yahoo-inc/cve-impacts huggingface dataset:
CVE-2021-41275: spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both: * Executed whether as: * A before_action callback (the default) * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). * Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. Thanks @waiting-for-dev for reporting and providing a patch ?? ### Patches Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 ### Workarounds If possible, change your strategy to :exception: ```ruby class ApplicationController < ActionController::Base protect_from_forgery with: :exception end ``` Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller: ```ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end ``` ### References https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Key phrases: find), csrf
CVE-2021-41276: Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. This issue has been patched in Tuleap Community Edition 13.2.99.31, Tuleap Enterprise Edition 13.1-5, and Tuleap Enterprise Edition 13.2-3.
Key phrases: exploitable
CVE-2021-41277: Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If youre unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
Key phrases: security issue, local file inclusion
CVE-2021-41278: Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX IoT platform. In affected versions broken encryption in app-functions-sdk AES transform in EdgeX Foundry releases prior to Jakarta allows attackers to decrypt messages via unspecified vectors. The app-functions-sdk exports an aes transform that user scripts can optionally call to encrypt data in the processing pipeline. No decrypt function is provided. Encryption is not enabled by default, but if used, the level of protection may be less than the user may expects due to a broken implementation. Version v2.1.0 (EdgeX Foundry Jakarta release and later) of app-functions-sdk-go/v2 deprecates the aes transform and provides an improved aes256 transform in its place. The broken implementation will remain in a deprecated state until it is removed in the next EdgeX major release to avoid breakage of existing software that depends on the broken implementation. As the broken transform is a library function that is not invoked by default, users who do not use the AES transform in their processing pipelines are unaffected. Those that are affected are urged to upgrade to the Jakarta EdgeX release and modify processing pipelines to use the new "aes256" transform.
Key phrases: decrypt messages via unspecified vectors, broken implementation, breakage
CVE-2021-41279: BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
Key phrases: path traversal, unspecified
CVE-2021-4128: When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially exploitable crash.<br>*This bug only affects Firefox on MacOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 95.
Key phrases: memory corruption, exploitable crash
CVE-2021-41280: Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value.
Key phrases: operating system command injection
CVE-2021-41281: Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.
CVE-2021-41282: diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.
Key phrases: be able to view data about the routes, sed data injection, command injection, arbitrary file
CVE-2021-41285: Ballistix MOD Utility through 2.0.2.5 is vulnerable to privilege escalation in the MODAPI.sys driver component. The vulnerability is triggered by sending a specific IOCTL request that allows low-privileged users to directly interact with physical memory via the MmMapIoSpace function call (mapping physical memory into a virtual address space). Attackers could exploit this issue to achieve local privilege escalation to NT AUTHORITY\\\\SYSTEM.
Key phrases: directly interact with physical memory via the MmMapIoSpace, privilege escalation, local privilege escalation
CVE-2021-41286: Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the application, the validity of the password is checked locally. All communication to the database backend is made via the same technical account. Consequently, an attacker can attach a debugger to the process or create a patch that manipulates the behavior of the login function. When the function always returns the success value (corresponding to a correct password), an attacker can login with any desired account, such as the administrative account of the application.
Key phrases: patch
CVE-2021-41288: Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
Key phrases: sql injection
CVE-2021-41289: ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general users permission, local attackers can modify the BIOS by replacing or filling in the content of the designated Memory DataBuffer, which causing a failure of integrity verification and further resulting in a failure to boot.
Key phrases: improper restriction of operations within the bounds of a memory buffer, failure to boot, integrity
CVE-2021-4129: Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 95, Firefox ESR < 91.4.0, and Thunderbird < 91.4.0.
Key phrases: run arbitrary code, memory safety bugs, memory corruption
CVE-2021-41290: ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.
Key phrases: set arbitrary values, gain the possibility to execute arbitrary code on, arbitrary file write, path traversal
CVE-2021-41291: ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.
Key phrases: path traversal content disclosure
CVE-2021-41292: ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.
Key phrases: bypass authentication, authentication bypass, remotely bypass, cookie poisoning, sensitive information
CVE-2021-41293: ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.
Key phrases: causing arbitrary files disclosure, path traversal, arbitrary file disclosure
CVE-2021-41294: ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario.
Key phrases: causing arbitrary files deletion, path traversal, denial of service scenario, arbitrary file deletion
CVE-2021-41295: ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands (GET, POST, PUT, DELETE) to perform arbitrary operations in the system.
Key phrases: perform arbitrary operations, cross-site request forgery
CVE-2021-41296: ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
Key phrases: gain full control, default administrative credentials, full control of the system
CVE-2021-41297: ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts in plain-text.
Key phrases: remotely escalate privileges by disclosing credentials of administrative, weak access control mechanism
CVE-2021-41298: ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.
Key phrases: bypass authorization and access the hidden resources in, remotely bypass, insecure direct object references
CVE-2021-41299: ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrators privilege without logging in.
Key phrases: obtain administrators privilege, hard-coded credentials, hard coded credentials
CVE-2021-4130: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Key phrases: cross-site request forgery (csrf)
CVE-2021-41300: ECOA BAS controllers special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality.
Key phrases: obtain privilege, plain text
CVE-2021-41301: ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.
Key phrases: authentication bypass, configuration disclosure, privilege escalation, full system access, sensitive information
CVE-2021-41302: ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain users privilege.
Key phrases: obtain users privilege, clear-text
CVE-2021-41303: Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
Key phrases: authentication bypass
CVE-2021-41304: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.2.
Key phrases: inject arbitrary HTML or JavaScript, inject arbitrary HTML or JavaScript via a Cross, cross-site scripting (xss), arbitrary html
CVE-2021-41305: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in Status Gadget. The affected versions are before version 8.13.12..
Key phrases: view the names of private projects and filters, insecure direct object references (idor)
CVE-2021-41306: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.
Key phrases: view private project and filter names via an, insecure direct object references (idor)
CVE-2021-41307: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.
Key phrases: view the names of private projects and private, insecure direct object references (idor)
CVE-2021-41308: Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the `ReplicationSettings!default.jspa` endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.
Key phrases: edit the File Replication settings via a Broken, broken access control
CVE-2021-41309: Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The affected versions of Jira Server and Data Center are before version 8.19.1.
Key phrases: export audit logs of another user's Jira, broken authentication
CVE-2021-4131: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Key phrases: cross-site request forgery (csrf)
CVE-2021-41310: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Associated Projects feature (/secure/admin/AssociatedProjectsForCustomField.jspa). The affected versions are before version 8.5.19, from version 8.6.0 before 8.13.11, and from version 8.14.0 before 8.19.1.
Key phrases: inject arbitrary HTML or JavaScript, inject arbitrary HTML or JavaScript via a Cross, cross-site scripting (xss), arbitrary html
CVE-2021-41311: Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.
Key phrases: an administrator account that has had its access, broken authentication
CVE-2021-41312: Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue Collectors on Jira Service Management projects via an Improper Authentication vulnerability in the /secure/ViewCollectors endpoint. The affected versions are before version 8.19.1.
Key phrases: enable and disable Issue Collectors on Jira Service, improper authentication
CVE-2021-41313: Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization vulnerability in the /secure/admin/ConfigureBatching!default.jspa endpoint. The affected versions are before version 8.20.7.
Key phrases: edit email batch configurations via an Improper Authorization, improper authorization
CVE-2021-41314: Certain NETGEAR smart switches are affected by a \\\\n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2" string). This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.
Key phrases: create (or overwrite) a file with, injection, admin session crafting
CVE-2021-41315: The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access to the console application) to execute arbitrary OS commands and escalate privileges.
Key phrases: execute arbitrary OS commands, the console application) to execute arbitrary OS, escalate privileges, arbitrary os command
CVE-2021-41316: The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector.
Key phrases: overwrite arbitrary files, extra argument
CVE-2021-41317: XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
CVE-2021-41318: In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
Key phrases: execute arbitrary code, execute arbitrary code in a victim's browser, malicious input
CVE-2021-4132: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2021-41320: A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user.
Key phrases: hardcoded credentials
CVE-2021-41322: Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process.
Key phrases: change the Admin password by modifying a POST, post parameter
CVE-2021-41323: Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any user, via the format parameter.
Key phrases: overwrite personal files, directory traversal
CVE-2021-41324: Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files belonging to any user) via the nodes parameter (for Copy and Move) or via the Path parameter (for Delete).
Key phrases: enumerate personal files (or Cells files belonging, directory traversal
CVE-2021-41325: Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be granted several admin permissions via the Roles parameter.)
Key phrases: create standard users via the profile parameter, broken access control
CVE-2021-41326: In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.
CVE-2021-41329: Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their view filter. This information exposure, caused by an internal cache key collision, occurs when the user's view filter includes an array or IN clause, and when another user has recently executed an identical query differing only by the array elements.
Key phrases: their accounts) to see query results not, information exposure, internal cache key collision
CVE-2021-4133: A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
Key phrases: create new default user accounts via the administrative
CVE-2021-41330: Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-41331: Windows Media Audio Decoder Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-41332: Windows Print Spooler Information Disclosure Vulnerability
Key phrases: windows print spooler information disclosure
CVE-2021-41333: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-41334: Windows Desktop Bridge Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-41335: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2021-41336: Windows Kernel Information Disclosure Vulnerability
Key phrases: windows kernel information disclosure
CVE-2021-41337: Active Directory Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, active directory security feature bypass
CVE-2021-41338: Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2021-41339: Microsoft DWM Core Library Elevation of Privilege Vulnerability
Key phrases: microsoft dwm core library elevation of privilege
CVE-2021-4134: The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.
Key phrases: inject arbitrary SQL, obtain sensitive information, inject arbitrary SQL queries to obtain sensitive information, sql injection
CVE-2021-41340: Windows Graphics Component Remote Code Execution Vulnerability
Key phrases: windows graphics component remote code execution
CVE-2021-41342: Windows MSHTML Platform Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-41343: Windows Fast FAT File System Driver Information Disclosure Vulnerability
Key phrases: windows fast fat file system driver information disclosure
CVE-2021-41344: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-41345: Storage Spaces Controller Elevation of Privilege Vulnerability
Key phrases: storage spaces controller elevation of privilege
CVE-2021-41346: Console Window Host Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, console window host security feature bypass
CVE-2021-41347: Windows AppX Deployment Service Elevation of Privilege Vulnerability
Key phrases: windows appx deployment service elevation of privilege
CVE-2021-41348: Microsoft Exchange Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-41349: Microsoft Exchange Server Spoofing Vulnerability
Key phrases: microsoft exchange server spoofing
CVE-2021-4135: A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.
Key phrases: memory leak, unauthorized access
CVE-2021-41350: Microsoft Exchange Server Spoofing Vulnerability
Key phrases: microsoft exchange server spoofing
CVE-2021-41351: Microsoft Edge (Chrome based) Spoofing on IE Mode
Key phrases: spoofing, ie mode
CVE-2021-41352: SCOM Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-41353: Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability
Key phrases: spoofing
CVE-2021-41354: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2021-41355: .NET Core and Visual Studio Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-41356: Windows Denial of Service Vulnerability
Key phrases: windows denial of service
CVE-2021-41357: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-4136: vim is vulnerable to Heap-based Buffer Overflow
Key phrases: heap-based buffer overflow
CVE-2021-41360: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-41361: Active Directory Federation Server Spoofing Vulnerability
Key phrases: active directory federation server spoofing
CVE-2021-41363: Intune Management Extension Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, intune management extension security feature bypass
CVE-2021-41365: Microsoft Defender for IoT Remote Code Execution Vulnerability
Key phrases: iot remote code execution
CVE-2021-41366: Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-41367: NTFS Elevation of Privilege Vulnerability
Key phrases: ntfs elevation of privilege
CVE-2021-41368: Microsoft Access Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-41370: NTFS Elevation of Privilege Vulnerability
Key phrases: ntfs elevation of privilege
CVE-2021-41371: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2021-41372: <p>A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim.</p><p>Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded.</p><p>The security update addresses the vulnerability by helping to ensure that Power BI Report Server properly sanitize file uploads.</p>
Key phrases: cross-site scripting (xss), cross-site request forgery (csrf), privilege escalation, file upload
CVE-2021-41373: FSLogix Information Disclosure Vulnerability
Key phrases: fslogix information disclosure
CVE-2021-41374: Azure Sphere Information Disclosure Vulnerability
Key phrases: azure sphere information disclosure
CVE-2021-41375: Azure Sphere Information Disclosure Vulnerability
Key phrases: azure sphere information disclosure
CVE-2021-41376: Azure Sphere Information Disclosure Vulnerability
Key phrases: azure sphere information disclosure
CVE-2021-41377: Windows Fast FAT File System Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-41378: Windows NTFS Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2021-41379: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2021-4138: Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.
CVE-2021-41380: RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data. NOTE: It is asserted that this issue requires social engineering a user into connecting to a fake VNC Server. The VNC Viewer application they are using will then hang, until terminated, but no memory leak occurs - the resources are freed once the hung process is terminated and the resource usage is constant during the hang. Only the process that is connected to the fake Server is affected. This is an application bug, not a security issue
Key phrases: denial of service (application crash), cause a denial of service (application crash, memory leak, application bug, security issue, application hang
CVE-2021-41381: Payara Micro Community 5.2021.6 and below allows Directory Traversal.
Key phrases: Directory Traversal, directory traversal
CVE-2021-41382: Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
CVE-2021-41383: setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server field.
Key phrases: execute arbitrary shell commands, execute arbitrary shell commands via shell metacharacters in
CVE-2021-41385: The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtain access to server configuration details via SSRF.
Key phrases: obtain access, obtain access to server configuration details via SSRF, ssrf
CVE-2021-41387: seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root.
Key phrases: privilege escalation because it uses execlp and may, setuid root
CVE-2021-41388: Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not perform validation on new connections before accepting the connection. Thus any low privileged user can connect and call external methods defined in XPC service as root, elevating their privilege to the highest level.
Key phrases: local privilege escalation, highest level, elevate privileges
CVE-2021-4139: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2021-41390: In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Injection.
Key phrases: csv injection
CVE-2021-41391: In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSS via a name, leading to session hijacking and full account takeover.
Key phrases: xss, full account takeover
CVE-2021-41392: static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API.
Key phrases: the exposed vulnerable ipcRenderer IPC interface, remote command execution
CVE-2021-41393: Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.
Key phrases: forgery of SSH host certificates in some situations, forgery of ssh host certificates
CVE-2021-41394: Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.
Key phrases: alteration of build artifacts in some situations
CVE-2021-41395: Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or username.
Key phrases: control a database connection string, username
CVE-2021-41396: Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling module, in which a heap-based buffer overflow happens. An attacker can leverage this to launch a DoS attack.
Key phrases: heap-based buffer overflow, dos, heap based buffer overflow
CVE-2021-4140: It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Key phrases: bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, xslt markup
CVE-2021-41402: flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.
Key phrases: execute arbitrary PHP code, code execution, arbitrary php code
CVE-2021-41403: flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.
Key phrases: server-side request forgery, server side request forgery
CVE-2021-41408: VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter.
Key phrases: sql injection
CVE-2021-41411: drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
Key phrases: xml external entity (xxe), xxe injection
CVE-2021-41413: ok-file-formats master 2021-9-12 is affected by a buffer overflow in ok_jpg_convert_data_unit_grayscale and ok_jpg_convert_YCbCr_to_RGB.
Key phrases: buffer overflow
CVE-2021-41415: Subscription-Manager v1.0 /main.js has a cross-site scripting (XSS) vulnerability in the machineDetail parameter.
Key phrases: cross-site scripting (xss)
CVE-2021-41418: AriaNg v0.1.0~v1.2.2 is affected by an incorrect access control vulnerability through not authenticating visitors' access rights.
Key phrases: incorrect access control
CVE-2021-41419: QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.
Key phrases: remote code execution, java deserialization
CVE-2021-4142: The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.
Key phrases: use the SCA (simple content access), authentication flaw, improper authentication
CVE-2021-41420: A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context of authenticated and unauthenticated users through the MaianAffiliate admin panel.
Key phrases: an authenticated attacker for arbitrary JavaScript code execution, stored xss, arbitrary javascript code execution
CVE-2021-41421: A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel.
Key phrases: gain RCE through the MaianAffiliate admin panel., php code injection, rce
CVE-2021-41426: Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm.
Key phrases: cross site request forgery (csrf)
CVE-2021-41427: Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi.
Key phrases: cross site scripting (xss)
CVE-2021-4143: Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.
Key phrases: cross-site scripting (xss)
CVE-2021-41432: A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content.
Key phrases: for arbitrary execution of JavaScript commands through blog, stored cross-site scripting (xss)
CVE-2021-41433: SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan Media that allows authentication bypass through login.php.
Key phrases: bypass through login.php, authentication bypass, authentication bypass through login.php, sql injection
CVE-2021-41434: A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for arbitrary execution of JavaScript commands through index.php.
Key phrases: for arbitrary execution of JavaScript commands through index.php, cross-site scripting (xss)
CVE-2021-41435: A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.
Key phrases: bypass in CAPTCHA protection, force protection bypass, attempt any number of login attempts via sending, brute-force protection bypass
CVE-2021-41436: An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet.
Key phrases: DoS via sending a specially crafted HTTP packet, http request smuggling, dos
CVE-2021-41437: An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL that if an authenticated victim visits it, the URL will give access to the cloud storage of the attacker.
Key phrases: craft a specific URL that if an authenticated, http response splitting, access
CVE-2021-4144: TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection.
Key phrases: os command injection
CVE-2021-41441: A DoS attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to reboot the router via sending a specially crafted URL to an authenticated victim. The authenticated victim need to visit this URL, for the router to reboot.
Key phrases: reboot the router via sending a specially crafted, dos
CVE-2021-41442: An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet.
Key phrases: DoS the web application via sending a specific, http smuggling, dos
CVE-2021-41445: A reflected cross-site-scripting attack in web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to execute code in the device of the victim via sending a specific URL to the unauthenticated victim.
Key phrases: execute code in the device of the victim, cross-site-scripting, cross-site scripting
CVE-2021-41449: A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote unauthenticated attacker to gain access to sensitive restricted information, such as forbidden files of the web application, via sending a specially crafted HTTP packet.
Key phrases: gain access, gain access to sensitive restricted information, path traversal
CVE-2021-4145: A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.
Key phrases: null pointer dereference issue, crash
CVE-2021-41450: An HTTP request smuggling attack in TP-Link AX10v1 before v1_211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet.
Key phrases: DoS the web application via sending a specific, http request smuggling, dos
CVE-2021-41451: A misconfiguration in HTTP/1.0 and HTTP/1.1 of the web interface in TP-Link AX10v1 before V1_211117 allows a remote unauthenticated attacker to send a specially crafted HTTP request and receive a misconfigured HTTP/0.9 response, potentially leading into a cache poisoning attack.
Key phrases: send a specially crafted HTTP request and receive, misconfigured http response, cache poisoning
CVE-2021-41456: There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denial of service vulnerability.
Key phrases: stack buffer overflow, denial of service
CVE-2021-41457: There is a stack buffer overflow in MP4Box 1.1.0 at src/filters/dmx_nhml.c in nhmldmx_init_parsing which leads to a denial of service vulnerability.
Key phrases: stack buffer overflow, denial of service
CVE-2021-41458: In GPAC MP4Box v1.1.0, there is a stack buffer overflow at src/utils/error.c:1769 which leads to a denial of service vulnerability.
Key phrases: stack buffer overflow, denial of service
CVE-2021-41459: There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter which leads to a denial of service vulnerability.
Key phrases: stack buffer overflow, denial of service
CVE-2021-4146: Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.
Key phrases: business logic errors
CVE-2021-41460: ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.
Key phrases: obtain sensitive information, sql injection
CVE-2021-41461: Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2021-41462: Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the ctID parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2021-41463: Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group_combination.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the cID parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2021-41464: Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2021-41465: Cross-site scripting (XSS) vulnerability in concrete/elements/collection_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2021-41467: Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2021-4147: A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting in a denial of service condition.
Key phrases: denial of service condition, reboot, crash