Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges. In affected versions multitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected by this issue. This vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on 2021-10-08. Starting with v0.15, the kustomize-controller no longer executes shell commands on the container OS and the `kubectl` binary has been removed from the container image. To pre
r executes shell commands on the container OS and the `kubectl` binary has been removed from the container image. To prevent the creation of Kubernetes Service Accounts with `secrets` in namespaces owned by tenants, a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno can be used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fluxcd/kustomize-controller/security/advisories/GHSA-35rf-v2jv-gfg7
CVE ID: CVE-2021-41256 State: PUBLISHED Published: 2021-11-30T20:55:09 Last Updated: 2024-08-04T03:08:31.607Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: nextcloud Products: news-android Problem Types: CWE-829 Description: nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or high
access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/news-android/security/advisories/GHSA-2q9v-q3cc-h9f3 - https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85 - https://github.com/nextcloud/news-android/blob/master/security/GHSL-2021-1033_Nextcloud_News_for_Android.md
CVE ID: CVE-2021-41258 State: PUBLISHED Published: 2021-11-16T18:05:18 Last Updated: 2024-08-04T03:08:31.642Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: getkirby Products: kirby Problem Types: CWE-79 Description: Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special characters to protect against cross-site scripting (XSS) attacks. The default snippet for the image block unfortunately did not use our escaping helper. This made it possible to include mali
default snippet for the image block unfortunately did not use our escaping helper. This made it possible to include malicious HTML code in the source, alt and link fields of the image block, which would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. Attackers must be in your group of authenticated Panel users in order to exploit this weakness. Users who do not make use of the blocks field are not affected. This issue has been patched in Kirby version 3.5.8 by escaping special HTML characters in the output from the default image block snippet. Please update to this or a later version to fix the vulnerability.
s in the output from the default image block snippet. Please update to this or a later version to fix the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/getkirby/kirby/releases/tag/3.5.8 - https://github.com/getkirby/kirby/security/advisories/GHSA-cq58-r77c-5jjw - https://github.com/getkirby/kirby/pull/3510
CVE ID: CVE-2021-41259 State: REJECTED Published: N/A Last Updated: 2023-04-07T00:00:00 Description: No description available.
CVE ID: CVE-2021-41260 State: PUBLISHED Published: 2021-12-16T18:10:11 Last Updated: 2024-08-04T03:08:31.567Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: galette Products: galette Problem Types: CWE-352 Description: Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/galette/galette/security/advisories/GHSA-hw28-c7px-xqm5 - https:/
VE Program Container: References: - https://github.com/galette/galette/security/advisories/GHSA-hw28-c7px-xqm5 - https://github.com/galette/galette/commit/a5602bca2566f1be370631c3ab2d40feedd4b3ad
CVE ID: CVE-2021-41261 State: PUBLISHED Published: 2021-12-16T18:10:22 Last Updated: 2024-08-04T03:08:31.660Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: galette Products: galette Problem Types: CWE-79 Description: Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been resolved in the 0.9.6 release and all users are advised to upgrade. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: Refe
ll users are advised to upgrade. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/galette/galette/security/advisories/GHSA-28fg-cp22-6c33 - https://github.com/galette/galette/commit/0d55bc7f420470e0dbca91ebe7899c592905cbc5
CVE ID: CVE-2021-41262 State: PUBLISHED Published: 2021-12-16T18:10:16 Last Updated: 2024-08-04T03:08:31.604Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: galette Products: galette Problem Types: CWE-89 Description: Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to SQL injection attacks by users with "member" privilege. Users are advised to upgrade to version 0.9.6 as soon as possible. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/galette/galette/security/advisories/GHSA-936f-xvgq-fg74 - h
s: - CVE Program Container: References: - https://github.com/galette/galette/security/advisories/GHSA-936f-xvgq-fg74 - https://github.com/galette/galette/commit/8e940641b5ed46c3f471332827df388ea00a85d3
CVE ID: CVE-2021-41263 State: PUBLISHED Published: 2021-11-15T20:10:11 Last Updated: 2024-08-04T03:08:31.596Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: discourse Products: rails_multisite Problem Types: CWE-200, CWE-565 Description: rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application. The issue has been patched in v4 of the `rails_mult
cookies on different 'sites' within a multi-site Rails application. The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh - https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0
CVE ID: CVE-2021-41264 State: PUBLISHED Published: 2021-11-12T17:55:11 Last Updated: 2024-08-04T03:08:31.576Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenZeppelin Products: openzeppelin-contracts Problem Types: CWE-665 Description: OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking
acts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5vp3-v4hc-gx76 - https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f78539819749e94d6df60592 - https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301
CVE ID: CVE-2021-41265 State: PUBLISHED Published: 2021-12-09T16:40:11 Last Updated: 2024-08-04T03:08:31.645Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: dpgaspar Products: Flask-AppBuilder Problem Types: CWE-287 Description: Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.
s only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q - https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbc - https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4
CVE ID: CVE-2021-41266 State: PUBLISHED Published: 2021-11-15T20:20:10 Last Updated: 2024-08-04T03:08:31.619Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: minio Products: console Problem Types: CWE-306 Description: Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affected and are advised to update to 0.12.3 or newer. Users unable to upgrade should add automountServiceAccountToken: false to the operator-console deploymen
.12.3 or newer. Users unable to upgrade should add automountServiceAccountToken: false to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the CONSOLE_IDP_URL, CONSOLE_IDP_CLIENT_ID, CONSOLE_IDP_SECRET and CONSOLE_IDP_CALLBACK environment variable and instead use the Kubernetes service account token. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/minio/console/security/advisories/GHSA-4999-659w-mq36 - https://github.com/minio/console/pull/1217
CVE ID: CVE-2021-41267 State: PUBLISHED Published: 2021-11-24T18:55:17 Last Updated: 2024-08-04T03:08:31.656Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: symfony Products: symfony Problem Types: CWE-444 Description: Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the "trusted_heade
X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure that the `X-Forwarded-Prefix` header is not forwarded to subrequests when it is not trusted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/pull/44243 - https://github.com/symfony/symfony/releases/tag/v5.3.12 - https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q - https://github.com/symfony/s
/tag/v5.3.12 - https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q - https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487
CVE ID: CVE-2021-41268 State: PUBLISHED Published: 2021-11-24T18:55:12 Last Updated: 2024-08-04T03:08:31.842Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: symfony Products: symfony Problem Types: CWE-384 Description: Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me
e account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie. Starting with version 5.3.12, Symfony makes the password part of the signature by default. In that way, when the password changes, then the cookie is not valid anymore. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/security/advisories/GHSA-qw36-p97w-vcqr - https://github.com/symfony/symfony/pull/44243 - https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfc - https://github.com/symfony/symfony/releases/tag/v5.3.12
CVE ID: CVE-2021-41269 State: PUBLISHED Published: 2021-11-15T20:30:14 Last Updated: 2024-08-04T03:08:31.579Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: jmrozanec Products: cron-utils Problem Types: CWE-94 Description: cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotati
ty. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jmrozanec/cron-utils/issues/461 - https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-p9m8-27x8-rg87 - https://github.com/jmrozanec/cron-utils/commit/cfd2880f80e62ea74b92fa83474c2aabdb9899da - https://github.com/jmrozanec/cron-utils/commit/d6707503ec2f20947f79e38f861dba93b39df9da
CVE ID: CVE-2021-41270 State: PUBLISHED Published: 2021-11-24T19:05:11 Last Updated: 2024-08-04T03:08:31.658Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: symfony Products: symfony Problem Types: CWE-1236 Description: Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+
maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendations and uses the single quote `'` to prefix formulas and add the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfo
well as `=`, `+`, `-` and `@`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/pull/44243 - https://github.com/symfony/symfony/releases/tag/v5.3.12 - https://github.com/symfony/symfony/security/advisories/GHSA-2xhg-w2g5-w95x - https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP/
CVE ID: CVE-2021-41271 State: PUBLISHED Published: 2021-11-15T21:20:11 Last Updated: 2024-08-04T03:08:31.897Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories
itional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-hf6r-mc9j-hf4p - https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1
CVE ID: CVE-2021-41272 State: PUBLISHED Published: 2021-12-13T21:10:11 Last Updated: 2024-08-04T03:08:31.638Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: hyperledger Products: besu Problem Types: CWE-681 Description: Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contracts that ask for shifts between approximately 2 billion and 4 billion bits (nonsensical but valid values for the operation) will fail to execute and hence fail to val
2 billion and 4 billion bits (nonsensical but valid values for the operation) will fail to execute and hence fail to validate. In networks where vulnerable versions are mining with other clients or non-vulnerable versions this will result in a fork and the relevant transactions will not be included in the fork. In networks where vulnerable versions are not mining (such as Rinkeby) no fork will result and the validator nodes will stop accepting blocks. In networks where only vulnerable versions are mining the relevant transaction will not be included in any blocks. When the network adds a non-vulnerable version the network will act as in the first case. Besu 21.10.2 contains a patch for this
network adds a non-vulnerable version the network will act as in the first case. Besu 21.10.2 contains a patch for this issue. Besu 21.7.4 is not vulnerable and clients can roll back to that version. There is a workaround available: Once a transaction with the relevant shift operations is included in the canonical chain, the only remediation is to make sure all nodes are on non-vulnerable versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hyperledger/besu/security/advisories/GHSA-7pg2-p5vj-xp5h - https://github.com/hyperledger/besu/pull/3039 - https://github.com/hyperledger/besu/commit/4170524ac3b45185704fcfbdeeb71b0b05dfa0a1
CVE ID: CVE-2021-41273 State: PUBLISHED Published: 2021-11-17T19:30:12 Last Updated: 2024-08-04T03:08:31.614Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: pterodactyl Products: panel Problem Types: CWE-352 Description: Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a si
data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6 - https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5
CVE ID: CVE-2021-41274 State: PUBLISHED Published: 2021-11-17T19:55:11 Last Updated: 2024-08-04T03:08:31.696Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: solidusio Products: solidus_auth_devise Problem Types: CWE-352 Description: solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A
e affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details. Additional Analyst Notes: - CVE Program Co