CVE-2021-41390

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Injection.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Sep 17, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-413915.4In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSCVE-2021-413929.8static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to theCVE-2021-413939.8Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situationsCVE-2021-413945.3Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.CVE-2021-413956.5Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted dataCVE-2021-413967.5Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the eCVE-2021-414010.0It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 9CVE-2021-414028.8flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.CVE-2021-414039.8flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.CVE-2021-414089.8VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter.CVE-2021-414119.8drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correCVE-2021-414137.8ok-file-formats master 2021-9-12 is affected by a buffer overflow in ok_jpg_convert_data_unit_grayscale and ok_jpg_convert_YCbCr_to_RGB.
CVE-2021-41390: High severity, CVSS 8.0 | Vulnix