CVE-2021-20844

MEDIUM Year: 2021
CVSS v3 Score
5.7
Medium
CVSS v2 Score
3.5
Low
Weakness Type
CWE-116
View all →

Vulnerability Description

Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.

Related Vulnerabilities

CVE-2018-2389

MEDIUM
CVSS:5.7(Medium)

Under certain conditions a malicious user can inject log files of SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, hiding important information in the log file.

CWE-1162018

CVE-2025-4084

MEDIUM
CVSS:5.7(Medium)

Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's ...

CWE-1162025

CVE-2018-8920

MEDIUM
CVSS:5.9(Medium)

Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impa...

CWE-1162018

CVE-2022-20230

MEDIUM
CVSS:5.5(Medium)

In choosePrivateKeyAlias of KeyChain.java, there is a possible access to the user's certificate due to improper input validation. This could lead to local information disclosure with no additional exe...

CWE-1162022

CVE-2023-31669

MEDIUM
CVSS:5.5(Medium)

WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").

CWE-1162023

CVE-2019-10362

MEDIUM
CVSS:5.4(Medium)

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change...

CWE-1162019