yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-26965: A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.
Key phrases: obtain and modify sensitive information, conduct SQL injection attacks against the AirWave instance, remote authenticated sql injection
CVE-2021-26966: A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.
Key phrases: obtain and modify sensitive information, conduct SQL injection attacks against the AirWave instance, remote authenticated sql injection
CVE-2021-26967: A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of certain components of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victims browser in the context of the AirWave management interface.
Key phrases: execute arbitrary script code, conduct a reflected cross-site scripting (, execute arbitrary script code in a victims browser, remote reflected cross-site scripting (xss)
CVE-2021-26968: A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victims browser in the context of the affected interface.
Key phrases: execute arbitrary script code, conduct a stored cross-site scripting (, execute arbitrary script code in a victims browser, remote authenticated stored cross-site scripting (xss)
CVE-2021-26969: A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Due to improper restrictions on XML entities a vulnerability exists in the web-based management interface of AirWave. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.
Key phrases: retrieve files from the local system or cause, remote authenticated authenticated xml external entity (xxe), denial of service condition
CVE-2021-26970: A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system leading to partial system compromise.
Key phrases: authenticated arbitrary command execution vulnerability, run arbitrary commands on the underlying host, execute arbitrary commands as a lower privileged user, remote authenticated arbitrary command execution, partial system compromise
CVE-2021-26971: A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system leading to partial system compromise.
Key phrases: authenticated arbitrary command execution vulnerability, run arbitrary commands on the underlying host, execute arbitrary commands as a lower privileged user, remote authenticated arbitrary command execution, partial system compromise
CVE-2021-26987: Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.
Key phrases: remote code execution
CVE-2021-26988: Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to discover information related to converting a 7-Mode directory to Cluster-mode such as Storage Virtual Machine (SVM) names, volume names, directory paths and Job IDs.
Key phrases: discover information related to converting a 7-
CVE-2021-26989: Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which could allow a remote authenticated attacker to cause a Denial of Service (DoS) on clustered Data ONTAP configured for SMB access.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2021-26990: Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files.
Key phrases: overwrite arbitrary system files
CVE-2021-26991: Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing (CORS) policy which could allow a remote attacker to interact with Cloud Manager.
Key phrases: interact with Cloud Manager, insecure cross-origin resource sharing (cors) policy
CVE-2021-26992: Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability which could allow a remote attacker to cause a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2021-26993: E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to cause a partial Denial of Service (DoS) to the web server.
Key phrases: Denial of Service (DoS), cause a partial Denial of Service (DoS, denial of service (dos)
CVE-2021-26994: Clustered Data ONTAP versions prior to 9.7P13 and 9.8P3 are susceptible to a vulnerability which could allow single workloads to cause a Denial of Service (DoS) on a cluster node.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2021-26995: E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow privileged attackers to execute arbitrary code.
Key phrases: execute arbitrary code
CVE-2021-26996: E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover system configuration and application information which may aid in crafting more complex attacks.
Key phrases: discover system configuration and application information which may, complex
CVE-2021-26997: E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover information via error messaging which may aid in crafting more complex attacks.
Key phrases: discover information via error messaging which may aid, complex
CVE-2021-26998: NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with auto-upgrade disabled are advised to upgrade to a fixed version.
Key phrases: sensitive information
CVE-2021-26999: NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The logged information is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with auto-upgrade disabled are advised to upgrade to a fixed version.
Key phrases: sensitive information
CVE-2021-27001: Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow an authenticated privileged local attacker to arbitrarily modify Compliance-mode WORM data prior to the end of the retention period.
Key phrases: arbitrarily modify Compliance-mode WORM data prior
CVE-2021-27002: NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retrieve sensitive data via the web proxy.
Key phrases: retrieve sensitive data via the web proxy
CVE-2021-27003: Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a clickjacking attack.
Key phrases: a clickjacking attack, x-frame-options header
CVE-2021-27004: System Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow a local attacker to discover plaintext iSCSI CHAP credentials.
Key phrases: discover plaintext iSCSI CHAP credentials
CVE-2021-27005: Clustered Data ONTAP versions 9.6 and higher prior to 9.6P16, 9.7P16, 9.8P7 and 9.9.1P3 are susceptible to a vulnerability which could allow a remote attacker to cause a crash of the httpd server.
Key phrases: cause a crash of the httpd server
CVE-2021-27006: StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may allow an administrative user to escalate their privileges and modify settings in SANtricity System Manager.
Key phrases: escalate their privileges and modify settings in SANtricity, escalate privilege
CVE-2021-27007: NetApp Virtual Desktop Service (VDS) when used with an HTML5 gateway is susceptible to a vulnerability which when successfully exploited could allow an unauthenticated attacker to takeover a Remote Desktop Session.
Key phrases: takeover a Remote Desktop Session
CVE-2021-27018: The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to not be properly validated. This issue only affects clients that are configured to utilize Tenable.sc as the vulnerability data source.
Key phrases: clients
CVE-2021-27019: PuppetDB logging included potentially sensitive system information.
Key phrases: sensitive system information
CVE-2021-27020: Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.
CVE-2021-27021: A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.
Key phrases: delete tables via an SQL query, escalation of privileges, escalation privilege
CVE-2021-27022: A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).
CVE-2021-27023: A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Key phrases: leak
CVE-2021-27024: A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet Enterprise API token. This issue is resolved in CD4PE 4.10.0
CVE-2021-27025: A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
Key phrases: denial of service condition
CVE-2021-27026: A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged
CVE-2021-27027: An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to code execution through maliciously crafted DLL files or information disclosure.
Key phrases: out-of-bounds read, code execution, information disclosure
CVE-2021-27028: A Memory Corruption Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to remote code execution through maliciously crafted DLL files.
Key phrases: memory corruption, remote code execution
CVE-2021-27029: The user may be tricked into opening a malicious FBX file which may exploit a Null Pointer Dereference vulnerability in FBX's Review version 1.5.0 and prior causing the application to crash leading to a denial of service.
Key phrases: null pointer dereference, denial of service, application crash
CVE-2021-27030: A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system.
Key phrases: run arbitrary code, directory traversal remote code execution
CVE-2021-27031: A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Review causing the application to reference a memory location controlled by an unauthorized third party, thereby running arbitrary code on the system.
Key phrases: running arbitrary code, use-after-free, use after free
CVE-2021-27032: Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues. A malicious user with limited privileges could run any number of tools on a system to identify services that are configured with weak permissions and are running under elevated privileges. These weak permissions could allow all users on the operating system to modify the service configuration and take ownership of the service.
Key phrases: modify the service configuration and take ownership of, privilege escalation issues, weak permissions, elevate privileges
CVE-2021-27033: A Double Free vulnerability allows remote attackers to execute arbitrary code on PDF files within affected installations of Autodesk Design Review 2018, 2017, 2013, 2012, 2011. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Key phrases: execute arbitrary code, execute arbitrary code on PDF files within affected, double free
CVE-2021-27034: A heap-based buffer overflow could occur while parsing PICT, PCX, RCL or TIFF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011. This vulnerability can be exploited to execute arbitrary code.
Key phrases: execute arbitrary code, heap-based buffer overflow, heap based buffer overflow
CVE-2021-27035: A maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA or DWF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Key phrases: code execution
CVE-2021-27036: A maliciously crafted PCX, PICT, RCL, TIF, BMP, PSD or TIFF file can be used to write beyond the allocated buffer while parsing PCX, PDF, PICT, RCL, BMP, PSD or TIFF files. This vulnerability can be exploited to execute arbitrary code
Key phrases: execute arbitrary code, file write
CVE-2021-27037: A maliciously crafted PNG, PDF or DWF file in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by remote malicious actors to execute arbitrary code.
Key phrases: execute arbitrary code
CVE-2021-27038: A Type Confusion vulnerability in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can occur when processing a maliciously crafted PDF file. A malicious actor can leverage this to execute arbitrary code.
Key phrases: execute arbitrary code, type confusion
CVE-2021-27039: A maliciously crafted TIFF and PCX file can be forced to read and write beyond allocated boundaries when parsing the TIFF and PCX file for based overflow. This vulnerability can be exploited to execute arbitrary code.
Key phrases: execute arbitrary code, overflow
CVE-2021-27040: A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulnerability can be exploited to execute arbitrary code.
Key phrases: execute arbitrary code, allocated boundaries
CVE-2021-27041: A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code
Key phrases: execute arbitrary code, dwg file, file write
CVE-2021-27042: A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. The vulnerability exists because the application fails to handle a crafted DWG file, which causes an unhandled exception. An attacker can leverage this vulnerability to execute arbitrary code.
Key phrases: execute arbitrary code, dwg file, file write
CVE-2021-27043: An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpected paths. In order to exploit this the attacker would need the victim to enable full page heap in the application.
Key phrases: leverage the application to write in unexpected paths, arbitrary address write issue, full page heap
CVE-2021-27044: A Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through maliciously crafted DLL files or information disclosure.
Key phrases: out-of-bounds read write, remote code execution, information disclosure
CVE-2021-27045: A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the PDF file. This vulnerability can be exploited to execute arbitrary code.
Key phrases: execute arbitrary code, allocated boundaries
CVE-2021-27046: A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution through maliciously crafted DLL files.
Key phrases: memory corruption, code execution
CVE-2021-27047: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24089, CVE-2021-24110, CVE-2021-26902, CVE-2021-27048, CVE-2021-27049, CVE-2021-27050, CVE-2021-27051, CVE-2021-27061, CVE-2021-27062.
Key phrases: hevc video extensions remote code execution
CVE-2021-27048: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24089, CVE-2021-24110, CVE-2021-26902, CVE-2021-27047, CVE-2021-27049, CVE-2021-27050, CVE-2021-27051, CVE-2021-27061, CVE-2021-27062.
Key phrases: hevc video extensions remote code execution
CVE-2021-27049: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24089, CVE-2021-24110, CVE-2021-26902, CVE-2021-27047, CVE-2021-27048, CVE-2021-27050, CVE-2021-27051, CVE-2021-27061, CVE-2021-27062.
Key phrases: hevc video extensions remote code execution
CVE-2021-27050: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24089, CVE-2021-24110, CVE-2021-26902, CVE-2021-27047, CVE-2021-27048, CVE-2021-27049, CVE-2021-27051, CVE-2021-27061, CVE-2021-27062.
Key phrases: hevc video extensions remote code execution
CVE-2021-27051: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24089, CVE-2021-24110, CVE-2021-26902, CVE-2021-27047, CVE-2021-27048, CVE-2021-27049, CVE-2021-27050, CVE-2021-27061, CVE-2021-27062.
Key phrases: hevc video extensions remote code execution
CVE-2021-27052: Microsoft SharePoint Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-27053: Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-27054.
Key phrases: remote code execution
CVE-2021-27054: Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-27053.
Key phrases: remote code execution
CVE-2021-27055: Microsoft Visio Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2021-27056: Microsoft PowerPoint Remote Code Execution Vulnerability
Key phrases: microsoft powerpoint remote code execution
CVE-2021-27057: Microsoft Office Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24108, CVE-2021-27059.
Key phrases: remote code execution
CVE-2021-27058: Microsoft Office ClickToRun Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27059: Microsoft Office Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24108, CVE-2021-27057.
Key phrases: remote code execution
CVE-2021-27060: Visual Studio Code Remote Code Execution Vulnerability
Key phrases: visual studio code remote code execution
CVE-2021-27061: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24089, CVE-2021-24110, CVE-2021-26902, CVE-2021-27047, CVE-2021-27048, CVE-2021-27049, CVE-2021-27050, CVE-2021-27051, CVE-2021-27062.
Key phrases: hevc video extensions remote code execution
CVE-2021-27062: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24089, CVE-2021-24110, CVE-2021-26902, CVE-2021-27047, CVE-2021-27048, CVE-2021-27049, CVE-2021-27050, CVE-2021-27051, CVE-2021-27061.
Key phrases: hevc video extensions remote code execution
CVE-2021-27063: Windows DNS Server Denial of Service Vulnerability This CVE ID is unique from CVE-2021-26896.
Key phrases: denial of service
CVE-2021-27064: Visual Studio Installer Elevation of Privilege Vulnerability
Key phrases: visual studio installer elevation of privilege
CVE-2021-27065: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27066: Windows Admin Center Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows admin center security feature bypass
CVE-2021-27067: Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-27068: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27070: Windows 10 Update Assistant Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-27072: Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-28310.
Key phrases: elevation of privilege
CVE-2021-27074: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2021-27080.
Key phrases: unsigned code execution
CVE-2021-27075: Azure Virtual Machine Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-27076: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27077: Windows Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-26863, CVE-2021-26875, CVE-2021-26900.
Key phrases: windows elevation of privilege
CVE-2021-27078: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27079: Windows Media Photo Codec Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-27080: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2021-27074.
Key phrases: unsigned code execution
CVE-2021-27081: Visual Studio Code ESLint Extension Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27082: Quantum Development Kit for Visual Studio Code Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27083: Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27084: Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27085: Internet Explorer Remote Code Execution Vulnerability
Key phrases: internet explorer remote code execution
CVE-2021-27086: Windows Services and Controller App Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-27088: Windows Event Tracing Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-27089: Microsoft Internet Messaging API Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-27090: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-27091: RPC Endpoint Mapper Service Elevation of Privilege Vulnerability
Key phrases: rpc endpoint mapper service elevation of privilege
CVE-2021-27092: Azure AD Web Sign-in Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, web sign-in security feature bypass
CVE-2021-27093: Windows Kernel Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-28309.
Key phrases: windows kernel information disclosure
CVE-2021-27094: Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability This CVE ID is unique from CVE-2021-28447.
Key phrases: Security Feature Bypass, driver security feature bypass
CVE-2021-27095: Windows Media Video Decoder Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28315.
Key phrases: windows media video decoder remote code execution
CVE-2021-27096: NTFS Elevation of Privilege Vulnerability
Key phrases: ntfs elevation of privilege
CVE-2021-27097: The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
Key phrases: modified fit
CVE-2021-27098: In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Servers Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1.
CVE-2021-27099: In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID templating feature, which may allow the issuance of an arbitrary SPIFFE ID within the same trust domain, if the attacker controls the value of an EC2 tag prior to attestation, and the attestor is configured for agent ID templating where the tag value is the last element in the path. This issue has been fixed in SPIRE versions 0.11.3 and 0.12.1
Key phrases: attestation
CVE-2021-27101: Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
Key phrases: sql injection
CVE-2021-27102: Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
Key phrases: os command execution, local web service call
CVE-2021-27103: Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Key phrases: ssrf
CVE-2021-27104: Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
Key phrases: os command execution
CVE-2021-27112: LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images.
Key phrases: remote code execution
CVE-2021-27113: An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters.
Key phrases: command injection via shell metacharacters
CVE-2021-27114: An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'s_ip" and "s_mac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address.
Key phrases: stack-based buffer overflow
CVE-2021-27116: An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.
Key phrases: launch symlink attacks locally
CVE-2021-27117: An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.
Key phrases: launch symlink attacks locally
CVE-2021-27124: SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database credentials via a SQL injection attack.
Key phrases: dump the database credentials via a SQL injection, sql injection
CVE-2021-27129: CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parameter.
Key phrases: cross-site scripting (xss)
CVE-2021-27130: Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload.
Key phrases: authentication bypass, sql injection, reverse shell upload
CVE-2021-27131: Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer. NOTE: this is disputed by the vendor because the "Additional HTML Section" for "Header and Footer" can only be supplied by an administrator, who is intentionally allowed to enter unsanitized input (e.g., site-specific JavaScript).
Key phrases: persistent stored cross-site scripting (xss)
CVE-2021-27132: SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
Key phrases: CRLF injection (for HTTP header injection), crlf injection, http header injection
CVE-2021-27135: xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
Key phrases: execute arbitrary code, denial of service (segmentation fault), execute arbitrary code or cause a denial of
CVE-2021-27138: The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.
CVE-2021-27139: An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to extract information from the device without authentication by disabling JavaScript and visiting /info.asp.
CVE-2021-27140: An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to find passwords and authentication cookies stored in cleartext in the web.log HTTP logs.
Key phrases: cleartext
CVE-2021-27141: An issue was discovered on FiberHome HG6245D devices through RP2613. Credentials in /fhconf/umconfig.txt are obfuscated via XOR with the hardcoded *j7a(L#yZ98sSd5HfSgGjMj8;Ss;d)(*&^#@$a2s0i3g key. (The webs binary has details on how XOR is used.)
Key phrases: hardcoded
CVE-2021-27142: An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions.
Key phrases: permissions, hardcoded
CVE-2021-27143: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / user1234 credentials for an ISP.
Key phrases: hardcoded user credentials
CVE-2021-27144: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credentials for an ISP.
Key phrases: hardcoded
CVE-2021-27145: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / lnadmin credentials for an ISP.
Key phrases: hardcoded admin lnadmin credentials
CVE-2021-27146: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP.
Key phrases: hardcoded admin cuadmin credentials
CVE-2021-27147: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / admin credentials for an ISP.
Key phrases: hardcoded admin admin credentials
CVE-2021-27148: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded telecomadmin / nE7jA%5m credentials for an ISP.
Key phrases: hardcoded
CVE-2021-27149: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for an ISP.
Key phrases: hardcoded
CVE-2021-27150: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded gestiontelebucaramanga / t3l3buc4r4m4ng42013 credentials for an ISP.
Key phrases: hardcoded
CVE-2021-27151: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded rootmet / m3tr0r00t credentials for an ISP.
Key phrases: hardcoded rootmet credentials
CVE-2021-27152: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded awnfibre / fibre@dm!n credentials for an ISP.
Key phrases: hardcoded
CVE-2021-27153: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded trueadmin / admintrue credentials for an ISP.
Key phrases: hardcoded trueadmin admintrue credentials
CVE-2021-27154: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / G0R2U1P2ag credentials for an ISP.
Key phrases: hardcoded admin credentials
CVE-2021-27155: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 3UJUh2VemEfUtesEchEC2d2e credentials for an ISP.
Key phrases: hardcoded
CVE-2021-27156: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains credentials for an ISP that equal the last part of the MAC address of the br0 interface.
CVE-2021-27157: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 888888 credentials for an ISP.
Key phrases: hardcoded admin credentials
CVE-2021-27158: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded L1vt1m4eng / 888888 credentials for an ISP.
Key phrases: hardcoded
CVE-2021-27159: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded useradmin / 888888 credentials for an ISP.
Key phrases: hardcoded useradmin credentials
CVE-2021-27160: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / 888888 credentials for an ISP.
Key phrases: hardcoded user credentials
CVE-2021-27161: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 1234 credentials for an ISP.
Key phrases: hardcoded admin credentials
CVE-2021-27162: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP.
Key phrases: hardcoded user tattoo@home credentials
CVE-2021-27163: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / tele1234 credentials for an ISP.
Key phrases: hardcoded admin credentials
CVE-2021-27164: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / aisadmin credentials for an ISP.
Key phrases: hardcoded admin aisadmin credentials
CVE-2021-27165: An issue was discovered on FiberHome HG6245D devices through RP2613. The telnet daemon on port 23/tcp can be abused with the gpon/gpon credentials.
Key phrases: gpon gpon credentials
CVE-2021-27166: An issue was discovered on FiberHome HG6245D devices through RP2613. The password for the enable command is gpon.
CVE-2021-27167: An issue was discovered on FiberHome HG6245D devices through RP2613. There is a password of four hexadecimal characters for the admin account. These characters are generated in init_3bb_password in libci_adaptation_layer.so.
CVE-2021-27168: An issue was discovered on FiberHome HG6245D devices through RP2613. There is a 6GFJdY4aAuUKJjdtSn7d password for the rdsadmin account.
CVE-2021-27169: An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631. There is a gepon password for the gepon account.
CVE-2021-27170: An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to the Internet.
Key phrases: internal management interfaces
CVE-2021-27171: An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to start a Linux telnetd as root on port 26/tcp by using the CLI interface commands of ddd and shell (or tshell).
CVE-2021-27172: An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh.
Key phrases: gepon password, hardcoded
CVE-2021-27173: An issue was discovered on FiberHome HG6245D devices through RP2613. There is a telnet?enable=0&key=calculated(BR0_MAC) backdoor API, without authentication, provided by the HTTP server. This will remove firewall rules and allow an attacker to reach the telnet server (used for the CLI).
Key phrases: reach the telnet server (used for the, backdoor api, firewall rules
CVE-2021-27174: An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 permissions.
Key phrases: cleartext passwords, permissions
CVE-2021-27175: An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 permissions.
Key phrases: cleartext passwords, permissions
CVE-2021-27176: An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 permissions.
Key phrases: cleartext passwords, permissions
CVE-2021-27177: An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending the decoded value of the GgpoZWxwCmxpc3QKd2hvCg== string to the telnet server.
Key phrases: bypass authentication
CVE-2021-27178: An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram.
Key phrases: cleartext
CVE-2021-27179: An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to crash the telnet daemon by sending a certain 0a 65 6e 61 62 6c 65 0a 02 0a 1a 0a string.
Key phrases: crash
CVE-2021-27180: An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user.
Key phrases: performing any action with the privileges of the, reflected xss
CVE-2021-27181: An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user.
Key phrases: perform a fixation of the anti-CSRF, remote administration
CVE-2021-27182: An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.
Key phrases: perform any action with the privileges of the, iframe injection
CVE-2021-27183: An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution.
Key phrases: arbitrary file write, remote code execution
CVE-2021-27184: Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the ControlPointCacheShare.xml file (in a %APPDATA%\\Pelco directory) when DSControlPoint.exe is executed.
Key phrases: xml external entity, disclosure
CVE-2021-27185: The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
Key phrases: command injection because of the use of process.exec
CVE-2021-27186: Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metrics.c.
Key phrases: null pointer dereference
CVE-2021-27187: The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is checked.
Key phrases: cleartext
CVE-2021-27188: The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five hours) by making five invalid login attempts to a victim's account.
Key phrases: denial of service (access suspended for five hours), cause a denial of service (access suspended, invalid login attempts
CVE-2021-27189: The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation.
CVE-2021-27190: A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.
Key phrases: input malicious JavaScript which can steal cookie, stored cross site scripting(xss), polyglot payload
CVE-2021-27191: The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion.
Key phrases: denial of service (DoS), denial of service (dos), resource exhaustion
CVE-2021-27192: Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain administrator privileges whilst using the clients.
Key phrases: gain administrator privileges, gain administrator privileges whilst using the clients, local privilege escalation
CVE-2021-27193: Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to read and write files on the remote machine with system privileges resulting in a privilege escalation.
Key phrases: read and write files on the remote machine, incorrect default permissions, privilege escalation, to write files
CVE-2021-27194: Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to gather credentials including Windows login usernames and passwords.
Key phrases: gather credentials including Windows login usernames and passwords, cleartext transmission, sensitive information
CVE-2021-27195: Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic.
Key phrases: replay network traffic, improper authorization
CVE-2021-27196: Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion 670/650/SAM600-IO, Relion 650, REB500, RTU500 Series, FOX615 (TEGO1), MSM, GMS600, PWC600 allows an attacker with access to the IEC 61850 network with knowledge of how to reproduce the attack, as well as the IP addresses of the different IEC 61850 access points (of IEDs/products), to force the device to reboot, which renders the device inoperable for approximately 60 seconds. This vulnerability affects only products with IEC 61850 interfaces. This issue affects: Hitachi ABB Power Grids Relion 670 Series 1.1; 1.2.3 versions prior to 1.2.3.20; 2.0 versions prior to 2.0.0.13; 2.1; 2.2.2 versions prior to 2.2.2.3; 2.2.3 versions prior to 2.2.3.2. Hitachi ABB Power Grids Relion 670/650 Series 2.2.0 versions prior to 2.2.0.13. Hitachi ABB Power Grids Relion 670/650/SAM600-IO 2.2.1 versions prior to 2.2.1.6. Hitachi ABB Power Grids Relion 650 1.1; 1.2; 1.3 versions prior to 1.3.0.7. Hitachi ABB Power Grids REB500 7.3; 7.4; 7.5; 7.6; 8.2; 8.3. Hitachi ABB Power Grids RTU500 Series 7.x version 7.x and prior versions; 8.x version 8.x and prior versions; 9.x version 9.x and prior versions; 10.x version 10.x and prior versions; 11.x version 11.x and prior versions; 12.x version 12.x and prior versions. Hitachi ABB Power Grids FOX615 (TEGO1) R1D02 version R1D02 and prior versions. Hitachi ABB Power Grids MSM 2.1.0 versions prior to 2.1.0. Hitachi ABB Power Grids GMS600 1.3.0 version 1.3.0 and prior versions. Hitachi ABB Power Grids PWC600 1.0 versions prior to 1.0.1.4; 1.1 versions prior to 1.1.0.1.
Key phrases: the IEC 61850 network with knowledge of how, improper input validation, inoperable, reboot
CVE-2021-27197: DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with "OBJECT classid=" and "<SCRIPT language='vbscript'>") to overwrite arbitrary files.
Key phrases: overwrite arbitrary files, arbitrary file write
CVE-2021-27198: An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbitrary File Upload in the web service when using a myspeed/sf?filename= URI. This application is written in Java and is thus cross-platform. The Windows installation runs as SYSTEM, which means that exploitation gives one Administrator privileges on the target system.
Key phrases: unauthenticated remote code execution, arbitrary file upload
CVE-2021-27200: In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.
Key phrases: weak cryptographic algorithm, code parameter