CVE-2021-27945
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Squirro Insights Engine是瑞士Squirro公司的一个应用软件。提供最相关的数据直接或通过工作台集成信号源和显示他们语境的见解。 Squirro Insights Engine存在安全漏洞，攻击者可利用该漏洞提供的代码可以执行各种各样的操作，例如窃取受害者的会话令牌或登录凭证，代表他们执行任意操作，并记录他们的按键。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-27945
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Squirro Insights Engine 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Squirro Insights Engine是瑞士Squirro公司的一个应用软件。提供最相关的数据直接或通过工作台集成信号源和显示他们语境的见解。 Squirro Insights Engine存在安全漏洞，攻击者可利用该漏洞提供的代码可以执行各种各样的操作，例如窃取受害者的会话令牌或登录凭证，代表他们执行任意操作，并记录他们的按键。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2021-27945
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-27945
请登录查看更多情报信息。
Other References for CVE-2021-27945 (1)
Same Patch Batch · n/a · 2021-04-08 · 33 CVEs total
| CVE-2021-22115 | Cloud Foundry Cloud Controller 安全漏洞 | |
| CVE-2021-3413 | Red Hat Satellite 6 信息泄露漏洞 | |
| CVE-2021-3448 | dnsmasq 安全漏洞 | |
| CVE-2021-3482 | Exiv2 缓冲区错误漏洞 | |
| CVE-2020-6590 | Forcepoint Web Security Content Gateway 代码问题漏洞 | |
| CVE-2021-22512 | Jenkins 跨站请求伪造漏洞 | |
| CVE-2021-22511 | Jenkins 信任管理问题漏洞 | |
| CVE-2021-22510 | Jenkins Core 跨站脚本漏洞 | |
| CVE-2021-22513 | Jenkins 安全漏洞 | |
| CVE-2020-14106 | Xiaomi MIUI 安全漏洞 | |
| CVE-2020-14103 | Xiaomi MIUI OS 安全漏洞 | |
| CVE-2021-3146 | Dolby DAX2 API Service 代码问题漏洞 | |
| CVE-2021-22312 | 多款华为产品 缓冲区错误漏洞 | |
| CVE-2020-14099 | Xiaomi router AX1800 信任管理问题漏洞 | |
| CVE-2020-14104 | Xiaomi Xiaomi router AX3600 竞争条件问题漏洞 | |
| CVE-2021-22507 | Micro Focus Operations Bridge Manager 授权问题漏洞 | |
| CVE-2021-29154 | Linux kernel 命令注入漏洞 | |
| CVE-2021-3328 | Aprelium Abyss Web Server 缓冲区错误漏洞 | |
| CVE-2020-23539 | Realtek rtl8723de 代码问题漏洞 | |
| CVE-2021-27522 | Mr.Zhou Learnsite 授权问题漏洞 |
Showing top 20 of 33 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2021-27945
No comments yet