, file write
CVE-2021-33577: An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain.
CVE-2021-33578: Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading to the ability to bypass authentication, exfiltrate Structured Query Language (SQL) records, and manipulate data.
Key phrases: bypass authentication, sql injection, manipulate data
CVE-2021-33580: User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2.
Key phrases: redos
CVE-2021-33581: MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a PPM connection. This occurs in com.idsscheer.ppmmashup.web.webservice.impl.ZPrestoAdminWebService.
Key phrases: interact with arbitrary TCP services, ssrf, availability
CVE-2021-33582: Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
Key phrases: denial of service (multiple-minute daemon hang), cause a denial of service (multiple-
CVE-2021-33583: REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file.
Key phrases: sa password, hardcoded
CVE-2021-33586: InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
Key phrases: connect to the server) to access recently, malformed pong
CVE-2021-33587: The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
CVE-2021-33589: Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.
Key phrases: weaker encryption, weak encryption
CVE-2021-33590: GattLib 0.3-rc1 has a stack-based buffer over-read in get_device_path_from_mac in dbus/gattlib.c.
Key phrases: stack-based buffer over-read, buffer over read
CVE-2021-33591: An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Key phrases: execute arbitrary code, remote debugging port
CVE-2021-33592: NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in filename parameter can be the cause of bypassing code signing check function.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted upgrade.xml file, special characters in filename parameter, bypass code signing check
CVE-2021-33593: Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing.
Key phrases: obfuscate the address bar which may lead to, address bar spoofing
CVE-2021-33594: An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted a malicious URL, it appears like a legitimate one on the address bar, while the content comes from other domain and presented in a window, covering the original content. A remote attacker can leverage this to perform address bar spoofing attack.
Key phrases: address bar spoofing
CVE-2021-33595: A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. A remote attacker can leverage this to perform address bar spoofing attack.
Key phrases: address bar spoofing
CVE-2021-33596: Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded malicious redirect while using F-Secure Safe Browser for iOS.
CVE-2021-33597: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
Key phrases: denial-of-service (dos), crash
CVE-2021-33598: A Denial-of-Service (DoS) vulnerability was discovered in all versions of F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
Key phrases: denial-of-service (dos), crash
CVE-2021-33599: A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service (infinite loop and freezes AV engine scanner). The vulnerability can be exploit remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.
Key phrases: denial-of-service, denial of service, infinite loop
CVE-2021-33600: A denial-of-service (DoS) vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. The vulnerability occurs because of an attacker can trigger assertion via malformed HTTP packet to web interface. An unauthenticated attacker could exploit this vulnerability by sending a large username parameter. A successful exploitation could lead to a denial-of-service of the product.
Key phrases: denial-of-service, denial of service
CVE-2021-33601: A vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. An authenticated user can modify settings through the web user interface in a way that could lead to an arbitrary code execution on the F-Secure Internet Gatekeeper server.
Key phrases: arbitrary code execution
CVE-2021-33602: A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive (LZW decompression method), and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.
Key phrases: denial-of-service, crash
CVE-2021-33603: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
Key phrases: denial-of-service (dos), crash
CVE-2021-33604: URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
Key phrases: execute arbitrary JavaScript code, execute arbitrary JavaScript code by opening crafted URL, url encoding error
CVE-2021-33605: Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.
Key phrases: modify the value of a disabled Checkbox inside, improper check, unspecified vectors
CVE-2021-33609: Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Key phrases: cause heap exhaustion by requesting too many rows, missing check
CVE-2021-33611: Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL
Key phrases: execute malicious JavaScript in browser by opening crafted, missing output sanitization
CVE-2021-33615: RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.
Key phrases: Unrestricted Upload of a File with a Dangerous, unrestricted upload, dangerous type
CVE-2021-33616: RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.
Key phrases: stored XSS, xss
CVE-2021-33617: Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.
Key phrases: a failed login request) is null only
CVE-2021-33618: Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.
Key phrases: the user-management feature, xss
CVE-2021-33620: Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.
Key phrases: denial of service (affecting availability to all clients), cause a denial of service (affecting availability, issue trigger
CVE-2021-33621: The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
Key phrases: applications that use untrusted user input either to, http response splitting
CVE-2021-33622: Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value.
Key phrases: incorrect check
CVE-2021-33623: The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Key phrases: regular expression denial-of-service (redos), denial of service
CVE-2021-33624: In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.
Key phrases: read arbitrary memory locations, type confusion, side-channel
CVE-2021-33625: An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.
Key phrases: use of SMRAM, hddpassword
CVE-2021-33626: A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.
Key phrases: arbitrary code execution
CVE-2021-33627: An issue was discovered in Insyde InsydeH2O 5.x, affecting FwBlockServiceSmm. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses
Key phrases: use of SMRAM