CVE-2021-29397

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local user to intercept users credentials transmitted in cleartext over HTTP.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://Ardent-Security.comThird Party Advisory
https://ardent-security.com/en/advisory/asa-2021-05/Third Party Advisory
https://Ardent-Security.comThird Party Advisory
https://ardent-security.com/en/advisory/asa-2021-05/Third Party Advisory

Timeline

Published: Feb 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-293985.3Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 al CVE-2021-293996.1XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input. This bug affects all versions of XMB. All XMB i CVE-2021-294006.5A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change t CVE-2021-294146.1STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control.CVE-2021-294155.5The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor CVE-2021-294166.5An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a CVE-2021-294179.8gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.CVE-2021-294185.3The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. CVE-2021-294217.5models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.CVE-2021-294247.5The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address strin CVE-2021-294254.8In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\f CVE-2021-294277.2In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poison