Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-32715 State: PUBLISHED Published: 2021-07-07T20:05:11 Last Updated: 2024-08-03T23:25:31.081Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: hyperium Products: hyper Problem Types: CWE-444 Description: hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.1
m, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99c - https://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739
CVE ID: CVE-2021-32716 State: PUBLISHED Published: 2021-06-24T21:05:12 Last Updated: 2024-08-03T23:25:31.137Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: shopware Products: platform Problem Types: CWE-200 Description: Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a
he download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopware/platform/security/advisories/GHSA-gpmh-g94g-qrhr - https://github.com/shopware/platform/commit/b5c3ce3e93bd121324d72aa9d367cb636ff1c0eb - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021
CVE ID: CVE-2021-32717 State: PUBLISHED Published: 2021-06-24T21:10:12 Last Updated: 2024-08-03T23:25:31.098Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: shopware Products: platform Problem Types: CWE-200 Description: Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing th
l as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities. Additional Analyst Notes: - CVE Program Container: References: - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021 - https://github.com/shopware/platform/security/advisories/G
m/en/shopware-6-en/security-updates/security-update-06-2021 - https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52v - https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3
CVE ID: CVE-2021-32718 State: PUBLISHED Published: 2021-06-28T14:50:10 Last Updated: 2024-08-03T23:25:31.192Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: rabbitmq Products: rabbitmq-server Problem Types: CWE-80 Description: RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The v
age. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-rg5h-2772 - https://github.com/rabbitmq/rabbitmq-server/pull/3028 - http://seclists.org/fulldisclosure/2021/Dec/3
CVE ID: CVE-2021-32719 State: PUBLISHED Published: 2021-06-28T15:15:11 Last Updated: 2024-08-03T23:25:31.107Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: rabbitmq Products: rabbitmq-server Problem Types: CWE-80 Description: RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper <script> tag sanitization. This potentially allows for JavaScript code execution in the context of the page. The user must be signed in and have elevated permissions (manage federation upst
e execution in the context of the page. The user must be signed in and have elevated permissions (manage federation upstreams and policies) for this to occur. The vulnerability is patched in RabbitMQ 3.8.18. As a workaround, disable the `rabbitmq_federation_management` plugin and use [CLI tools](https://www.rabbitmq.com/cli.html) instead. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-hxj4-773x - https://github.com/rabbitmq/rabbitmq-server/pull/3122 - https://herolab.usd.de/security-advisories/usd-2021-0011/
CVE ID: CVE-2021-32720 State: PUBLISHED Published: 2021-06-28T18:45:11 Last Updated: 2024-08-03T23:25:31.162Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Sylius Products: Sylius Problem Types: CWE-200 Description: Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, h
the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, however, could be used for sociotechnical attacks or may expose a few details about shop condition to the third parties. The data possible to aggregate are the number of processed orders or their value in the moment of time. The problem has been patched at Sylius 1.9.5 and 1.10.0-RC.1. There are a few workarounds for the vulnerability. The first possible solution is to hide the problematic endpoints behind the firewall from not logged in users. This would put only the order list under the firewall and allow only authorized users to access it. Once a user is authorized, it wi
ut only the order list under the firewall and allow only authorized users to access it. Once a user is authorized, it will have access to theirs orders only. The second possible solution is to decorate the `\Sylius\Bundle\ApiBundle\Doctrine\QueryCollectionExtension\OrdersByLoggedInUserExtension` and throw `Symfony\Component\Security\Core\Exception\AccessDeniedException` if the class is executed for unauthorized user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Sylius/Sylius/security/advisories/GHSA-rpxh-vg2x-526v - https://github.com/Sylius/Sylius/releases/tag/v1.9.5
CVE ID: CVE-2021-32721 State: PUBLISHED Published: 2021-06-29T18:40:10 Last Updated: 2024-08-03T23:25:31.079Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: AndrewBurian Products: powermux Problem Types: CWE-601 Description: PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link. The issue is resolved in v1.1.1. There are no existing workarounds. Additional Analyst Notes: - CVE Program Container:
The issue is resolved in v1.1.1. There are no existing workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AndrewBurian/powermux/security/advisories/GHSA-mj9r-wwm8-7q52
CVE ID: CVE-2021-32722 State: PUBLISHED Published: 2021-06-28T19:25:11 Last Updated: 2024-08-03T23:33:54.827Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: miraheze Products: GlobalNewFiles Problem Types: CWE-400 Description: GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulnerability. A large amount of page moves within a short space of time could overwhelm Database servers due to improper handling of load balancing and a lack of an appropriate index. As a workaround, one may avoid use of the extension unless additional rate limit at the MediaWiki le
appropriate index. As a workaround, one may avoid use of the extension unless additional rate limit at the MediaWiki level or via PoolCounter / MySQL is enabled. A patch is available in version 48be7adb70568e20e961ea1cb70904454a671b1d. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-cwv5-c938-5h5h - https://phabricator.miraheze.org/T7532 - https://github.com/miraheze/GlobalNewFiles/commit/48be7adb70568e20e961ea1cb70904454a671b1d - https://github.com/miraheze/GlobalNewFiles/pull/17
CVE ID: CVE-2021-32723 State: PUBLISHED Published: 2021-06-28T19:15:15 Last Updated: 2024-08-03T23:33:54.878Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: PrismJS Products: prism Problem Types: CWE-400 Description: Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highl
round, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg - https://github.com/PrismJS/prism/pull/2688 - https://github.com/PrismJS/prism/pull/2774 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-32724 State: PUBLISHED Published: 2021-09-09T21:00:11 Last Updated: 2024-08-03T23:33:54.893Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: check-spelling Products: check-spelling Problem Types: CWE-532 Description: check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_target` (or `schedule`), an attacker can send a crafted Pull Request that causes a `GITHUB_TOKEN` to be exposed. With the `GITHUB_TOKEN`, it's possible to push commits to the repository bypassi
causes a `GITHUB_TOKEN` to be exposed. With the `GITHUB_TOKEN`, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository. As a workaround users may can either: [Disable the workflow](https://docs.github.com/en/actions/managing-workflow-runs/disabling-and-enabling-a-workflow) until you've fixed all branches or Set repository to [Allow specific actions](https://docs.github.com/en/github/administering-a-repository/managing-repository-settings/disabling-or-limiting-github-actions-for-a-repository#allowing-specific-actions-to-run). check-spelling isn't a verified creator and it ce
ing-github-actions-for-a-repository#allowing-specific-actions-to-run). check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses. Set repository [Workflow permissions](https://docs.github.com/en/github/administering-a-repository/managing-repository-settings/disabling-or-limiting-github-actions-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository) to `Read repository contents permission`. Workflows using `check-spelling/check-spelling@main` will get the fix automatically. Workflows using a pinned sha or tagged version will need to change the affected workflows for all reposi
automatically. Workflows using a pinned sha or tagged version will need to change the affected workflows for all repository branches to the latest version. Users can verify who and which Pull Requests have been running the action by looking up the spelling.yml action in the Actions tab of their repositories, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml - you can filter PRs by adding ?query=event%3Apull_request_target, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml?query=event%3Apull_request_target. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/check-spelling/check-spelling/s
get. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p - https://github.com/check-spelling/check-spelling/commit/436362fc6b588d9d561cbdb575260ca593c8dc56
CVE ID: CVE-2021-32725 State: PUBLISHED Published: 2021-07-12T19:30:14 Last Updated: 2024-08-03T23:33:54.874Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-277 Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advis
al Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6f6v-h9x9-jj4v - https://github.com/nextcloud/server/pull/26946 - https://hackerone.com/reports/1178320 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32726 State: PUBLISHED Published: 2021-07-12T19:45:13 Last Updated: 2024-08-03T23:33:54.834Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-708 Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: Reference
.0.13, 20.0.11, and 21.0.3. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6qr9-c846-j8mg - https://github.com/nextcloud/server/pull/27532 - https://hackerone.com/reports/1202590 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32727 State: PUBLISHED Published: 2021-07-12T20:40:13 Last Updated: 2024-08-03T23:33:54.870Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-295 Description: Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private key belonged to a previously downloaded public certificate. If the Nextcloud instance served a malicious public key, the data would be
a previously downloaded public certificate. If the Nextcloud instance served a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. The vulnerability is patched in version 3.16.1. As a workaround, do not add additional end-to-end encrypted devices to a user account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5v33-r9cm-7736 - https://github.com/nextcloud/android/pull/8438 - https://hackerone.com/reports/1189162 - https://github.com/nextcloud/end_to_end_encryption_rfc/blob/7f002996397faefb664019a97ebb0a1e210f64f0/RFC.md#further-devices
CVE ID: CVE-2021-32728 State: PUBLISHED Published: 2021-08-18T16:00:13 Last Updated: 2024-08-03T23:33:54.918Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-295 Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to previously downloaded public certificate. If the Nextcloud instance serves a malicious public key, the data would be e
o previously downloaded public certificate. If the Nextcloud instance serves a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. This issue is fixed in Nextcloud Desktop Client version 3.3.0. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1189162 - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f5fr-5gcv-6cc5 - https://github.com/nextcloud/desktop/pull/3338 - https://www.debian.org/security/2021/dsa-4974
CVE ID: CVE-2021-32729 State: PUBLISHED Published: 2021-07-01T16:45:11 Last Updated: 2024-08-03T23:33:55.568Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-693 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights. An attacher with script rights who is able to reset the authentication failure record might perform a brut
mming rights. An attacher with script rights who is able to reset the authentication failure record might perform a brute force attack, since they would be able to virtually deactivate the mechanism introduced to mitigate those attacks. The problem has been patched in version 12.6.8, 12.10.4 and 13.0. There are no workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m738-3rc4-5xv3 - https://jira.xwiki.org/browse/XWIKI-18276
CVE ID: CVE-2021-32730 State: PUBLISHED Published: 2021-07-01T17:30:13 Last Updated: 2024-08-03T23:33:55.828Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-352 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. The problem has been patched in XWiki 12.10.5 and 13.2RC1. As a workaround, it is possible to apply the patch m
n XWiki. The problem has been patched in XWiki 12.10.5 and 13.2RC1. As a workaround, it is possible to apply the patch manually by modifying the `register_macros.vm` template. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v9j2-q4q5-cxh4 - https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d450366580217a47cc44d32f7257 - https://jira.xwiki.org/browse/XWIKI-18315
CVE ID: CVE-2021-32731 State: PUBLISHED Published: 2021-07-01T19:05:14 Last Updated: 2024-08-03T23:33:55.504Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-200 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1. As a workaround, it is possible to manually modify the `resetpasswordinline.vm` to perform the changes made to mitigate the vulnerability. Additiona
ble to manually modify the `resetpasswordinline.vm` to perform the changes made to mitigate the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4m4-pgp4-whgm - https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2 - https://jira.xwiki.org/browse/XWIKI-18400
CVE ID: CVE-2021-32732 State: PUBLISHED Published: 2022-02-04T22:15:13.000Z Last Updated: 2025-04-22T18:27:32.831Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-352 Description: ### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix