Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-31806 State: PUBLISHED Published: 2021-05-27T00:00:00 Last Updated: 2024-08-03T23:10:30.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-pxwq-f3qr-w2xf - http://www.squid-cache.org/Versions/v4/changesets/squid-4-e7cf864f938f24eea8af0692c04d16790983c823.patch - https://www.debian.org/security/2021/dsa-4924 - https://lists
s/squid-4-e7cf864f938f24eea8af0692c04d16790983c823.patch - https://www.debian.org/security/2021/dsa-4924 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQ3U54ZCNXR44QRPW3AV2VCS6K3TKCF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4EPIWUZDJAXADDHVOPKRBTQHPBR6H66/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00014.html - https://security.netapp.com/advisory/ntap-20210716-0007/ - http://www.openwall.com/lists/oss-security/2023/10/11/3 - http://seclists.org/fulldisclosure/2023/Oct/14
CVE ID: CVE-2021-31807 State: PUBLISHED Published: 2021-06-08T00:00:00 Last Updated: 2024-08-03T23:10:30.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-pxwq-f3qr-w2xf - http://www.squid-cache.org/Versions/v4/changesets/squid-4-e7cf864f938f24eea8af0692c0
ty/advisories/GHSA-pxwq-f3qr-w2xf - http://www.squid-cache.org/Versions/v4/changesets/squid-4-e7cf864f938f24eea8af0692c04d16790983c823.patch - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQ3U54ZCNXR44QRPW3AV2VCS6K3TKCF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4EPIWUZDJAXADDHVOPKRBTQHPBR6H66/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00014.html - https://security.netapp.com/advisory/ntap-20210716-0007/ - http://www.openwall.com/lists/oss-security/2023/10/11/3 - http://seclists.org/fulldisclosure/2023/Oct/14
CVE ID: CVE-2021-31808 State: PUBLISHED Published: 2021-05-27T00:00:00 Last Updated: 2024-08-03T23:10:30.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-pxwq-f3qr-w2xf - http://www.squid-cache.org/Versions/v4/changesets/squid-4-e7cf864f938f24eea8af0692c04d16790983c823.patch - https://www.debian.org/security/2021/dsa-
ersions/v4/changesets/squid-4-e7cf864f938f24eea8af0692c04d16790983c823.patch - https://www.debian.org/security/2021/dsa-4924 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQ3U54ZCNXR44QRPW3AV2VCS6K3TKCF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4EPIWUZDJAXADDHVOPKRBTQHPBR6H66/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00014.html - https://security.netapp.com/advisory/ntap-20210716-0007/ - http://www.openwall.com/lists/oss-security/2023/10/11/3 - http://seclists.org/fulldisclosure/2023/Oct/14
CVE ID: CVE-2021-31810 State: PUBLISHED Published: 2021-07-13T00:00:00 Last Updated: 2024-08-03T23:10:30.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1145454 - https://lists.fedoraproject.org
st Notes: - CVE Program Container: References: - https://hackerone.com/reports/1145454 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/ - https://security.netapp.com/advisory/ntap-20210917-0001/ - https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html - https://security.gentoo.org/glsa/202401-27
CVE ID: CVE-2021-31811 State: PUBLISHED Published: 2021-06-12T09:45:11 Last Updated: 2024-08-03T23:10:30.183Z Vendors: Apache Software Foundation Products: Apache PDFBox Problem Types: CWE-789 Description: In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apache.org%3E - https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apach
- https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apache.org%3E - https://lists.apache.org/thread.html/rf937c2236e6c79cdb99f76a70690dd345e53dbe0707cb506a202e43e%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/06/12/2 - https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea%40%3Ccommits.ofbiz.
%3E - https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba%40%3Ccommits.ofbiz.apache.org%3E - https://lists.fedoraproject.org/
cd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba%40%3Ccommits.ofbiz.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-31812 State: PUBLISHED Published: 2021-06-12T09:45:11 Last Updated: 2024-08-03T23:10:30.239Z Vendors: Apache Software Foundation Products: Apache PDFBox Problem Types: CWE-834 Description: In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e%40%3Cusers.pdfbox.apache.org%3E - https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e%40%3Cusers.pdfbox.apache.org%3E
//lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e%40%3Cusers.pdfbox.apache.org%3E - https://lists.apache.org/thread.html/rf251f6c358087107f8c23473468b279d59d50a75db6b4768165c78d3%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/06/12/1 - https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea%40%3Ccommits.ofbiz.apache.o
tps://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba%40%3Ccommits.ofbiz.apache.org%3E - https://lists.fedoraproject.org/archives
cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba%40%3Ccommits.ofbiz.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-31813 State: PUBLISHED Published: 2021-07-01T11:58:51 Last Updated: 2024-08-03T23:10:30.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2021-31813.html - https://raxis.com/blog/cve-2021-31813
CVE ID: CVE-2021-31814 State: PUBLISHED Published: 2022-02-10T16:28:15 Last Updated: 2024-08-03T23:10:31.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker can block a client from accessing the VPN and can obtain sensitive information through the SN VPN SSL Client. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu/ - https://advisories.stormshield.eu/2021-019/
CVE ID: CVE-2021-31815 State: PUBLISHED Published: 2021-04-28T01:52:13 Last Updated: 2024-08-03T23:10:31.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a user's location history, in-person social graph, and (sometimes) COVID-19 infection status, because Rolling Proximity Identifiers and MAC addresses are written to the Android system log, and many Android devices have applications (preinstalled by the hardware manufacturer or network operator) that read system log data and send it to third parties. NOTE: a news outlet (The Markup) states that
r network operator) that read system log data and send it to third parties. NOTE: a news outlet (The Markup) states that they received a vendor response indicating that fix deployment "began several weeks ago and will be complete in the coming days." Additional Analyst Notes: - CVE Program Container: References: - https://themarkup.org/privacy/2021/04/27/google-promised-its-contact-tracing-app-was-completely-private-but-it-wasnt - https://blog.appcensus.io/2021/04/27/why-google-should-stop-logging-contact-tracing-data/
CVE ID: CVE-2021-31816 State: PUBLISHED Published: 2021-07-08T10:43:39 Last Updated: 2024-08-03T23:10:30.262Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Cleartext Storage of Sensitive Information (Windows) Description: When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/adv/2021-05---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-31816%29.2121793537.html
CVE ID: CVE-2021-31817 State: PUBLISHED Published: 2021-07-08T10:43:40 Last Updated: 2024-08-03T23:10:30.181Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Cleartext Storage of Sensitive Information (Linux Container) Description: When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/adv/2021-06---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-31817%29.2121138201.html
CVE ID: CVE-2021-31818 State: PUBLISHED Published: 2021-06-17T13:22:17 Last Updated: 2024-08-03T23:10:30.820Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: SQL Injection Description: Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/adv/2021-04---SQL-Injection-in-the-Events-REST-API-%28CVE-2021-31818%29.2013233248.html
CVE ID: CVE-2021-31819 State: PUBLISHED Published: 2021-09-22T01:45:10 Last Updated: 2024-08-03T23:10:30.129Z Vendors: Octopus Deploy Products: Halibut Problem Types: Remote Code Execution via Deserialisation in the Halibut Protocol Description: In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-%28CVE-2021-31819%29.2250309681.html
CVE ID: CVE-2021-31820 State: PUBLISHED Published: 2021-08-18T10:43:57 Last Updated: 2024-08-03T23:10:29.992Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Proxy Password Stored in Plaintext Description: In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/adv/2021-07---Proxy-Password-Stored-in-Plaintext-%28CVE-2021-31820%29.2193063986.html
CVE ID: CVE-2021-31821 State: PUBLISHED Published: 2022-01-19T05:25:10 Last Updated: 2024-08-03T23:10:30.124Z Vendors: Octopus Deploy Products: Octopus Tentacle Problem Types: Cleartext Storage of Sensitive Information in Octopus Tentacle Windows Docker image Description: When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext. This does not affect the Linux Docker image Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2022/sa2022-01/
CVE ID: CVE-2021-31822 State: PUBLISHED Published: 2021-11-24T00:35:09 Last Updated: 2024-08-03T23:10:30.119Z Vendors: Octopus Deploy Products: Octopus Tentacle Problem Types: Local privilege escalation in Octopus Tentacle Description: When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged user modifying the contents of the systemd service file to gain privileged access. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/adv/2021-11---Local-privilege-escalation-in-Octopus-Tentacle-%28CVE-2021-31822%29.2283732993.html
CVE ID: CVE-2021-31826 State: PUBLISHED Published: 2021-04-27T03:33:47 Last Updated: 2024-08-03T23:10:30.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied. Additional Analyst Notes: - CVE Program Container: References: - https://shibboleth.net/community/advisories/secadv_20210426.txt - https://issues.shibboleth.net/jira/browse/SSPCPP-927 - https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=5a47c3b9378f4c49392dd4d15189b70956f9f2ec -
se/SSPCPP-927 - https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=5a47c3b9378f4c49392dd4d15189b70956f9f2ec - https://bugs.debian.org/987608 - https://www.debian.org/security/2021/dsa-4905
CVE ID: CVE-2021-31827 State: PUBLISHED Published: 2021-05-18T10:25:22 Last Updated: 2024-08-03T23:10:30.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. This is in MOVEit.DMZ.WebApp in SILHuma
in addition to executing SQL statements that alter or destroy database elements. This is in MOVEit.DMZ.WebApp in SILHuman.vb. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/moveit - https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-April-2021 - https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm
CVE ID: CVE-2021-31828 State: PUBLISHED Published: 2021-05-06T18:13:18 Last Updated: 2024-08-03T23:10:30.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Alerting plugin's intended scope. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opendistro-for-elasticsearch/alerting/pull/353 - https://opendistro.github.io/for-elasticsearch-docs/version-history/ - https://rotem-bar.com/ssrf-in-open-distro-for-elasticsearch-cve-2021-31828
CVE ID: CVE-2021-31829 State: PUBLISHED Published: 2021-05-06T15:43:01 Last Updated: 2024-08-03T23:10:30.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized data that might represent sensitive information previously operated on by the kernel. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2021/05/04/4 - http://
Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2021/05/04/4 - http://www.openwall.com/lists/oss-security/2021/05/04/4 - https://github.com/torvalds/linux/commit/801c6058d14a82179a7ee17a4b532cac6fad067f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4X2G5YAPYJGI3PFEZZNOTRYI33GOCCZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VWCZ6LJLENL2C3URW5ICARTACXPFCFN2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZI7OBCJQDNWMKLBP6MZ5NV4EUTDAMX6Q/ - https://lists.debian.org/debian-lts-announce/2
nce%40lists.fedoraproject.org/message/ZI7OBCJQDNWMKLBP6MZ5NV4EUTDAMX6Q/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
CVE ID: CVE-2021-31830 State: PUBLISHED Published: 2021-06-03T10:10:16 Last Updated: 2024-08-03T23:10:30.698Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: McAfee,LLC Products: McAfee Database Security (DBSec) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to embed JavaScript code when configuring the name of a database to be monitored. This would be triggered when any authorized user logs into the DBSec interface and opens the properties configuration page for this database. Additional Analyst No
user logs into the DBSec interface and opens the properties configuration page for this database. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE ID: CVE-2021-31831 State: PUBLISHED Published: 2021-06-03T10:10:11 Last Updated: 2024-08-03T23:10:30.869Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: McAfee,LLC Products: McAfee Database Security (DBSec) Problem Types: CWE-552 Description: Incorrect access to deleted scripts vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to gain access to signed SQL scripts which have been marked as deleted or expired within the administrative console. This access was only available through the REST API. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=
e REST API. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE ID: CVE-2021-31832 State: PUBLISHED Published: 2021-06-09T13:45:17 Last Updated: 2024-08-03T23:10:30.156Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: McAfee,LLC Products: McAfee Data Loss Prevention (DLP) Endpoint for Windows Problem Types: CWE-79 Description: Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScript code into the alert configuration text field. This JavaScript will be executed when an end user triggers a DLP policy on their machine. Additional Analyst Notes: - CVE Program Container: Refere
cuted when an end user triggers a DLP policy on their machine. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10360