Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-25287 State: PUBLISHED Published: 2021-06-02T15:13:14 Last Updated: 2024-08-03T19:56:11.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode - https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ - https://security.gento
hives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ - https://security.gentoo.org/glsa/202107-33
CVE ID: CVE-2021-25288 State: PUBLISHED Published: 2021-06-02T15:13:28 Last Updated: 2024-08-03T19:56:11.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode - https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ - https://security.gentoo.
ves/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ - https://security.gentoo.org/glsa/202107-33
CVE ID: CVE-2021-25289 State: PUBLISHED Published: 2021-03-19T03:29:48 Last Updated: 2024-08-03T19:56:11.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html - https://security.gentoo.org/glsa/202107-33
CVE ID: CVE-2021-25290 State: PUBLISHED Published: 2021-03-19T03:29:57 Last Updated: 2024-08-03T19:56:11.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html - https://security.gentoo.org/glsa/202107-33 - https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
CVE ID: CVE-2021-25291 State: PUBLISHED Published: 2021-03-19T03:30:09 Last Updated: 2024-08-03T19:56:11.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html - https://security.gentoo.org/glsa/202107-33
CVE ID: CVE-2021-25292 State: PUBLISHED Published: 2021-03-19T03:30:39 Last Updated: 2024-08-03T19:56:11.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html - https://security.gentoo.org/glsa/202107-33
CVE ID: CVE-2021-25293 State: PUBLISHED Published: 2021-03-19T03:30:46 Last Updated: 2024-08-03T19:56:11.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html - https://security.gentoo.org/glsa/202107-33
CVE ID: CVE-2021-25294 State: PUBLISHED Published: 2021-01-18T05:28:37 Last Updated: 2024-08-03T19:56:11.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an __destruct magic method in guzzlehttp. Additional Analyst Notes: - CVE Program Container: References: - https://snoopysecurity.github.io/web-application-security/2021/01/16/09_opencats_php_object_injection.html - https://github.com/snoopysecurity/snoopys
io/web-application-security/2021/01/16/09_opencats_php_object_injection.html - https://github.com/snoopysecurity/snoopysecurity.github.io/blob/master/web-application-security/2021/01/16/09_opencats_php_object_injection.html - https://www.opencats.org/news/
CVE ID: CVE-2021-25295 State: PUBLISHED Published: 2021-01-18T05:28:20 Last Updated: 2024-08-03T19:56:11.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues. Additional Analyst Notes: - CVE Program Container: References: - https://snoopysecurity.github.io/web-application-security/2021/01/16/09_opencats_php_object_injection.html - https://github.com/snoopysecurity/snoopysecurity.github.io/blob/master/web-application-security/2021/01/16/09_opencats_php_object_injection.html - https://www.opencats.org/news/
CVE ID: CVE-2021-25296 State: PUBLISHED Published: 2021-02-15T00:00:00.000Z Last Updated: 2025-10-21T23:35:27.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://nagios.com - https://assets.nagios.com/downloads/nagiosxi/versions.php - https://github.com/
hment: References: - http://nagios.com - https://assets.nagios.com/downloads/nagiosxi/versions.php - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md - http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html - http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html - https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and
CVE ID: CVE-2021-25297 State: PUBLISHED Published: 2021-02-15T00:00:00.000Z Last Updated: 2025-10-21T23:35:27.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://nagios.com - https://assets.nagios.com/downloads/nagiosxi/versions.php - https://github.com/fs0c-sh/
eferences: - http://nagios.com - https://assets.nagios.com/downloads/nagiosxi/versions.php - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md - http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html - http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html - https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and
CVE ID: CVE-2021-25298 State: PUBLISHED Published: 2021-02-15T00:00:00.000Z Last Updated: 2025-10-21T23:35:26.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://nagios.com - https://assets.nagios.com/downloads/nagiosxi/versions.php - https://github.com/fs0c
t: References: - http://nagios.com - https://assets.nagios.com/downloads/nagiosxi/versions.php - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md - http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html - http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html - https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and
CVE ID: CVE-2021-25299 State: PUBLISHED Published: 2021-02-15T12:32:03 Last Updated: 2024-08-03T20:03:04.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server. Additional Analyst Notes: - CVE Program Container: References: - http://nagios.com - https://assets.nagios
os XI server. Additional Analyst Notes: - CVE Program Container: References: - http://nagios.com - https://assets.nagios.com/downloads/nagiosxi/versions.php - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md - http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html
CVE ID: CVE-2021-25306 State: PUBLISHED Published: 2021-03-02T00:40:16 Last Updated: 2024-08-03T20:03:05.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in the AT command interface of Gigaset DX600A v41.00-175 devices allows remote attackers to force a device reboot by sending relatively long AT commands. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/02/28/technical-advisory-administrative-passcode-recovery-and-authenticated-remote-buffer-overflow-vulnerabilities-in-gigaset-dx600a-handset-cve-2021-25309-cve-2021-25306/
CVE ID: CVE-2021-25309 State: PUBLISHED Published: 2021-03-02T00:41:00 Last Updated: 2024-08-03T20:03:05.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situation (together with the weak password policy that forces a 4-digit password) allows remote attackers to easily obtain administrative access via brute-force attacks. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/02/28/technical-advisory-administrative-passcode-recovery-and-authenticated-remote-buffer-overflow-vulnera
roup.com/2021/02/28/technical-advisory-administrative-passcode-recovery-and-authenticated-remote-buffer-overflow-vulnerabilities-in-gigaset-dx600a-handset-cve-2021-25309-cve-2021-25306/
CVE ID: CVE-2021-25310 State: PUBLISHED Published: 2021-02-02T14:01:08 Last Updated: 2024-08-03T20:03:04.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the ui_language POST parameter to the apply.cgi form endpoint. This occurs in do_upgrade_post in mini_httpd. NOTE: This vulnerability only affects products that are no longer supported by the maintaine Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/?res
tional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/?research=Technical%20advisories - https://research.nccgroup.com/2021/01/28/technical-advisory-linksys-wrt160nl-authenticated-command-injection-cve-2021-25310/
CVE ID: CVE-2021-25311 State: PUBLISHED Published: 2021-01-27T15:56:07 Last Updated: 2024-08-03T20:03:04.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory, as demonstrated by creating a file under /etc that will later be executed by root. Additional Analyst Notes: - CVE Program Container: References: - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0002.html
CVE ID: CVE-2021-25312 State: PUBLISHED Published: 2021-01-27T15:54:58 Last Updated: 2024-08-03T20:03:05.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method. Additional Analyst Notes: - CVE Program Container: References: - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0001.html
CVE ID: CVE-2021-25313 State: PUBLISHED Published: 2021-03-05T08:35:19.239350Z Last Updated: 2024-09-17T01:22:12.189Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: SUSE Products: Rancher Problem Types: CWE-79 Description: A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1181852 - https://github.com/rancher/rancher/issues/31583 - https://github.com/rancher/ranch
la.suse.com/show_bug.cgi?id=1181852 - https://github.com/rancher/rancher/issues/31583 - https://github.com/rancher/rancher/releases/tag/v2.5.6
CVE ID: CVE-2021-25314 State: PUBLISHED Published: 2021-04-14T15:00:17.561172Z Last Updated: 2024-09-17T01:35:35.573Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Availability 12-SP5, SUSE Linux Enterprise High Availability 15-SP2 Problem Types: CWE-378 Description: A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Availability 12-SP5, SUSE Linux Enterprise High Availability 15-SP2 allows local attackers to escalate to root. This issue affects: SUSE Linux Enterpris
Enterprise High Availability 15-SP2 allows local attackers to escalate to root. This issue affects: SUSE Linux Enterprise High Availability 12-SP3 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 12-SP5 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 15-SP2 hawk2 versions prior to 2.6.3+git.1614684118.af555ad9. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1182166
CVE ID: CVE-2021-25315 State: PUBLISHED Published: 2021-03-03T09:55:16.356867Z Last Updated: 2024-09-16T21:03:45.719Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server 15 SP 3, Tumbleweed Problem Types: CWE-287 Description: CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affe
15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1182382
CVE ID: CVE-2021-25316 State: PUBLISHED Published: 2021-04-14T09:55:12.766065Z Last Updated: 2024-09-17T03:32:49.137Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: SUSE Products: SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 Problem Types: CWE-377 Description: A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions prior to 2.1.0-18.29.1. SUSE Linux Enterprise Server 15-SP2 s390-tools versions prior to 2.11.0-9.20.1. Additional Analy
prior to 2.1.0-18.29.1. SUSE Linux Enterprise Server 15-SP2 s390-tools versions prior to 2.11.0-9.20.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1182777
CVE ID: CVE-2021-25317 State: PUBLISHED Published: 2021-05-05T09:35:13.321996Z Last Updated: 2024-09-17T00:32:16.952Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9, openSUSE Leap 15.2, Factory Problem Types: CWE-276 Description: A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the abil
ctory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1184161 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H74BP746O5NNVCBUTLLZYAFB
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H74BP746O5NNVCBUTLLZYAFBPESFVECV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S37IDQGHTORQ3Z6VRDQIGBYVOI27YG47/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWPGZLT3U776Q5YPPSA6LGFWWBDWBVH3/
CVE ID: CVE-2021-25318 State: PUBLISHED Published: 2021-07-15T08:55:15.569132Z Last Updated: 2024-09-16T20:37:30.651Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Rancher Products: Rancher Problem Types: CWE-732 Description: A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1184913
CVE ID: CVE-2021-25319 State: PUBLISHED Published: 2021-05-05T08:25:13.677536Z Last Updated: 2024-09-16T22:24:55.435Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: openSUSE Products: Factory Problem Types: CWE-276 Description: A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1182918
CVE ID: CVE-2021-25320 State: PUBLISHED Published: 2021-07-15T08:55:17.141837Z Last Updated: 2024-09-16T20:21:51.810Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Rancher Products: Rancher Problem Types: CWE-284 Description: A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach the requested credentials without further checks This issue affects: Rancher versions prior to 2.5.9; Rancher versions prior to 2.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.
ns prior to 2.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1185514
CVE ID: CVE-2021-25321 State: PUBLISHED Published: 2021-06-30T08:25:12.750081Z Last Updated: 2024-09-16T18:43:24.802Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9, Factory, Leap 15.2 Problem Types: CWE-61 Description: A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatc
local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1186240
CVE ID: CVE-2021-25322 State: PUBLISHED Published: 2021-06-10T11:45:11.776686Z Last Updated: 2024-09-17T03:02:08.344Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: openSUSE Products: Leap 15.2, Factory Problem Types: CWE-61 Description: A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior versions. openSUSE Factory python-HyperKitty versions prior to 1.3.4-5.1. Additional Analyst Notes: - CVE Program Container: Re
s. openSUSE Factory python-HyperKitty versions prior to 1.3.4-5.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1182373
CVE ID: CVE-2021-25323 State: PUBLISHED Published: 2021-01-19T15:30:35 Last Updated: 2024-08-03T20:03:05.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/afbf95a478b6e94f532ca0776c79da1b08be7eed