Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-41583 State: PUBLISHED Published: 2021-09-24T02:22:03 Last Updated: 2024-08-04T03:15:29.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS filesystem access, because of the interaction of QR codes with an exec that uses the -r option. This can be leveraged to obtain additional VPN access. Additional Analyst Notes: - CVE Program Container: References: - https://list.surfnet.nl/pipermail/eduvpn-deploy/2021-September/000352.html
CVE ID: CVE-2021-41584 State: PUBLISHED Published: 2021-09-24T02:57:12 Last Updated: 2024-08-04T03:15:28.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com/advisory/2021-02
CVE ID: CVE-2021-41585 State: PUBLISHED Published: 2021-11-03T15:20:25 Last Updated: 2024-08-04T03:15:28.820Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: cwe Description: Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections. This issue affects Apache Traffic Server 5.0.0 to 9.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164
CVE ID: CVE-2021-41586 State: PUBLISHED Published: 2021-09-24T14:18:53 Last Updated: 2024-08-04T03:15:29.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com/advisory/2021-05
CVE ID: CVE-2021-41587 State: PUBLISHED Published: 2021-09-24T14:18:43 Last Updated: 2024-08-04T03:15:29.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com/advisory/2021-04
CVE ID: CVE-2021-41588 State: PUBLISHED Published: 2021-09-24T14:18:31 Last Updated: 2024-08-04T03:15:28.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com/advisory/2021-03
CVE ID: CVE-2021-41589 State: PUBLISHED Published: 2021-10-27T13:31:01 Last Updated: 2024-08-04T03:15:28.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymous write access to the build cache. If access control to the build cache is not changed from the default open configuration, a malicious actor with network access can populate the cache with manipulated entries that may execute mali
nfiguration, a malicious actor with network access can populate the cache with manipulated entries that may execute malicious code as part of a build process. This applies to the build cache provided with Gradle Enterprise and the separate build cache node service if used. If access control to the user interface is not changed from the default open configuration, a malicious actor can undo build cache access control in order to populate the cache with manipulated entries that may execute malicious code as part of a build process. This does not apply to the build cache provided with Gradle Enterprise, but does apply to the separate build cache node service if used. Additional Analyst Notes: -
ded with Gradle Enterprise, but does apply to the separate build cache node service if used. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com - https://security.gradle.com/advisory/2021-06
CVE ID: CVE-2021-41590 State: PUBLISHED Published: 2021-10-27T13:20:17 Last Updated: 2024-08-04T03:15:29.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installation configuration user interface available to administrators allows testing the configured SMTP server settings. This test function can be used to identify the listening TCP ports available to the server, revealing information about the internal network environment. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com - https://security.gradle.com/ad
ional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com - https://security.gradle.com/advisory/2021-07
CVE ID: CVE-2021-41591 State: PUBLISHED Published: 2021-10-04T16:47:56 Last Updated: 2024-08-04T03:15:29.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure. Additional Analyst Notes: - CVE Program Container: References: - https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-May/002714.html - https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixing - https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003257.html - https://github.com/ACINQ/eclair/pull/1985
CVE ID: CVE-2021-41592 State: PUBLISHED Published: 2021-10-04T16:58:55 Last Updated: 2024-08-04T03:15:28.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure. Additional Analyst Notes: - CVE Program Container: References: - https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-May/002714.html - https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixing - https://github.com/ElementsProject/lightning - https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003257.html - https://lists.linuxfoundation.org/pip
tps://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003257.html - https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003264.html
CVE ID: CVE-2021-41593 State: PUBLISHED Published: 2021-10-04T16:54:36 Last Updated: 2024-08-04T03:15:29.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure. Additional Analyst Notes: - CVE Program Container: References: - https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-May/002714.html - https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixing - https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003257.html - https://github.com/lightningnetwork/lnd/releases/tag/v0.13.3-beta - https://github.co
ing-dev/2021-October/003257.html - https://github.com/lightningnetwork/lnd/releases/tag/v0.13.3-beta - https://github.com/lightningnetwork/lnd/blob/master/docs/release-notes/release-notes-0.13.3.md - https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003264.html
CVE ID: CVE-2021-41594 State: PUBLISHED Published: 2022-03-29T23:33:34 Last Updated: 2024-08-04T03:15:28.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieves access to the precluded functions. Additional Analyst Notes: - CVE Program Container: References: - https://www.rsa.com/en-us/company/vulnerability-response-policy - https://www.archerirm.community/t5/security-advisories/archer-an-r
rsa.com/en-us/company/vulnerability-response-policy - https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497
CVE ID: CVE-2021-41595 State: PUBLISHED Published: 2021-10-04T16:46:08 Last Updated: 2024-08-04T03:15:29.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM - https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33 - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22 - https://github.com/ach-ing/cves/blob/main/CVE-2021-41595.md
CVE ID: CVE-2021-41596 State: PUBLISHED Published: 2021-10-04T16:48:19 Last Updated: 2024-08-04T03:15:29.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality. Additional Analyst Notes: - CVE Program Container: References: - https://suitecrm.com - https://github.com/salesagility/SuiteCRM - https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33 - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22 - https://github.com/ach-ing/cves/blob/main/CVE-2021-41596.md
CVE ID: CVE-2021-41597 State: PUBLISHED Published: 2022-01-12T19:17:05 Last Updated: 2024-08-04T03:15:29.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - https://suitecrm.com - https://github.com/salesagility/SuiteCRM - https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35 - https://github.com/ach-ing/cves/blob/main/CVE-2021-41597.md - https://docs.suitecrm.com/admin/releases/
CVE ID: CVE-2021-41598 State: PUBLISHED Published: 2022-01-25T19:45:12 Last Updated: 2024-08-04T03:15:29.207Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-451 Description: A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. All permissions being granted would properly be shown during the first authorization, but if the user later u
tion flow. All permissions being granted would properly be shown during the first authorization, but if the user later updated the set of repositories the app was installed on after the GitHub App had configured additional user-level permissions, those additional permissions would not be displayed, leading to more permissions being granted than the user potentially intended. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.2.5, 3.1.13, 3.0.21. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.0/admin/re
tional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.21 - https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.13 - https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.5
CVE ID: CVE-2021-41599 State: PUBLISHED Published: 2022-02-17T23:35:12 Last Updated: 2024-08-04T03:15:29.207Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-77 Description: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.21, 3.1.13, 3.2.5. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst
n versions 3.0.21, 3.1.13, 3.2.5. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.21 - https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.13 - https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.5
CVE ID: CVE-2021-41608 State: PUBLISHED Published: 2022-01-28T18:02:53 Last Updated: 2024-08-04T03:15:28.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve survey user submitted data by modifying the value of the ID parameter in sequential order beginning from 1. Additional Analyst Notes: - CVE Program Container: References: - https://www.classapps.com/product_ssv5.aspx - https://www.optiv.com/insights/source-zero/blog/classapps-inc-selectsurveynet-v50-vulnerabilities-disclosure
CVE ID: CVE-2021-41609 State: PUBLISHED Published: 2022-01-28T18:02:50 Last Updated: 2024-08-04T03:15:29.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve data from the application's backend database via boolean-based blind and UNION injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.classapps.com/product_ssv5.aspx - https://www.optiv.com/insights/source-zero/blog/classapps-inc-selectsurveynet-v50-vulnerabilities-disclosure
CVE ID: CVE-2021-41610 State: REJECTED Published: 2022-01-04T19:55:44 Last Updated: 2022-01-04T19:58:20 Description: No description available.
CVE ID: CVE-2021-41611 State: PUBLISHED Published: 2021-10-18T08:56:16 Last Updated: 2024-08-04T03:15:29.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v6/changesets/squid-6-43d6b5c81b88ec2256b430c69a872a1e4f324e4a.p
iner: References: - http://www.squid-cache.org/Versions/v6/changesets/squid-6-43d6b5c81b88ec2256b430c69a872a1e4f324e4a.patch - https://github.com/squid-cache/squid/security/advisories/GHSA-47m4-g3mv-9q5r - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CWQ2WKDWTSO47S3F6XJJ6HGG2ULWEAE4/ - http://www.openwall.com/lists/oss-security/2021/12/23/2
CVE ID: CVE-2021-41612 State: PUBLISHED Published: 2023-04-18T00:00:00.000Z Last Updated: 2025-02-06T15:05:09.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract instruction, which results in an incorrect value of the carry flag. Any software that relies on this flag may experience corruption in execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openrisc/mor1kx/issues/139 - https://seth.engr.tamu.edu/software-releases/thehuzz/
CVE ID: CVE-2021-41613 State: PUBLISHED Published: 2023-04-18T00:00:00.000Z Last Updated: 2025-03-05T18:48:53.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EEAR) is not implemented correctly. User programs from authorized privilege levels will be unable to write to EEAR. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openrisc/mor1kx/issues/141 - https://seth.engr.tamu.edu/software-releases/thehuzz/
CVE ID: CVE-2021-41614 State: PUBLISHED Published: 2023-04-18T00:00:00.000Z Last Updated: 2025-02-06T15:00:47.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program Counter Register (EPCR) are not implemented correctly. User programs from an unauthorized privilege level can make read/write accesses to EPCR. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openrisc/mor1kx/issues/140 - https://seth.engr.tamu.edu/software-releases/thehuzz/
CVE ID: CVE-2021-41615 State: PUBLISHED Published: 2022-08-08T18:26:11 Last Updated: 2024-08-04T03:15:29.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected. Additional Analyst Notes: - CVE Program Container: References: - h
used in 2021. Recent GoAhead software is unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://devel.rtems.org/browser/rtems/cpukit/httpd/websda.c?rev=c1427d2758079f0e9dd6a8de1662d78e0d6bc4ca - https://github.com/trenta3/goahead-versions/blob/master/2.1.8/230165webs218.tar.gz?raw=true
CVE ID: CVE-2021-41616 State: PUBLISHED Published: 2021-09-30T07:55:11.000Z Last Updated: 2025-04-23T19:25:26.214Z Vendors: Apache Software Foundation Products: Apache DB ddlutils Problem Types: CWE-502 Description: Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used ObjectInputStream.readObject without validating that the input data was safe to deserialize. Please note that DdlUtils is no longer being actively developed. To address the insecurity of the BinaryObjectHelper
e. Please note that DdlUtils is no longer being actively developed. To address the insecurity of the BinaryObjectHelper class, the following changes to DdlUtils have been made: (1) BinaryObjectsHelper.java has been deleted from the DdlUtils source repository and the DdlUtils feature of propagating data of SQL binary types is therefore no longer present in DdlUtils; (2) The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure; (3) The DdlUtils web site has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://l
a packaged release. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread.html/r3d7a8303a820144f5e2d1fd0b067e18d419421b58346b53b58d3fa72%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-41617 State: PUBLISHED Published: 2021-09-26T00:00:00 Last Updated: 2024-08-04T03:15:29.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssh.com/security.html - https://www.openwa
itional Analyst Notes: - CVE Program Container: References: - https://www.openssh.com/security.html - https://www.openwall.com/lists/oss-security/2021/09/26/1 - https://www.openssh.com/txt/release-8.8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W44V2PFQH5YLRN6ZJTVRKAD7CU6CYYET/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVI7RWM2JLNMWTOFK6BDUSGNOIPZYPUT/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://bugzilla.suse.com/show_bug.cgi?id
OFK6BDUSGNOIPZYPUT/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://bugzilla.suse.com/show_bug.cgi?id=1190975 - https://security.netapp.com/advisory/ntap-20211014-0004/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://www.starwindsoftware.com/security/sw-20220805-0001/ - https://www.tenable.com/plugins/nessus/154174 - https://www.debian.org/security/2023/dsa-5586 - https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html
CVE ID: CVE-2021-41619 State: PUBLISHED Published: 2021-10-27T13:24:37 Last Updated: 2024-08-04T03:15:29.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installation configuration user interface (available to administrators) allows specifying arbitrary Java Virtual Machine startup options. Some of these options, such as -XX:OnOutOfMemoryError, allow specifying a command to be run on the host. This can be abused to run arbitrary commands on the host, should an attacker gain administrative access to the application. Additional Ana
to run arbitrary commands on the host, should an attacker gain administrative access to the application. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com - https://security.gradle.com/advisory/2021-08
CVE ID: CVE-2021-41634 State: PUBLISHED Published: 2022-06-24T11:46:52 Last Updated: 2024-08-04T03:15:29.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames. Additional Analyst Notes: - CVE Program Container: References: - https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/