{"vulnerability": "CVE-2021-4412", "sightings": [{"uuid": "84300a63-b2ee-4450-b2b5-8ec236ea43b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44124", "type": "seen", "source": "https://t.me/cibsecurity/39651", "content": "\u203c CVE-2021-44124 \u203c\n\nHiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-28T20:40:18.000000Z"}, {"uuid": "8fee6e40-abcf-4681-9d03-f1dd56a87fd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44127", "type": "seen", "source": "https://t.me/cibsecurity/39616", "content": "\u203c CVE-2021-44127 \u203c\n\nIn DLink DAP-1360 F1 firmware version <=v6.10 in the \"webupg\" binary, an attacker can use the \"file\" parameter to execute arbitrary system commands when the parameter is \"name=deleteFile\" after being authorized.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-28T00:39:27.000000Z"}, {"uuid": "4d8a76c1-b538-47e2-8c62-c5826186f024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44120", "type": "seen", "source": "https://t.me/cibsecurity/36297", "content": "\u203c CVE-2021-44120 \u203c\n\nSPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The \"Who are you\" and \"Website Name\" fields are vulnerable.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-26T14:19:35.000000Z"}, {"uuid": "db6f5ac9-4915-48d1-800e-5eb90a93f949", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44122", "type": "seen", "source": "https://t.me/cibsecurity/36291", "content": "\u203c CVE-2021-44122 \u203c\n\nSPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-26T14:19:27.000000Z"}, {"uuid": "6a4dfc8a-f7ef-4dca-9155-76272d39ba2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44123", "type": "seen", "source": "https://t.me/cibsecurity/36293", "content": "\u203c CVE-2021-44123 \u203c\n\nSPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-26T14:19:29.000000Z"}]}