yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-46348: There is an Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at /jerry-core/ecma/base/ecma-literal-storage.c in JerryScript 3.0.0.
CVE-2021-46349: There is an Assertion 'type == ECMA_OBJECT_TYPE_GENERAL || type == ECMA_OBJECT_TYPE_PROXY' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript 3.0.0.
CVE-2021-46350: There is an Assertion 'ecma_is_value_object (value)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c in JerryScript 3.0.0.
CVE-2021-46351: There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in JerryScript 3.0.0.
CVE-2021-46353: An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP request and gain knowledge of different absolute paths that are being used by the web application.
Key phrases: gain knowledge of different absolute paths that are, send a specially crafted HTTP request and gain, information disclosure
CVE-2021-46354: Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.
Key phrases: filtrate the real IP of the web server, information disclosure, attack surface
CVE-2021-46355: OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS). To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting (XSS).
Key phrases: the execution of Stored Cross-site Scripting, cross site scripting (xss), stored cross-site scripting (xss)
CVE-2021-46359: FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability. Some transactions may not be committed successfully, and malicious users may use this to achieve double-spending attacks.
Key phrases: denial of service, double-spending
CVE-2021-46360: Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr.
Key phrases: execute arbitrary code, execute arbitrary code via uploading a PHP shell, authenticated remote code execution (rce)
CVE-2021-46361: An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.
Key phrases: execute arbitrary code, bypass security restrictions, bypass security restrictions and execute arbitrary code via
CVE-2021-46362: A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload entered, server-side template injection (ssti)
CVE-2021-46363: An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Microsoft Excel.
Key phrases: perform Formula Injection attacks via crafted CSV/, formula injection, arbitrary code execution
CVE-2021-46364: A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted YAML file
CVE-2021-46365: An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.
Key phrases: execute XML External Entity attacks via a crafted, xml external entity
CVE-2021-46366: An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.
Key phrases: exploit both an Open Redirect vulnerability and Cross, open redirect, cross-site request forgery (csrf), brute force, exfiltrate
CVE-2021-46367: RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default.
Key phrases: bypass the .htacess configuration to deny execution of .php files, remote code execution
CVE-2021-46368: TRIGONE Remote System Monitor 3.61 is vulnerable to an unquoted path service allowing local users to launch processes with elevated privileges.
Key phrases: launch processes with elevated privileges, unquoted path service, elevate privileges
CVE-2021-46371: antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the foreground leads to leakage of sensitive information.
Key phrases: incorrect access control, leakage of sensitive information, unauthorized access
CVE-2021-46372: Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters.
Key phrases: xss
CVE-2021-46377: There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUser
Key phrases: front-end sql injection
CVE-2021-46378: DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download.
Key phrases: access control, unauthenticated remote configuration download, incorrect access control
CVE-2021-46379: DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site.
Key phrases: access control, incorrect access control
CVE-2021-46381: Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].
Key phrases: local file inclusion, path traversal, file read
CVE-2021-46382: Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipboard hijacking.
Key phrases: unauthenticated cross-site scripting (xss), session hijacking, clipboard hijacking
CVE-2021-46383: https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.
Key phrases: obtain sensitive information, sql injection, attack vector
CVE-2021-46384: https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}.  MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS.
Key phrases: execute arbitrary code, compromise MCMS, rce, attack vector, pre-auth rce, takeover
CVE-2021-46385: https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.
Key phrases: obtain sensitive information, sql injection, attack vector
CVE-2021-46386: File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted jspx webshell, file upload
CVE-2021-46387: ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.
Key phrases: execute arbitrary JavaScript codes, bypass security restriction, execute arbitrary JavaScript codes to perform multiple attacks, cross site scripting (xss), insecure uri handling, clipboard hijacking, session hijacking
CVE-2021-46389: IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by an integer overflow in iipsrv.fcgi through malformed HTTP query parameters.
Key phrases: integer overflow
CVE-2021-46390: An access control issue in the authentication module of Lexar_F35 v1.0.34 allows attackers to access sensitive data and cause a Denial of Service (DoS). An attacker without access to securely protected data on a secure USB flash drive can bypass user authentication without having any information related to the password of the registered user. The secure USB flash drive transmits the password entered by the user to the authentication module in the drive after the user registers a password, and then the input password is compared with the registered password stored in the authentication module. Subsequently, the module returns the comparison result for the authentication decision. Therefore, an attacker can bypass password authentication by analyzing the functions that return the password verification or comparison results and manipulate the authentication result values. Accordingly, even if attackers enter an incorrect password, they can be authenticated as a legitimate user and can therefore exploit functions of the secure USB flash drive by manipulating the authentication result values.
Key phrases: Denial of Service (DoS), bypass user authentication, bypass password authentication, access sensitive data and cause a Denial of, access control issue, denial of service (dos)
CVE-2021-46393: There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v10 variable is directly retrieved from the http request parameter startIp. Then v10 will be splice to stack by function sscanf without any security check,which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.
Key phrases: stack buffer overflow, stack overflow, remote code execution
CVE-2021-46394: There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved from the http request parameter startIp. Then v13 will be splice to stack by function sscanf without any security check, which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.
Key phrases: stack buffer overflow, stack overflow, remote code execution
CVE-2021-46398: A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.
Key phrases: create a backdoor user with admin privilege and, cross-site request forgery, rce, run commands
CVE-2021-46408: Tenda AX12 v22.03.01.21 was discovered to contain a stack buffer overflow in the function sub_422CE4. This vulnerability allows attackers to cause a Denial of Service (DoS) via the strcpy parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack buffer overflow, denial of service (dos)
CVE-2021-46416: Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
Key phrases: insecure direct object reference, insecure cookie handling
CVE-2021-46417: Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580.
Key phrases: insecure handling, path traversal, disclosure, root privilege
CVE-2021-46418: An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
Key phrases: creation of CGI scripts, file creation
CVE-2021-46419: An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.
Key phrases: deletion of system files and scripts, file deletion
CVE-2021-46420: Franklin Fueling Systems FFS TS-550 evo 2.23.4.8936 is affected by an unauthenticated directory traversal vulnerability, which allows an attacker to obtain sensitive information.
Key phrases: obtain sensitive information, unauthenticated directory traversal
CVE-2021-46421: Franklin Fueling Systems FFS T5 Series 1.8.7.7299 is affected by an unauthenticated directory traversal vulnerability, which allows an attacker to obtain sensitive information.
Key phrases: obtain sensitive information, unauthenticated directory traversal
CVE-2021-46422: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
Key phrases: execute OS commands without any authentication, os command injection
CVE-2021-46423: Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full configuration file.
Key phrases: download a full configuration file, unauthenticated file download
CVE-2021-46424: Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request.
Key phrases: delete any file, arbitrary file deletion
CVE-2021-46426: phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.
Key phrases: Reflected XSS and CSRF via app/admin, reflected xss, csrf
CVE-2021-46427: An SQL Injection vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 via the message parameter in Master.php.
Key phrases: sql injection
CVE-2021-46428: A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 ( and previous versions via the bot_avatar parameter in SystemSettings.php.
Key phrases: remote code execution (rce)
CVE-2021-46433: In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary PHP code when disable_native_funcs is true.
Key phrases: execute arbitrary PHP code, bypass sandbox to execute arbitrary PHP code when disable_native_funcs, Template.php function getTemplateCode()to bypass, arbitrary php code
CVE-2021-46434: EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid
Key phrases: username enumeration
CVE-2021-46436: An issue was discovered in ZZCMS 2021. There is a SQL injection vulnerability in ad_manage.php.
Key phrases: sql injection
CVE-2021-46437: An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php.
Key phrases: cross-site scripting (xss)
CVE-2021-46440: Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.
Key phrases: obtain a cleartext password, access a victim's HTTP request, recoverable format, api
CVE-2021-46441: In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute arbitrary system commands after obtaining authorization.
Key phrases: execute arbitrary system, parameter verification
CVE-2021-46442: In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization.
Key phrases: bypass authentication
CVE-2021-46444: H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID.
Key phrases: sql injection
CVE-2021-46445: H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id.
Key phrases: sql injection
CVE-2021-46446: H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID.
Key phrases: sql injection
CVE-2021-46447: A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the State parameter under the Address Book module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2021-46448: H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID.
Key phrases: sql injection
CVE-2021-46451: An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load_file function.
Key phrases: sql injection
CVE-2021-46452: D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via the tomography_ping_address, tomography_ping_number, tomography_ping_size, tomography_ping_timeout, and tomography_ping_ttl parameters.
Key phrases: execute arbitrary commands, execute arbitrary commands via the tomography_ping_address, command injection
CVE-2021-46453: D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStaticRouteSettings. This vulnerability allows attackers to execute arbitrary commands via the staticroute_list parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the staticroute_list parameter, command injection
CVE-2021-46454: D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanApcliSettings. This vulnerability allows attackers to execute arbitrary commands via the ApCliKeyStr parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the ApCliKeyStr parameter, command injection
CVE-2021-46455: D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStationSettings. This vulnerability allows attackers to execute arbitrary commands via the station_access_enable parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the station_access_enable parameter, command injection
CVE-2021-46456: D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allows attackers to execute arbitrary commands via the wl(0).(0)_maclist parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the wl(0).(0)_maclist parameter, command injection
CVE-2021-46457: D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function ChgSambaUserSettings. This vulnerability allows attackers to execute arbitrary commands via the samba_name parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the samba_name parameter, command injection
CVE-2021-46458: Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post. This vulnerability can be exploited through a crafted POST request via the post_title parameter.
Key phrases: sql injection
CVE-2021-46459: Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user. These vulnerabilities can be exploited through a crafted POST request via the user_name, user_firstname,user_lastname, or user_email parameters.
Key phrases: sql injection
CVE-2021-46461: njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.
Key phrases: out-of-bounds array access
CVE-2021-46462: njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c.
Key phrases: segmentation violation
CVE-2021-46463: njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs_promise_perform_then().
Key phrases: control flow hijack, type confusion
CVE-2021-46474: Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiEvalCodeSub in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2021-46475: Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsi_ArraySliceCmd in src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2021-46477: Jsish v3.5.0 was discovered to contain a heap buffer overflow via RegExp_constructor in src/jsiRegexp.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2021-46478: Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiClearStack in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2021-46480: Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiValueObjDelete in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2021-46481: Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c.
Key phrases: memory leak
CVE-2021-46482: Jsish v3.5.0 was discovered to contain a heap buffer overflow via NumberConstructor at src/jsiNumber.c.
Key phrases: heap buffer overflow
CVE-2021-46483: Jsish v3.5.0 was discovered to contain a heap buffer overflow via BooleanConstructor at src/jsiBool.c.
Key phrases: heap buffer overflow
CVE-2021-46484: Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_IncrRefCount in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46485: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_ValueIsNumber at src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46486: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via jsi_ArraySpliceCmd at src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46487: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x18e506. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46488: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via jsi_ArrayConcatCmd at src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46489: Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_DecrRefCount in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46490: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via NumberConstructor at src/jsiNumber.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46491: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_CommandPkgOpts at src/jsiCmds.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46492: Jsish v3.5.0 was discovered to contain a SEGV vulnerability via Jsi_FunctionInvoke at src/jsiFunc.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46494: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ValueLookupBase in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46495: Jsish v3.5.0 was discovered to contain a heap-use-after-free via DeleteTreeValue in src/jsiObj.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46496: Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_ObjFree in src/jsiObj.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46497: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_UserObjDelete in src/jsiUserObj.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46498: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_wswebsocketObjFree in src/jsiWebSocket.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46499: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ValueCopyMove in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46500: Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsi_ArgTypeCheck in src/jsiFunc.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46501: Jsish v3.5.0 was discovered to contain a heap-use-after-free via SortSubCmd in src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46502: Jsish v3.5.0 was discovered to contain a heap-use-after-free via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5166d. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46503: Jsish v3.5.0 was discovered to contain a heap-use-after-free via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2021-46504: There is an Assertion 'vp != resPtr' failed at jsiEval.c in Jsish v3.5.0.
Key phrases: assertion
CVE-2021-46505: Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5.
Key phrases: stack overflow
CVE-2021-46506: There is an Assertion 'v->d.lval != v' failed at src/jsiValue.c in Jsish v3.5.0.
Key phrases: assertion
CVE-2021-46507: Jsish v3.5.0 was discovered to contain a stack overflow via Jsi_LogMsg at src/jsiUtils.c.
Key phrases: stack overflow
CVE-2021-46508: There is an Assertion `i < parts_cnt' failed at src/mjs_bcode.c in Cesanta MJS v2.20.0.
CVE-2021-46509: Cesanta MJS v2.20.0 was discovered to contain a stack overflow via snquote at mjs/src/mjs_json.c.
Key phrases: stack overflow
CVE-2021-46510: There is an Assertion `s < mjs->owned_strings.buf + mjs->owned_strings.len' failed at src/mjs_gc.c in Cesanta MJS v2.20.0.
Key phrases: assertion
CVE-2021-46511: There is an Assertion `m->len >= sizeof(v)' failed at src/mjs_core.c in Cesanta MJS v2.20.0.
CVE-2021-46512: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_apply at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46513: Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via mjs_mk_string at mjs/src/mjs_string.c.
Key phrases: global buffer overflow
CVE-2021-46514: There is an Assertion 'ppos != NULL && mjs_is_number(*ppos)' failed at src/mjs_core.c in Cesanta MJS v2.20.0.
CVE-2021-46515: There is an Assertion `mjs_stack_size(&mjs->scopes) >= scopes_len' failed at src/mjs_exec.c in Cesanta MJS v2.20.0.
CVE-2021-46516: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_stack_size at mjs/src/mjs_core.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46517: There is an Assertion `mjs_stack_size(&mjs->scopes) > 0' failed at src/mjs_exec.c in Cesanta MJS v2.20.0.
CVE-2021-46518: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_disown at src/mjs_core.c.
Key phrases: heap buffer overflow
CVE-2021-46519: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_array_length at src/mjs_array.c.
Key phrases: heap buffer overflow
CVE-2021-46520: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_jprintf at src/mjs_util.c.
Key phrases: heap buffer overflow
CVE-2021-46521: Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via c_vsnprintf at mjs/src/common/str_util.c.
Key phrases: global buffer overflow
CVE-2021-46522: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0xaff53.
Key phrases: heap buffer overflow
CVE-2021-46523: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via to_json_or_debug at mjs/src/mjs_json.c.
Key phrases: heap buffer overflow
CVE-2021-46524: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via snquote at mjs/src/mjs_json.c.
Key phrases: heap buffer overflow
CVE-2021-46525: Cesanta MJS v2.20.0 was discovered to contain a heap-use-after-free via mjs_apply at src/mjs_exec.c.
Key phrases: heap-use-after-free, use after free
CVE-2021-46526: Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via snquote at src/mjs_json.c.
Key phrases: global buffer overflow
CVE-2021-46527: Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_get_cstring at src/mjs_string.c.
Key phrases: heap buffer overflow
CVE-2021-46528: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x5361e. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46529: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x8814e. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46530: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_execute at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46531: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x8d28e. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46532: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via exec_expr at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46534: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via getprop_builtin_foreign at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46535: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0xe533e. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46537: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x9a30e. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46538: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_compact_strings at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46539: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x45a1f. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46540: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_get_mjs at src/mjs_builtin.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46541: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x2c6ae. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46542: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_print at src/mjs_builtin.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46543: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x18e810. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46544: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x59e19. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46545: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x4b44b. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46546: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_next at src/mjs_object.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46547: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x2c17e. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46548: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via add_lineno_map_item at src/mjs_bcode.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46549: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via parse_cval_type at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46550: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via free_json_frame at src/mjs_json.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46553: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_set_internal at src/mjs_object.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46554: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_json_stringify at src/mjs_json.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46556: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_bcode_insert_offset at src/mjs_bcode.c. This vulnerability can lead to a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), segv, denial of service (dos)
CVE-2021-46557: Vicidial 2.14-783a was discovered to contain a cross-site scripting (XSS) vulnerability via the input tabs.
Key phrases: cross-site scripting (xss)
CVE-2021-46558: Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password fields.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2021-46559: The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.
Key phrases: defeat an inspection mechanism for integrity protection, weak algorithm
CVE-2021-46560: The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage.
Key phrases: device damage, command injection
CVE-2021-46561: controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended access within the context of that new organization.
Key phrases: transfer a user account to an arbitrary new, unintended access
CVE-2021-46562: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14987.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46563: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14990.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46564: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15023.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46565: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15024.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46566: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15027.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46567: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15028.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46568: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15030.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46569: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15031.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46570: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15364.
Key phrases: execute arbitrary code, disclose sensitive information on affected installations of Bentley
CVE-2021-46571: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15365.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46572: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15366.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46573: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15367.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code
CVE-2021-46574: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15368.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of Bentley, execute code