Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes after it was made. Users are encouraged to upgrade to the latest commit if they are running Discourse against the `tests-passed` branch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-vm3x-w6jm-j9vv - https://github.com/discourse/discourse/commit/27bad28c530c89acab35a56b945b6a3924280f4b - https://github.com/discourse/discourse/commit/ddb458343dc39a7a8c99467dcd809b444514fe2c
CVE ID: CVE-2021-41083 State: PUBLISHED Published: 2021-09-20T21:30:13 Last Updated: 2024-08-04T02:59:31.378Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: justingit Products: dada-mail Problem Types: CWE-352 Description: Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control of the list control panel as if the bad actor was logged in themselves. This includes changing any mailing list password, as well as the Dada Mail Root Password - which could effectively shut out actual list owners of the mailing list and allow th
ll as the Dada Mail Root Password - which could effectively shut out actual list owners of the mailing list and allow the bad actor complete and unfettered control of your mailing list. This vulnerability also affects profile logins. For this vulnerability to work, the target of the bad actor would need to be logged into the list control panel themselves. This CSRF vulnerability in Dada Mail affects all versions of Dada Mail v11.15.1 and below. Although we know of no known CSRF exploits that have happened in the wild, this vulnerability has been confirmed by our testing, and by a third party. Users are advised to update to version 11.16.0. Additional Analyst Notes: - CVE Program Container: R
d by a third party. Users are advised to update to version 11.16.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/justingit/dada-mail/security/advisories/GHSA-344m-p829-2r38 - https://github.com/justingit/dada-mail/commit/d4d3d86d08c816b4da75a5ef45abc12188772459
CVE ID: CVE-2021-41084 State: PUBLISHED Published: 2021-09-21T17:20:14 Last Updated: 2024-08-04T02:59:31.504Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: http4s Products: http4s Problem Types: CWE-918 Description: http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0
(`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3 - https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8 - https://httpwg.org/http-core/draft-ietf-h
s://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8 - https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values - https://owasp.org/www-community/attacks/HTTP_Response_Splitting
CVE ID: CVE-2021-41086 State: PUBLISHED Published: 2021-09-21T21:00:12 Last Updated: 2024-08-04T02:59:31.417Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: jsuites Products: jsuites Problem Types: CWE-79 Description: jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and t
is is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsuites/jsuites/security/advisories/GHSA-qh7x-j4v8-qw5w - https://github.com/jsuites/jsuites/commit/d47a6f4e143188dde2742f4cffd313e1068ad3b3 - https://github.com/jsuites/jsuites/commit/fe1d3cc5e339f2f4da8ed1f9f42271fdf9cbd8d2
CVE ID: CVE-2021-41087 State: PUBLISHED Published: 2021-09-21T21:05:15 Last Updated: 2024-08-04T02:59:31.359Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: in-toto Products: in-toto-golang Problem Types: CWE-345 Description: in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path t
er with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3 - https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290
CVE ID: CVE-2021-41088 State: PUBLISHED Published: 2021-09-23T19:55:10 Last Updated: 2024-08-04T02:59:31.522Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: elves Products: elvish Problem Types: CWE-668 Description: Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in loca
backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/elves/elvish/security/advisories/GHSA-fpv6-f8jw-rc3r - https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5
CVE ID: CVE-2021-41089 State: PUBLISHED Published: 2021-10-04T20:20:15 Last Updated: 2024-08-04T02:59:31.512Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: moby Products: moby Problem Types: CWE-281 Description: Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has b
oes not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4 - https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject
ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/ - https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
CVE ID: CVE-2021-41090 State: PUBLISHED Published: 2021-12-08T16:15:19 Last Updated: 2024-08-04T02:59:31.578Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: grafana Products: agent Problem Types: CWE-200 Description: Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defined in the base YAML file are exposed at `/-/config` and metrics instance configs defined for the scraping service are exposed at `/agent/api/v1/configs
posed at `/-/config` and metrics instance configs defined for the scraping service are exposed at `/agent/api/v1/configs/:key`. Inline secrets will be exposed to anyone being able to reach these endpoints. If HTTPS with client authentication is not configured, these endpoints are accessible to unauthenticated users. Secrets found in these sections are used for delivering metrics to a Prometheus Remote Write system, authenticating against a system for discovering Prometheus targets, and authenticating against a system for collecting metrics. This does not apply for non-inlined secrets, such as `*_file` based secrets. This issue is patched in Grafana Agent versions 0.20.1 and 0.21.2. A few wor
ed secrets, such as `*_file` based secrets. This issue is patched in Grafana Agent versions 0.20.1 and 0.21.2. A few workarounds are available. Users who cannot upgrade should use non-inline secrets where possible. Users may also desire to restrict API access to Grafana Agent with some combination of restricting the network interfaces Grafana Agent listens on through `http_listen_address` in the `server` block, configuring Grafana Agent to use HTTPS with client authentication, and/or using firewall rules to restrict external access to Grafana Agent's API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh
Notes: - CVE Program Container: References: - https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh - https://github.com/grafana/agent/pull/1152 - https://github.com/grafana/agent/commit/af7fb01e31fe2d389e5f1c36b399ddc46b412b21 - https://github.com/grafana/agent/releases/tag/v0.20.1 - https://github.com/grafana/agent/releases/tag/v0.21.2 - https://security.netapp.com/advisory/ntap-20211229-0004/
CVE ID: CVE-2021-41091 State: PUBLISHED Published: 2021-10-04T20:20:09 Last Updated: 2024-08-04T02:59:31.575Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: moby Products: moby Problem Types: CWE-281 Description: Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileg
cute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers. Ad
sers unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558 - https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/ - https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
CVE ID: CVE-2021-41092 State: PUBLISHED Published: 2021-10-04T20:10:10 Last Updated: 2024-08-04T02:59:31.334Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: docker Products: cli Problem Types: CWE-200 Description: Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been
y provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v - https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.
4ba4b048d72e99748e0f86b2767c6c6b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/ - https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
CVE ID: CVE-2021-41093 State: PUBLISHED Published: 2021-10-04T18:15:11 Last Updated: 2024-08-04T02:59:31.525Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: wireapp Products: wire-ios Problem Types: CWE-285 Description: Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together. Additional Analyst Notes: - CVE Pr
-ios-transport references. This is the root advisory that pulls the changes together. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wireapp/wire-ios/security/advisories/GHSA-6f4c-phfj-m255 - https://github.com/wireapp/wire-ios-sync-engine/security/advisories/GHSA-w727-5f74-49xj - https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-p354-6r3m-g4xr - https://github.com/wireapp/wire-server/security/advisories/GHSA-9rm2-w6pq-333m - https://github.com/wireapp/wire-ios/commit/b0e7bb3b13dd8212032cb46e32edf701694687c7
CVE ID: CVE-2021-41094 State: PUBLISHED Published: 2021-10-04T18:20:13 Last Updated: 2024-08-04T02:59:31.399Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: wireapp Products: wire-ios Problem Types: CWE-668 Description: Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fail silently if no device passcode is set. The user has no indication that encryption at rest is not active since the feature is hidden to them. This
code is set. The user has no indication that encryption at rest is not active since the feature is hidden to them. This issue has been resolved in version 3.70 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wireapp/wire-ios/security/advisories/GHSA-h4m7-pr8h-j7rf - https://github.com/wireapp/wire-ios/commit/5ba3eb180efc3fc795d095f9c84ae7f109b84746
CVE ID: CVE-2021-41095 State: PUBLISHED Published: 2021-09-27T19:30:11 Last Updated: 2024-08-04T02:59:31.377Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `stable` branch, versions 2.8.0.beta6 and earlier of the `beta` branch, and versions 2.8.0.beta6 and earlier of the `tests-passed` branch. Rendering of some error messages that contain user input can be susceptible to XSS attacks. This vulnerability only affects sites which have blocked watched words tha
user input can be susceptible to XSS attacks. This vulnerability only affects sites which have blocked watched words that contain HTML tags, modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest `stable`, `beta` and `tests-passed` versions of Discourse. As a workaround, avoid modifying or disabling Discourse’s default Content Security Policy, and blocking watched words containing HTML tags. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-qvqx-2h7w-m479 - https://github.com/discourse/discourse/pull/14434/commits/40b776b9d39c41d9273d01eecf8fe03aa39fcb59
CVE ID: CVE-2021-41096 State: PUBLISHED Published: 2021-09-27T19:25:11 Last Updated: 2024-08-04T02:59:31.528Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mayankmetha Products: Rucky Problem Types: CWE-327 Description: Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm (RSA/ECB/PKCS1Padding). The issue will be patched in v2.3 for release builds and 426 onwards for nightly builds. As a workaround, one may disable an advance security feature if not required. Additional Analyst Notes: - CVE Program Container: Refere
, one may disable an advance security feature if not required. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mayankmetha/Rucky/security/advisories/GHSA-32m7-456v-wgfw - https://github.com/mayankmetha/Rucky/commit/5e3a477365009f488a73efd26a91168502de1b93
CVE ID: CVE-2021-41097 State: PUBLISHED Published: 2021-09-27T17:40:12 Last Updated: 2024-08-04T02:59:31.515Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: aurelia Products: path Problem Types: CWE-1321 Description: aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object
employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv - https://github.com/aurelia/path/issues/44 - https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1 - https://github.com/aurelia/path/releases/tag/1.1.7 - https://www.npmjs.com/package/aurelia-path
CVE ID: CVE-2021-41098 State: PUBLISHED Published: 2021-09-27T19:35:11 Last Updated: 2024-08-04T02:59:31.455Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: sparklemotion Products: nokogiri Problem Types: CWE-611 Description: Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nok
X::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h - https://github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d
CVE ID: CVE-2021-41099 State: PUBLISHED Published: 2021-10-04T18:05:11 Last Updated: 2024-08-04T02:59:31.395Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-190, CWE-680 Description: Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis version