Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-12362. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders - https://www.zerodayinitiative.com/advisories/ZDI-21-264/
CVE ID: CVE-2021-27258 State: PUBLISHED Published: 2021-04-14T15:45:58 Last Updated: 2024-08-03T20:48:15.879Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Orion Platform Problem Types: CWE-284 Description: This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SaveUserSetting endpoint. The issue results from improper restriction of this endpoint to unprivileged users. An attacker can leverage this vulnerability to escalate privileges their privileges from
ndpoint to unprivileged users. An attacker can leverage this vulnerability to escalate privileges their privileges from Guest to Administrator. Was ZDI-CAN-11903. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-192/
CVE ID: CVE-2021-27259 State: PUBLISHED Published: 2021-04-14T15:45:59 Last Updated: 2024-08-03T20:48:15.953Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-190 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before a
issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12021. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-212/
CVE ID: CVE-2021-27260 State: PUBLISHED Published: 2021-04-14T15:46:00 Last Updated: 2024-08-03T20:48:16.050Z Severity: LOW (CVSS 3.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-125 Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the e
onent. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12068. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-213/
CVE ID: CVE-2021-27261 State: PUBLISHED Published: 2021-03-30T14:35:31 Last Updated: 2024-08-03T20:48:15.901Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the
files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12269. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-343/
CVE ID: CVE-2021-27262 State: PUBLISHED Published: 2021-03-30T14:35:32 Last Updated: 2024-08-03T20:48:16.045Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in
embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12270. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-344/
CVE ID: CVE-2021-27263 State: PUBLISHED Published: 2021-03-30T14:35:33 Last Updated: 2024-08-03T20:48:16.108Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in
embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12290. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-345/
CVE ID: CVE-2021-27264 State: PUBLISHED Published: 2021-03-30T14:35:33 Last Updated: 2024-08-03T20:48:16.161Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in
embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12291. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-346/
CVE ID: CVE-2021-27265 State: PUBLISHED Published: 2021-03-30T14:35:34 Last Updated: 2024-08-03T20:48:16.131Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in
embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12292. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-347/
CVE ID: CVE-2021-27266 State: PUBLISHED Published: 2021-03-30T14:35:35 Last Updated: 2024-08-03T20:48:15.880Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in
embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12293. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-348/
CVE ID: CVE-2021-27267 State: PUBLISHED Published: 2021-03-30T14:35:35 Last Updated: 2024-08-03T20:48:16.142Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the o
files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12294. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-349/
CVE ID: CVE-2021-27268 State: PUBLISHED Published: 2021-03-30T14:35:36 Last Updated: 2024-08-03T20:48:15.954Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the o
files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12295. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-350/
CVE ID: CVE-2021-27269 State: PUBLISHED Published: 2021-03-30T14:35:37 Last Updated: 2024-08-03T20:48:16.146Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the
files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process Was ZDI-CAN-12390. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-351/
CVE ID: CVE-2021-27270 State: PUBLISHED Published: 2021-03-30T14:35:37 Last Updated: 2024-08-03T20:48:15.987Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an
e issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12230. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-352/
CVE ID: CVE-2021-27271 State: PUBLISHED Published: 2021-03-30T14:35:38 Last Updated: 2024-08-03T20:48:16.025Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in an out-
ed in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in an out-of-bounds read condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12438. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-21-353/
CVE ID: CVE-2021-27272 State: PUBLISHED Published: 2021-03-29T20:55:22 Last Updated: 2024-08-03T20:48:15.877Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: NETGEAR Products: ProSAFE Network Management System Problem Types: CWE-22 Description: This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ReportTemplateController class. When parsing the path parameter, the process does not properly validate a user-supp
the ReportTemplateController class. When parsing the path parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12123. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000062723/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0537 - https://www.zerodayinitiative.com/advisories/ZDI-21-355/
CVE ID: CVE-2021-27273 State: PUBLISHED Published: 2021-03-29T20:55:23 Last Updated: 2024-08-03T20:48:16.635Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: ProSAFE Network Management System Problem Types: CWE-78 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SettingConfigController class. When parsing the fileName parameter, the process does not properly validate a user-s
the SettingConfigController class. When parsing the fileName parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-12121. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000062686/Security-Advisory-for-Post-Authentication-Command-Injection-on-NMS300-PSV-2020-0559 - https://www.zerodayinitiative.com/advisories/ZDI-21-356/
CVE ID: CVE-2021-27274 State: PUBLISHED Published: 2021-03-29T20:55:23 Last Updated: 2024-08-03T20:48:15.993Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: ProSAFE Network Management System Problem Types: CWE-434 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MFileUploadController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage t
m the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-12124. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000062688/Security-Advisory-for-Pre-Authentication-Command-Injection-on-NMS300-PSV-2020-0560 - https://www.zerodayinitiative.com/advisories/ZDI-21-357/
CVE ID: CVE-2021-27275 State: PUBLISHED Published: 2021-03-29T20:55:24 Last Updated: 2024-08-03T20:48:16.114Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: NETGEAR Products: ProSAFE Network Management System Problem Types: CWE-22 Description: This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ConfigFileController class. When parsing the realName parameter, the process doe
ed. The specific flaw exists within the ConfigFileController class. When parsing the realName parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information or to create a denial-of-service condition on the system. Was ZDI-CAN-12125. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000062687/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0561 - https://www.zerodayinitiative.com/advisories/ZDI-21-358/
CVE ID: CVE-2021-27276 State: PUBLISHED Published: 2021-03-29T20:55:25 Last Updated: 2024-08-03T20:48:15.935Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: NETGEAR Products: ProSAFE Network Management System Problem Types: CWE-22 Description: This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the MibController class. When parsing the realName parameter, the process does not properly validate a user-supplied pa
the MibController class. When parsing the realName parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12122. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000062722/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0500 - https://www.zerodayinitiative.com/advisories/ZDI-21-359/
CVE ID: CVE-2021-27277 State: PUBLISHED Published: 2021-04-22T17:50:13 Last Updated: 2024-08-03T20:48:16.038Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Orion Virtual Infrastructure Monitor Problem Types: CWE-502 Description: This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the OneTimeJobSchedulerEventsService WCF service. The issue results from the lack of proper validati
flaw exists within the OneTimeJobSchedulerEventsService WCF service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-11955. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-373/ - https://documentation.solarwinds.com/en/Success_Center/SAM/Content/Release_Notes/SAM_2020-2-5_release_notes.htm#Fixed