yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-40324: Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Key phrases: allows arbitrary file write operations, arbitrary file write operations via upload_log_data
CVE-2021-40325: Cobbler before 3.3.0 allows authorization bypass for modification of settings.
Key phrases: bypass for modification of settings, authorization bypass, authorization bypass for modification of settings
CVE-2021-40326: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker can write to an arbitrary file, and display controlled contents, during signature verification.
Key phrases: incremental data, controlled contents, arbitrary file
CVE-2021-40327: Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner.
Key phrases: incorrect access control
CVE-2021-40329: The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.
CVE-2021-4033: kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
Key phrases: cross-site request forgery (csrf)
CVE-2021-40330: git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.
Key phrases: contain a newline character, cross-protocol requests
CVE-2021-40331: An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabledThis issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later.
Key phrases: incorrect permission assignment for critical resource
CVE-2021-40333: Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A.
Key phrases: gain unauthorized access, gain unauthorized access to the Data Communication Network, weak password requirements
CVE-2021-40334: Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker that exploits the vulnerability by activating SSH on port TCP 5558 to cause disruption to the NMS and NE communication. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A.
Key phrases: cause disruption to the NMS and NE communication, missing handler
CVE-2021-40335: A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery (CSRF), which if exploited could lead an attacker to gain unauthorized access to the web application and perform an unwanted operation on it without the knowledge of the legitimate user. An attacker, who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., link is sent per E-Mail, could perform harmful command on MSM through its web server interface. This issue affects: Hitachi Energy MSM V2.2 and prior versions.
Key phrases: gain unauthorized access, cross site request forgery (csrf), harmful command
CVE-2021-40336: A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the users web browser, such as to steal the session cookies. Thus, an attacker who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., the link is sent per E-Mail, could trick the user into downloading malicious software onto his computer. This issue affects: Hitachi Energy MSM V2.2 and prior versions.
Key phrases: http response splitting
CVE-2021-40337: Cross-site Scripting (XSS) vulnerability in Hitachi Energy LinkOne allows an attacker that manages to exploit the vulnerability can take advantage to exploit multiple web attacks and stole sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
Key phrases: exploit the vulnerability can take advantage to exploit, cross-site scripting (xss), sensitive information
CVE-2021-40338: Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
Key phrases: web server misconfiguration
CVE-2021-40339: Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerability to retrieve sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
Key phrases: exploit this vulnerability to retrieve sensitive information, configuration
CVE-2021-4034: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Key phrases: execute arbitrary code, run commands as privileged users according predefined policies, local privilege escalation
CVE-2021-40340: Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, an attacker that manages to exploit this vulnerability can use the exposed information as a reconnaissance for further exploitation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
Key phrases: information exposure
CVE-2021-40341: DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily.This issue affects  *  FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C;  *  UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C.List of CPEs:  *  cpe:2.3:a:hitachienergy:foxman-un:R16A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R16A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*
Key phrases: be decrypted easily, exploitation, inadequate encryption strength, sensitive information
CVE-2021-40342: In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions.This issue affects   *  FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C;   *  UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C.List of CPEs:   *  cpe:2.3:a:hitachienergy:foxman-un:R16A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R16A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:*  *  cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*
Key phrases: obtain sensitive information, gain access, obtain sensitive information and gain access to the, exploitation
CVE-2021-40343: An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the root user.
Key phrases: elevate their privileges to the root user, insecure file permissions, elevate privileges
CVE-2021-40344: An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.
Key phrases: remote command execution
CVE-2021-40345: An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.
Key phrases: execute system commands, command injection
CVE-2021-40346: An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
Key phrases: bypass all configured http-request HAProxy ACLs, integer overflow, http request smuggling
CVE-2021-40347: An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.
CVE-2021-40348: Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.
Key phrases: append arbitrary code, append Spacewalk-specific key-value pair, code injection
CVE-2021-40349: e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal attack that results in information disclosure via the "GET /.." substring.
Key phrases: a path-traversal attack that results in, information disclosure, path traversal
CVE-2021-4035: A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.
Key phrases: stored cross site scripting, cross-site scripting
CVE-2021-40350: webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafted query containing an unspecified Cookie header. Authentication bypass can be achieved by including an administrative cookie that the device does not validate.
Key phrases: bypass can be achieved by including an administrative cookie, Authentication bypass, perform any desired action via a crafted query, authentication bypass, unspecified
CVE-2021-40352: OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.
Key phrases: insecure direct object reference
CVE-2021-40353: A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637.
Key phrases: sql injection
CVE-2021-40354: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The "surrogate" functionality on the user profile of the application does not perform sufficient access control that could lead to an account takeover. Any profile on the application can perform this attack and access any other user assigned tasks via the "inbox/surrogate tasks".
CVE-2021-40355: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The affected application contains Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to use user-supplied input to access objects directly.
Key phrases: use user-supplied input to access objects, insecure direct object reference (idor)
CVE-2021-40356: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.
Key phrases: view files on the application server filesystem, xml external entity injection (xxe)
CVE-2021-40357: A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.10), Teamcenter Active Workspace V5.0 (All versions < V5.0.8), Teamcenter Active Workspace V5.1 (All versions < V5.1.5), Teamcenter Active Workspace V5.2 (All versions < V5.2.1). A path traversal vulnerability in the application could allow an attacker to bypass certain restrictions such as direct access to other services within the host.
Key phrases: bypass certain restrictions, bypass certain restrictions such as direct access to, path traversal
CVE-2021-40358: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). Legitimate file operations on the web server of the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read, write or delete unexpected critical files.
CVE-2021-40359: A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V8.2 (All versions), SIMATIC BATCH V9.0 (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Update 6), SIMATIC NET PC Software V17 (All versions < V17 SP1), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files.
CVE-2021-40360: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The password hash of a local user account in the remote server could be granted via public API to a user on the affected system. An authenticated attacker could brute force the password hash and use it to login to the server.
CVE-2021-40363: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Update 4), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The affected component stores the credentials of a local system account in a potentially publicly accessible project file using an outdated cipher algorithm. An attacker may use this to brute force the credentials and take over the system.
Key phrases: brute force
CVE-2021-40364: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system.
Key phrases: sensitive information, sensitive information log file
CVE-2021-40365: Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device.
Key phrases: cause a denial of service in the device
CVE-2021-40366: A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.
Key phrases: read sensitive data, man-in-the-middle position, man in the middle
CVE-2021-40367: A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing DICOM files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15097)
Key phrases: out-of-bounds write, out of bounds write, execute code
CVE-2021-40368: A vulnerability has been identified in  SIMATIC S7-400 CPU 412-1 DP V7 (All versions),  SIMATIC S7-400 CPU 412-2 DP V7 (All versions),  SIMATIC S7-400 CPU 412-2 PN/DP V7 (All versions < V7.0.3),  SIMATIC S7-400 CPU 414-2 DP V7 (All versions),  SIMATIC S7-400 CPU 414-3 DP V7 (All versions),  SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3),  SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3),  SIMATIC S7-400 CPU 416-2 DP V7 (All versions),  SIMATIC S7-400 CPU 416-3 DP V7 (All versions),  SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3),  SIMATIC S7-400 CPU 416F-2 DP V7 (All versions),  SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions < V7.0.3),  SIMATIC S7-400 CPU 417-4 DP V7 (All versions), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (All versions < V6.0.10), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) (All versions < V10.1), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions < V8.2.3), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 V7 (All versions), SIPLUS S7-400 CPU 417-4 V7 (All versions). Affected devices improperly handle specially crafted packets sent to port 102/tcp.This could allow an attacker to create a Denial-of-Service condition. A restart is needed to restore normal operations.
Key phrases: create a Denial-of-Service condition
CVE-2021-40369: A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.
Key phrases: execute javascript in the victim's browser and, xss, sensitive information
CVE-2021-4037: A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.
Key phrases: create files for the XFS file-system
CVE-2021-40371: Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\\\\\\\\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap.
Key phrases: ServiceManagerTenant/GetVisibilityMap, directory traversal, remote code execution
CVE-2021-40373: playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via the index.php?app=main&inc=core_welcome URI.
Key phrases: allows Arbitrary Code Execution, Arbitrary Code Execution by entering PHP code at, arbitrary code execution, execute code
CVE-2021-40374: A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which could be used in a XSS attack.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, stored cross-site scripting (xss)
CVE-2021-40375: Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This response can be read in an intercepting proxy or by viewing the page source. Sensitive information returned in responses includes patient PII and medication records or history.
Key phrases: view the sensitive information of patients without having, intercepting proxy
CVE-2021-40376: otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attack may be possible as well, by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000.
Key phrases: achieve SYSTEM access via unauthenticated calls to exposed, system access, exposed interfaces, wshttpbinding
CVE-2021-40377: SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application.
Key phrases: inject HTML and/or JavaScript into a page that, xss
CVE-2021-40378: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killps.cgi deletes all data from the device.
Key phrases: deletes all data
CVE-2021-40379: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 does not require authorization.
CVE-2021-4038: Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in all scenarios.
Key phrases: embed a XSS in the administrator interface via, cross site scripting (xss)
CVE-2021-40380: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose credentials.
Key phrases: credentials
CVE-2021-40381: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access.
Key phrases: video access
CVE-2021-40382: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allows video screenshot access.
Key phrases: video screenshot access
CVE-2021-40385: An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is a privilege escalation from read-only user to admin.
Key phrases: privilege escalation
CVE-2021-40386: Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code.
Key phrases: execute arbitrary code
CVE-2021-40387: An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authenticated remote code execution.
Key phrases: remote code execution
CVE-2021-40388: A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: privilege escalation, escalate privilege
CVE-2021-40389: A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: privilege escalation, escalate privilege
CVE-2021-4039: A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands on the device, command injection, arbitrary os command
CVE-2021-40390: An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP request can lead to unauthorized access. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: authentication bypass, unauthorized access
CVE-2021-40391: An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: out-of-bounds write, code execution, malicious file, out of bounds write
CVE-2021-40392: An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to exploit this vulnerability.
Key phrases: information disclosure, sensitive information
CVE-2021-40393: An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit 71493260). A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: out-of-bounds write, code execution, malicious file, out of bounds write
CVE-2021-40394: An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit 71493260). A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: out-of-bounds write, code execution, malicious file, out of bounds write
CVE-2021-40396: A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: privilege escalation, escalate privilege
CVE-2021-40397: A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: privilege escalation, escalate privilege
CVE-2021-40398: An out-of-bounds write vulnerability exists in the parse_raster_data functionality of Accusoft ImageGear 19.10. A specially-crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: out-of-bounds write, memory corruption, malicious file, out of bounds write
CVE-2021-40399: An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351. A specially-crafted XLS file can cause a use-after-free condition, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
Key phrases: exploitable use-after-free, use-after-free condition, remote code execution, use after free
CVE-2021-4040: A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.
Key phrases: partially disrupt availability to the broker through a, partial interruption, sustained
CVE-2021-40400: An out-of-bounds read vulnerability exists in the RS-274X aperture macro outline primitive functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit d7f42a9a). A specially-crafted Gerber file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: out-of-bounds read, information disclosure, malicious file, out of bounds read
CVE-2021-40401: A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: use-after-free, code execution, malicious file, use after free
CVE-2021-40402: An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.7.1 and 2.8.0. A specially-crafted Gerber file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: out-of-bounds read, information disclosure, malicious file, out of bounds read
CVE-2021-40403: An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: information disclosure, leak memory contents, malicious file
CVE-2021-40404: An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: authentication bypass
CVE-2021-40405: A denial of service vulnerability exists in the cgiserver.cgi Upgrade API functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: denial of service, reboot
CVE-2021-40406: A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to prevent users from logging in. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: denial of service
CVE-2021-40407: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: os command injection
CVE-2021-40408: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->username variable, that has the value of the userName parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection.
Key phrases: os command injection
CVE-2021-40409: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->password variable, that has the value of the password parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection.
Key phrases: os command injection
CVE-2021-4041: A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.
CVE-2021-40410: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [4] the dns_data->dns1 variable, that has the value of the dns1 parameter provided through the SetLocal API, is not validated properly. This would lead to an OS command injection.
Key phrases: os command injection
CVE-2021-40411: An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [6] the dns_data->dns2 variable, that has the value of the dns2 parameter provided through the SetLocalLink API, is not validated properly. This would lead to an OS command injection.
Key phrases: os command injection
CVE-2021-40412: An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [8] the devname variable, that has the value of the name parameter provided through the SetDevName API, is not validated properly. This would lead to an OS command injection.
Key phrases: oscommand injection, os command injection
CVE-2021-40413: An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be possible, allegedly, to later on perform the Upgrade. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: default permission
CVE-2021-40414: An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The SetMdAlarm API sets the movement detection parameters, giving the ability to set the sensitivity of the camera per a range of hours, and which of the camera spaces to ignore when considering movement detection. Because in cgi_check_ability the SetMdAlarm API does not have a specific case, the user permission will default to 7. This will give non-administrative users the possibility to change the movement detection parameters.
Key phrases: default permission
CVE-2021-40415: An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check_ability the Format API does not have a specific case, the user permission will default to 7. This will give non-administrative users the possibility to format the SD card and reboot the device.
Key phrases: default permission, reboot
CVE-2021-40416: An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get APIs that are not included in cgi_check_ability are already executable by any logged-in users. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: default permission
CVE-2021-40417: When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that were submitted with the job along with fields that were parsed for the submitted video by the R3D SDK to calculate the size of a heap buffer. Due to an integer overflow with regards to this calculation, this can result in an undersized heap buffer being allocated. When this heap buffer is written to, a heap-based buffer overflow will occur. This can result in code execution under the context of the application.
Key phrases: integer overflow, heap-based buffer overflow, code execution, heap based buffer overflow
CVE-2021-40418: When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID that was parsed from a frame within the video container. Upon destruction of the object that owns it, the uninitialized member will be dereferenced and then destroyed using the object’s virtual destructor. Due to the object property being uninitialized, this can result in dereferencing an arbitrary pointer for the object’s virtual method table, which can result in code execution under the context of the application.
Key phrases: arbitrary pointer, code execution
CVE-2021-40419: A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of network requests can lead to arbitrary firmware update. An attacker can send a sequence of requests to trigger this vulnerability.
Key phrases: firmware update
CVE-2021-40420: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Key phrases: use-after-free, arbitrary code execution, exploitation, use after free
CVE-2021-40422: An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.
Key phrases: authentication bypass, remote code execution
CVE-2021-40423: A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of HTTP requests can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: denial of service
CVE-2021-40424: An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted executable can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability. An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. The GetProcessCommandLine IOCTL request could cause an out-of-bounds read in the device driver WRCore_x64. An attacker can issue an ioctl to trigger this vulnerability.
Key phrases: out-of-bounds read, denial of service, out of bounds read
CVE-2021-40425: An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted executable can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability. An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. An IOCTL_B03 request with specific invalid data causes a similar issue in the device driver WRCore_x64. An attacker can issue an ioctl to trigger this vulnerability.
Key phrases: out-of-bounds read, denial of service, out of bounds read
CVE-2021-40426: A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: heap-based buffer overflow, heap buffer overflow, malicious file, heap based buffer overflow
CVE-2021-4043: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.
Key phrases: null pointer dereference
CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-40439: Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.
Key phrases: denial of service
CVE-2021-4044: Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).
Key phrases: crash, infinite loop
CVE-2021-40440: Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2021-40441: Windows Media Center Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-40442: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2021-40443: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability
Key phrases: mshtml remote code execution
CVE-2021-40447: Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-38667, CVE-2021-38671.
Key phrases: windows print spooler elevation of privilege
CVE-2021-40448: Microsoft Accessibility Insights for Android Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-40449: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-4045: TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.
Key phrases: take full control of the camera, rce
CVE-2021-40450: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-40452: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-40453: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-40454: Rich Text Edit Control Information Disclosure Vulnerability
Key phrases: information disclosure