yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-40455: Windows Installer Spoofing Vulnerability
Key phrases: windows installer spoofing
CVE-2021-40456: Windows AD FS Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows ad fs security feature bypass
CVE-2021-40457: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
Key phrases: customer engagement cross-site scripting
CVE-2021-4046: The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking or theft of sensitive data.
Key phrases: perform persistent XSS attacks
CVE-2021-40460: Windows Remote Procedure Call Runtime Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows remote procedure call runtime security feature bypass
CVE-2021-40461: Windows Hyper-V Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-40462: Windows Media Foundation Dolby Digital Atmos Decoders Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-40463: Windows Network Address Translation (NAT) Denial of Service Vulnerability
Key phrases: windows network address translation (nat), denial of service
CVE-2021-40464: Windows Nearby Sharing Elevation of Privilege Vulnerability
Key phrases: windows nearby sharing elevation of privilege
CVE-2021-40465: Windows Text Shaping Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-40466: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2021-40467: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2021-40468: Windows Bind Filter Driver Information Disclosure Vulnerability
Key phrases: windows bind filter driver information disclosure
CVE-2021-40469: Windows DNS Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-4047: The release of OpenShift 4.9.6 included four CVE fixes for the haproxy package, however the patch for CVE-2021-39242 was missing. This issue only affects Red Hat OpenShift 4.9.
CVE-2021-40470: DirectX Graphics Kernel Elevation of Privilege Vulnerability
Key phrases: directx graphics kernel elevation of privilege
CVE-2021-40471: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2021-40472: Microsoft Excel Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-40473: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2021-40474: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2021-40475: Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
Key phrases: driver information disclosure
CVE-2021-40476: Windows AppContainer Elevation Of Privilege Vulnerability
Key phrases: windows appcontainer elevation of privilege
CVE-2021-40477: Windows Event Tracing Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-40478: Storage Spaces Controller Elevation of Privilege Vulnerability
Key phrases: storage spaces controller elevation of privilege
CVE-2021-40479: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2021-4048: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Key phrases: out-of-bounds read flaw, crash, disclose portions of its memory, out of bounds read
CVE-2021-40480: Microsoft Office Visio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-40481: Microsoft Office Visio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-40482: Microsoft SharePoint Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-40483: Microsoft SharePoint Server Spoofing Vulnerability
Key phrases: microsoft sharepoint server spoofing
CVE-2021-40484: Microsoft SharePoint Server Spoofing Vulnerability
Key phrases: microsoft sharepoint server spoofing
CVE-2021-40485: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2021-40486: Microsoft Word Remote Code Execution Vulnerability
Key phrases: microsoft word remote code execution
CVE-2021-40487: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-40488: Storage Spaces Controller Elevation of Privilege Vulnerability
Key phrases: storage spaces controller elevation of privilege
CVE-2021-40489: Storage Spaces Controller Elevation of Privilege Vulnerability
Key phrases: storage spaces controller elevation of privilege
CVE-2021-4049: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Key phrases: cross-site request forgery (csrf)
CVE-2021-40490: A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.
Key phrases: race condition
CVE-2021-40491: The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.
CVE-2021-40492: A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php).
Key phrases: index.php), xss
CVE-2021-40493: Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.
Key phrases: sql injection
CVE-2021-40494: A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.
Key phrases: gain admin access, gain admin access to the host system, hardcoded jwt secret key
CVE-2021-40495: There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755. An unauthorized attacker can use the public SICF service /sap/public/bc/abap to reduce the performance of SAP NetWeaver Application Server ABAP and ABAP Platform.
Key phrases: denial-of service, reduce the performance
CVE-2021-40496: SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request and exposing sensitive data. This vulnerability is normally exposed over the network and successful exploitation can lead to exposure of data like system details.
Key phrases: exploit the authentication function by using POST and, exposure of data like system details
CVE-2021-40497: SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation could lead to exposure of some system specific data like its version.
Key phrases: exploit certain application endpoints to read sensitive data
CVE-2021-40498: A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is related to Android implementation methods that are widely used across Android mobile applications, and such methods are embedded into the SAP SuccessFactors mobile application. These Android methods begin executing once the user accesses their profile on the mobile application. While executing, it can also pick up the activities from other Android applications that are running in the background of the users device and are using the same types of methods in the application. Such vulnerability can also lead to phishing attacks that can be used for staging other types of attacks.
Key phrases: prevent legitimate users from accessing a service, denial of service, phishing, crash
CVE-2021-40499: Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
Key phrases: inject code that can be executed by the, behavior
CVE-2021-4050: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2021-40500: SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can enable the attacker to retrieve arbitrary files from the server.
Key phrases: retrieve arbitrary files, exploit missing XML validations at endpoints to read, xml validations
CVE-2021-40501: SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the vulnerable system. However, the attacker can neither significantly reduce the performance of the system nor stop the system.
Key phrases: escalation of privileges, vulnerable system, performance of the system, stop the system, escalation privilege
CVE-2021-40502: SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to.
Key phrases: escalation of privileges, escalation privilege
CVE-2021-40503: An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user.
Key phrases: obtain an equivalent of the user’s password, information disclosure, data leak
CVE-2021-40504: A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions.
Key phrases: transport authorizations
CVE-2021-40506: An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated for the msb and mac instructions, which results in an incorrect value in the overflow flag. Any software that relies on this flag may experience corruption in execution.
Key phrases: overflow flag, corruption
CVE-2021-40507: An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated correctly for the subtract instruction, which results in an incorrect value in the overflow flag. Any software that relies on this flag may experience corruption in execution.
Key phrases: overflow flag, corruption
CVE-2021-40509: ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature.
Key phrases: XSS via a user signature, xss
CVE-2021-40510: XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.
Key phrases: read system files via custom DTDs, xml external entity (xxe)
CVE-2021-40511: OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service.
Key phrases: denial of service, xml entity expansion
CVE-2021-40516: WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.
Key phrases: denial of service (crash), cause a denial of service (crash), out-of-bounds read, out of bounds read
CVE-2021-40517: Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting. XSS Payload is placed in the name column of the updates table using database access.
Key phrases: stored cross site scripting, xss payload
CVE-2021-40518: Airangel HSMX Gateway devices through 5.2.04 allow CSRF.
Key phrases: CSRF, csrf
CVE-2021-40519: Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials.
Key phrases: hard-coded database credentials
CVE-2021-4052: Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
Key phrases: use after free, heap corruption, convince
CVE-2021-40520: Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials.
Key phrases: weak ssh credentials
CVE-2021-40521: Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution.
Key phrases: Remote Code Execution, remote code execution
CVE-2021-40523: In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of service. Specifically, a server sometimes sends no response, because a fixed buffer space is available for all responses and that space may have been exhausted.
Key phrases: property violations, denial of service
CVE-2021-40524: In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)
Key phrases: upload files of unbounded size, denial of service, hang
CVE-2021-40525: Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.
Key phrases: reading and writing any file, path traversal, not impacted, to write files
CVE-2021-40526: Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling the Apple GymKit communication. This can lead to an Apple MFI device not being able to authenticate with the Peleton Bike
Key phrases: trigger a Denial of Service attack through the, buffer size, denial of service, heap overflow
CVE-2021-40527: Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application.
Key phrases: access developer files stored in an AWS S3, exposure of senstive information
CVE-2021-40528: The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
Key phrases: a cross-configuration attack against OpenPGP, plaintext recovery
CVE-2021-40529: The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
Key phrases: a cross-configuration attack against OpenPGP, plaintext recovery
CVE-2021-4053: Use after free in UI in Google Chrome on Linux prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2021-40530: The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
Key phrases: a cross-configuration attack against OpenPGP, plaintext recovery
CVE-2021-40531: Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app.
Key phrases: bypass file quarantine, be used to bypass file quarantine, remote code execution
CVE-2021-40532: Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.
CVE-2021-40537: Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary for exploitation.
Key phrases: server side request forgery (ssrf), exploitation
CVE-2021-40539: Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Key phrases: bypass with resultant remote code execution, authentication bypass, rest api authentication bypass
CVE-2021-4054: Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
Key phrases: spoofing
CVE-2021-40540: ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.
Key phrases: malformed http requests
CVE-2021-40541: PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can trigger XSS by appending "//" in the end of text.
Key phrases: xss)
CVE-2021-40542: Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). An unauthenticated user can inject and execute JavaScript code through the link_url parameter in Ajax_url_encode.php.
Key phrases: cross-site scripting (xss)
CVE-2021-40543: Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET['prof_id'] in the PasswordCheck.php file.
Key phrases: sql injection
CVE-2021-40546: Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device crash) via a long string in the wifiPwd_5G parameter to /goform/setWifi.
Key phrases: denial of service (device crash), cause a denial of service (device crash
CVE-2021-4055: Heap buffer overflow in extensions in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
Key phrases: heap buffer overflow, heap corruption, convince
CVE-2021-40553: piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.
Key phrases: remote code execution (rce)
CVE-2021-40555: Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form.
Key phrases: execute arbitrary code, execute arbitrary code via description field on the, cross site scripting (xss)
CVE-2021-40556: A stack overflow vulnerability exists in the httpd service in ASUS RT-AX56U Router Version 3.0.0.4.386.44266. This vulnerability is caused by the strcat function called by "caupload" input handle function allowing the user to enter 0xFFFF bytes into the stack. This vulnerability allows an attacker to execute commands remotely. The vulnerability requires authentication.
Key phrases: enter 0xFFFF bytes into the stack, execute commands remotely, stack overflow
CVE-2021-40559: A null pointer deference vulnerability exists in gpac through 1.0.1 via the naludmx_parse_nal_avc function in reframe_nalu, which allows a denail of service.
Key phrases: a denail of service, null pointer deference
CVE-2021-4056: Type confusion in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: type confusion, heap corruption
CVE-2021-40562: A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enqueue_or_dispatch function in reframe_nalu.c, which causes a denial of service.
Key phrases: denial of service
CVE-2021-40563: A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx_create_avc_decoder_config function in reframe_nalu.c when using mp4box, which causes a denial of service.
Key phrases: segmentation fault, null pointer dereference, denial of service
CVE-2021-40564: A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc_parse_slice function in av_parsers.c when using mp4box, which causes a denial of service.
Key phrases: null pointer dereference, denial of service
CVE-2021-40565: A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf_avc_parse_nalu function in av_parsers.c when using mp4box, which causes a denial of service.
Key phrases: null pointer dereference, denial of service
CVE-2021-40566: A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_mpgvid.c when using mp4box, which causes a denial of service.
Key phrases: heap use after free, denial of service
CVE-2021-40567: Segmentation fault vulnerability exists in Gpac through 1.0.1 via the gf_odf_size_descriptor function in desc_private.c when using mp4box, which causes a denial of service.
Key phrases: segmentation fault, denial of service
CVE-2021-40568: A buffer overflow vulnerability exists in Gpac through 1.0.1 via a malformed MP4 file in the svc_parse_slice function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Key phrases: cause a denial of service, buffer overflow, code execution, escalation of privileges, escalation privilege
CVE-2021-40569: The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta.c, which allows attackers to cause a denial of service.
Key phrases: cause a denial of service, double-free, double free
CVE-2021-4057: Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free in file api, heap corruption
CVE-2021-40570: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Key phrases: cause a denial of service, double-free, code execution, escalation of privileges, double free, escalation privilege
CVE-2021-40571: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Key phrases: cause a denial of service, double-free, code execution, escalation of privileges, double free, escalation privilege
CVE-2021-40572: The binary MP4Box in Gpac 1.0.1 has a double-free bug in the av1dmx_finalize function in reframe_av1.c, which allows attackers to cause a denial of service.
Key phrases: cause a denial of service, double-free bug, double free
CVE-2021-40573: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_list_del function in list.c, which allows attackers to cause a denial of service.
Key phrases: cause a denial of service, double-free, double free
CVE-2021-40574: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Key phrases: cause a denial of service, double-free, code execution, escalation of privileges, double free, escalation privilege
CVE-2021-40575: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in reframe_mpgvid.c, which allows attackers to cause a denial of service. This vulnerability is possibly due to an incomplete fix for CVE-2021-40566.
Key phrases: cause a denial of service, null pointer dereference
CVE-2021-40576: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.
Key phrases: cause a denial of service, null pointer dereference
CVE-2021-40577: A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 in the Add-Users page via the Name parameter.
Key phrases: stored cross site scripting (xss)
CVE-2021-40578: Authenticated Blind & Error-based SQL injection vulnerability was discovered in Online Enrollment Management System in PHP and PayPal Free Source Code 1.0, that allows attackers to obtain sensitive information and execute arbitrary SQL commands via IDNO parameter.
Key phrases: execute arbitrary SQL commands, obtain sensitive information, obtain sensitive information and execute arbitrary SQL commands, authenticated blind & error-based sql injection, arbitrary sql commands
CVE-2021-40579: https://www.sourcecodester.com/ Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 is affected by: Incorrect Access Control. The impact is: gain privileges (remote).
Key phrases: gain privileges, incorrect access control
CVE-2021-4058: Heap buffer overflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: heap buffer overflow, heap corruption
CVE-2021-40589: ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fileheader.bfOffBits.
Key phrases: integer underflow
CVE-2021-4059: Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Key phrases: insufficient data validation, cross-origin data
CVE-2021-40592: GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vulnerability in ISOBMFF reader filter, isoffin_read.c. Function isoffin_process() can result in DoS by infinite loop. To exploit, the victim must open a specially crafted mp4 file.
Key phrases: loop with unreachable exit condition, dos, infinite loop
CVE-2021-40595: SQL injection vulnerability in Sourcecodester Online Leave Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username parameter to /leave_system/classes/Login.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the username parameter, sql injection
CVE-2021-40596: SQL injection vulnerability in Login.php in sourcecodester Online Learning System v2 by oretnom23, allows attackers to execute arbitrary SQL commands via the faculty_id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the faculty_id parameter, sql injection
CVE-2021-40597: The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.
Key phrases: hardcoded
CVE-2021-40604: A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.
Key phrases: request arbitrary URLs, request arbitrary URLs or trigger deserialization via phar, server-side request forgery (ssrf), exploitation
CVE-2021-40606: The gf_bs_write_data function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
Key phrases: cause a denial of service via a crafted
CVE-2021-40607: The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
Key phrases: cause a denial of service via a crafted
CVE-2021-40608: The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
Key phrases: cause a denial of service via a crafted
CVE-2021-40609: The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
Key phrases: cause a denial of service via a crafted
CVE-2021-4061: Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: type confusion, heap corruption
CVE-2021-40610: Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.
Key phrases: cross-site scripting (xss)
CVE-2021-40612: An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an attacker perform command execution without echoes.
Key phrases: an attacker perform command execution without echoes
CVE-2021-40616: thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority is required.
Key phrases: unauthorized
CVE-2021-40617: An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php.
Key phrases: sql injection
CVE-2021-40618: An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in HoldAddressFields.php.
Key phrases: sql injection
CVE-2021-4062: Heap buffer overflow in BFCache in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Key phrases: heap buffer overflow, heap corruption
CVE-2021-4063: Use after free in developer tools in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2021-40633: A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.
Key phrases: remote attackers trigger an out of memory exception, memory leak, denial of service, leak memory
CVE-2021-40635: OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php. An attacker can inject a SQL query to extract information from the database.
Key phrases: sql injection
CVE-2021-40636: OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database.
Key phrases: sql injection
CVE-2021-40637: OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php. An attacker can inject JavaScript code to get the user's cookie and take over the working session of user.
Key phrases: cross-site scripting (xss)
CVE-2021-40639: Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.
Key phrases: access sensitive information via /classes/conf/, improper access control
CVE-2021-4064: Use after free in screen capture in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2021-40642: Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.
Key phrases: sensitive cookie in https session without secure attribute
CVE-2021-40643: EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application in the "cacti" configuration page (by default/usr/sbin/sendmail) it is possible to execute any command, which will be executed when we make a test of the configuration ("send test mail").
Key phrases: remote code execution, execute commands
CVE-2021-40644: An SQL Injection vulnerability exists in oasys oa_system as of 9/7/2021 in resources/mappers/notice-mapper.xml.
Key phrases: sql injection
CVE-2021-40645: An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController.
Key phrases: sql injection
CVE-2021-40647: In man2html 1.6g, a specific string being read in from a file will overwrite the size parameter in the top chunk of the heap. This at least causes the program to segmentation abort if the heap size parameter isn't aligned correctly. In version before GLIBC version 2.29 and aligned correctly, it allows arbitrary write anywhere in the programs memory.
Key phrases: allows arbitrary write, arbitrary write anywhere in the programs memory
CVE-2021-40648: In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fd_nextsize, bk_nextsize of the current chunk. The next chunk is then freed later on, causing a freeing of an arbitrary amount of memory.
Key phrases: arbitrary amount of memory
CVE-2021-40649: In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set.
CVE-2021-4065: Use after free in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2021-40650: In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set.
Key phrases: cookie
CVE-2021-40651: OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.
Key phrases: disclose arbitrary file, local file inclusion
CVE-2021-40654: An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
Key phrases: obtain a user name and password, information disclosure issue
CVE-2021-40655: An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
Key phrases: obtain a user name and password, informtion disclosure issue
CVE-2021-40656: libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867.
Key phrases: buffer overflow
CVE-2021-40658: Textpattern 4.8.7 is affected by a HTML injection vulnerability through Content>Write>Body.
Key phrases: html injection
CVE-2021-4066: Integer underflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: integer underflow, heap corruption
CVE-2021-40660: An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
Key phrases: denial of service (DoS), redos, denial of service (dos)
CVE-2021-40661: A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). It was possible to traverse the folders of the affected host by providing a traversal path to the 'webpage' parameter in AutoCE.ini This could allow a remote unauthenticated adversary to access additional files on the affected system. This could also allow the adversary to perform further enumeration against the affected host to identify the versions of the systems in use, in order to launch further attacks in future.
Key phrases: access additional files on the affected system, perform further enumeration against the affected host to, directory traversal
CVE-2021-40662: A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interaction with a crafted URL.
Key phrases: execute arbitrary commands, execute arbitrary commands on victim hosts via user, cross-site request forgery (csrf)
CVE-2021-40663: deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
Key phrases: improperly controlled modification of object prototype attributes, prototype pollution
CVE-2021-40668: The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulnerability that permits arbitrary directory listing, file read, and file write.
Key phrases: permits arbitrary directory listing, path traversal, file read, file write
CVE-2021-40669: SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file.
Key phrases: sql injection
CVE-2021-4067: Use after free in window manager in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2021-40670: SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file.
Key phrases: sql injection
CVE-2021-40674: An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.php.
Key phrases: sql injection
CVE-2021-40678: In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit.
Key phrases: persistent cross-site scripting
CVE-2021-4068: Insufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Key phrases: insufficient data validation, cross-origin data
CVE-2021-40680: There is a Directory Traversal vulnerability in Artica Proxy (4.30.000000 SP206 through SP255, and VMware appliance 4.30.000000 through SP273) via the filename parameter to /cgi-bin/main.cgi.
Key phrases: directory traversal
CVE-2021-40683: In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution.
Key phrases: hijack the flow of execution, unquoted path
CVE-2021-40684: Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running in the container.
Key phrases: the JMX of the runtime container, read or modify the container or software running, unauthenticated jolokia http endpoint
CVE-2021-4069: vim is vulnerable to Use After Free
Key phrases: use after free
CVE-2021-40690: All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Key phrases: abuse an XPath Transform to extract any local, xpath transform
CVE-2021-40691: A session hijack risk was identified in the Shibboleth authentication plugin.
Key phrases: session hijack risk
CVE-2021-40692: Insufficient capability checks made it possible for teachers to download users outside of their courses.
Key phrases: insufficient capability checks
CVE-2021-40693: An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
Key phrases: bypass risk was identified in the external database authentication functionality, authentication bypass, authentication bypass risk, type juggling
CVE-2021-40694: Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
Key phrases: insufficient escaping
CVE-2021-40695: It was possible for a student to view their quiz grade before it had been released, using a quiz web service.
CVE-2021-40697: Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2021-40698: ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass??. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment. 
Key phrases: manipulate arbitrary data, bypass??. An authenticated attacker could leverage, security feature bypass, use of inherently dangerous function, feature bypass,
CVE-2021-40699: ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment. 
Key phrases: manipulate arbitrary data, access control, improper access control
CVE-2021-4070: Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.
Key phrases: off-by-one error
CVE-2021-40700: Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
Key phrases: memory corruption, arbitrary code execution
CVE-2021-40701: Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious m4a file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
Key phrases: memory corruption, arbitrary code execution
CVE-2021-40702: Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious psd file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
Key phrases: memory corruption, arbitrary code execution
CVE-2021-40703: Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious m4a file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
Key phrases: memory corruption, arbitrary code execution
CVE-2021-40708: Adobe Genuine Service versions 7.3 (and earlier) are affected by a privilege escalation vulnerability in the AGSService installer. An authenticated attacker could leverage this vulnerability to achieve read / write privileges to execute arbitrary code. User interaction is required to abuse this vulnerability.
Key phrases: execute arbitrary code, privilege escalation
CVE-2021-40709: Adobe Photoshop versions 21.2.11 (and earlier) and 22.5 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted SVG file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: achieve arbitrary code execution, buffer overflow
CVE-2021-40710: Adobe Premiere Pro version 15.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .svg file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
Key phrases: memory corruption, arbitrary code execution
CVE-2021-40711: Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a stored XSS vulnerability when creating Content Fragments. An authenticated attacker can send a malformed POST request to achieve arbitrary code execution. Malicious JavaScript may be executed in a victims browser when they browse to the page containing the vulnerable field.
Key phrases: achieve arbitrary code execution, stored xss
CVE-2021-40712: Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper input validation vulnerability via the path parameter. An authenticated attacker can send a malformed POST request to achieve server-side denial of service.
Key phrases: improper input validation, server-side denial of service