Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-22865 State: PUBLISHED Published: 2021-04-02T17:25:14 Last Updated: 2024-08-03T18:51:07.557Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-285 Description: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication flow to read private repository metadata via the REST API without having been granted the appropriate permissions. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. The private repository metadata returned would be limite
authorize the application through the web authentication flow. The private repository metadata returned would be limited to repositories owned by the user the token identifies. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.0.4 and was fixed in versions 3.0.4, 2.22.10, 2.21.18. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.4 - https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.10 - https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.18
CVE ID: CVE-2021-22866 State: PUBLISHED Published: 2021-05-14T21:10:12 Last Updated: 2024-08-03T18:51:07.627Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-451 Description: A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. All permissions being granted would properly be shown during the first authorization, but in certain circumst
tion flow. All permissions being granted would properly be shown during the first authorization, but in certain circumstances, if the user revisits the authorization flow after the GitHub App has configured additional user-level permissions, those additional permissions may not be shown, leading to more permissions being granted than the user potentially intended. This vulnerability affected GitHub Enterprise Server 3.0.x prior to 3.0.7 and 2.22.x prior to 2.22.13. It was fixed in versions 3.0.7 and 2.22.13. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.0/adm
Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.7 - https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.13
CVE ID: CVE-2021-22867 State: PUBLISHED Published: 2021-07-14T20:55:12 Last Updated: 2024-08-03T18:51:07.486Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-77 Description: A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Ente
ld a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.1.3 and was fixed in 3.1.3, 3.0.11, and 2.22.17. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.17 - https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.11 - https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.3
CVE ID: CVE-2021-22868 State: PUBLISHED Published: 2021-09-24T17:50:16 Last Updated: 2024-08-03T18:51:07.475Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-77 Description: A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Ente
ld a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.1.8 and was fixed in 3.1.8, 3.0.16, and 2.22.22. This vulnerability was reported via the GitHub Bug Bounty program. This is the result of an incomplete fix for CVE-2021-22867. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.16 - https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.8 - https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.22
CVE ID: CVE-2021-22869 State: PUBLISHED Published: 2021-09-24T17:50:10 Last Updated: 2024-08-03T18:51:07.513Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-668 Description: An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self-hosted runner groups for access control. A repository with access to one enterprise runner group could access all of the enterprise runner groups within the organization because of improper authentication checks during the request. This could cause code to be run unintentionally by the incorrect runne
mproper authentication checks during the request. This could cause code to be run unintentionally by the incorrect runner group. This vulnerability affected GitHub Enterprise Server versions from 3.0.0 to 3.0.15 and 3.1.0 to 3.1.7 and was fixed in 3.0.16 and 3.1.8 releases. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.16 - https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.8
CVE ID: CVE-2021-22870 State: PUBLISHED Published: 2021-11-10T01:55:11 Last Updated: 2024-08-03T18:51:07.675Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-23 Description: A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.19, 3.1.11, and 3.2.3. This vulnerability was reported via the GitHub Bug Bounty program. Additio
fixed in versions 3.0.19, 3.1.11, and 3.2.3. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.19 - https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.11 - https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.3
CVE ID: CVE-2021-22871 State: PUBLISHED Published: 2021-01-21T19:15:11 Last Updated: 2024-08-03T18:51:07.525Z Vendors: n/a Products: https://github.com/revive-adserver/revive-adserver Problem Types: CWE-79 Description: Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.revive-adserver.com/security/revive-sa-2021-001/ - https://hackerone.com/reports/819362 - https://github.com/revive-
www.revive-adserver.com/security/revive-sa-2021-001/ - https://hackerone.com/reports/819362 - https://github.com/revive-adserver/revive-adserver/commit/89b88ce26 - https://github.com/revive-adserver/revive-adserver/commit/62a2a0439 - http://seclists.org/fulldisclosure/2021/Jan/60 - http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html
CVE ID: CVE-2021-22872 State: PUBLISHED Published: 2021-01-21T19:15:02 Last Updated: 2024-08-03T18:51:07.503Z Vendors: n/a Products: https://github.com/revive-adserver/revive-adserver Problem Types: CWE-79 Description: Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encode parameters were still vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://www.revive-adserver.com/security/revive-sa-2021-001/ - https://hackerone.
- CVE Program Container: References: - https://www.revive-adserver.com/security/revive-sa-2021-001/ - https://hackerone.com/reports/986365 - https://github.com/revive-adserver/revive-adserver/commit/00fdb8d0e - https://github.com/revive-adserver/revive-adserver/commit/1dbcf7d50 - http://seclists.org/fulldisclosure/2021/Jan/60 - http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html
CVE ID: CVE-2021-22873 State: PUBLISHED Published: 2021-01-21T19:14:44 Last Updated: 2024-08-03T18:51:07.583Z Vendors: n/a Products: https://github.com/revive-adserver/revive-adserver Problem Types: CWE-601 Description: Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability. Additional Ana
n anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1081406 - https://www.revive-adserver.com/security/revive-sa-2021-001/ - https://github.com/revive-adserver/revive-adserver/issues/1068 - http://seclists.org/fulldisclosure/2021/Jan/60 - http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html
CVE ID: CVE-2021-22874 State: PUBLISHED Published: 2021-01-28T16:09:23 Last Updated: 2024-08-03T18:51:07.505Z Vendors: n/a Products: https://github.com/revive-adserver/revive-adserver Problem Types: CWE-79 Description: Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1083231 - https://www.revive-adserver.com/security/revive-sa-2021-002/ - https://github.com/revive-adserver/revive-adserver/commit/e2a67ce8
CVE ID: CVE-2021-22875 State: PUBLISHED Published: 2021-01-28T16:12:14 Last Updated: 2024-08-03T18:51:07.627Z Vendors: n/a Products: https://github.com/revive-adserver/revive-adserver Problem Types: CWE-79 Description: Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.revive-adserver.com/security/revive-sa-2021-002/ - https://hackerone.com/reports/1083376 - https://github.com/revive-adserver/revive-adserver/commit/6f46076a
CVE ID: CVE-2021-22876 State: PUBLISHED Published: 2021-04-01T17:45:18.000Z Last Updated: 2025-06-09T14:54:59.891Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-359 Description: curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
server that is the target of the second HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1101882 - https://curl.se/docs/CVE-2021-22876.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00019.html - http
rg/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00019.html - https://security.gentoo.org/glsa/202105-36 - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210521-0007/ - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-22877 State: PUBLISHED Published: 2021-03-03T17:39:15 Last Updated: 2024-08-03T18:51:07.530Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-284 Description: A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1061591 - https://nextcloud.com/security/advisory/?id=NC-SA-2021-004 - https://github.com/nextcloud/server/issues/24600 - https://github.com/nextcloud/server/pull/25224 - https://lists.fedoraproject.org/archives/list/package-announce%40list
- https://github.com/nextcloud/server/pull/25224 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/
CVE ID: CVE-2021-22878 State: PUBLISHED Published: 2021-03-03T17:39:51 Last Updated: 2024-08-03T18:51:07.563Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-79 Description: Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/896522 - https://nextcloud.com/security/advisory/?id=NC-SA-2021-005 - https://github.com/nextcloud/server/pull/25234 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/
CVE ID: CVE-2021-22879 State: PUBLISHED Published: 2021-04-14T12:41:24 Last Updated: 2024-08-03T18:51:07.486Z Vendors: n/a Products: Nextcloud Desktop Client Problem Types: CWE-99 Description: Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1078002 - https://nextcloud.com/security/advisory/?id=NC-SA-2021-008 - https://github.com/nextcloud/desktop/pull/2906 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora
//github.com/nextcloud/desktop/pull/2906 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTWBJAS5DJJIK7LLVBZZQTSJASUVIRVE/ - https://security.gentoo.org/glsa/202105-37
CVE ID: CVE-2021-22880 State: PUBLISHED Published: 2021-02-11T16:11:22 Last Updated: 2024-08-03T18:58:24.778Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-400 Description: The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input. Additional Analyst Notes:
ls applications that are using PostgreSQL along with money type columns that take user input. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1023899 - https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO5OJ3F4ZL3UXVLJO6ECANRVZBNRS2IH/ - https://www.debian.org/security/2021/dsa-4929 - https://security.netapp.com/advisory/ntap-20210805-0009/
CVE ID: CVE-2021-22881 State: PUBLISHED Published: 2021-02-11T16:12:34 Last Updated: 2024-08-03T18:58:24.786Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-601 Description: The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website. Addi
owed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1047447 - https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130 - https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/ - http://www.openwall.com/lists/oss-security/2021/05/05/2 - http://www.openwall.com/lists/oss-security/2021/08/20/1 - http://www.ope
.openwall.com/lists/oss-security/2021/05/05/2 - http://www.openwall.com/lists/oss-security/2021/08/20/1 - http://www.openwall.com/lists/oss-security/2021/12/14/5
CVE ID: CVE-2021-22882 State: PUBLISHED Published: 2021-02-23T18:28:45 Last Updated: 2024-08-03T18:58:24.777Z Vendors: n/a Products: UniFi Protect Problem Types: CWE-400 Description: UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protect controller to crash. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1008579 - https://community.ui.com/releases/Security-advisory-bulletin-017-017/071141e5-bc2e-4b71-81f3-5e499316fcee
CVE ID: CVE-2021-22883 State: PUBLISHED Published: 2021-03-03T17:38:32 Last Updated: 2025-04-30T22:24:30.341Z Vendors: NodeJS Products: Node Problem Types: CWE-400 Description: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory. Additional A
limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/ - https://hackerone.com/reports/1043360 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/ - https://www.
ct.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210416-0001/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-22884 State: PUBLISHED Published: 2021-03-03T17:37:46 Last Updated: 2025-04-30T22:24:31.227Z Vendors: NodeJS Products: Node Problem Types: CWE-350 Description: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-71
” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1069487 - https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/ - https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/#node-js-inspector-dns-rebinding-vulnerability-cve-2018-7160 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG
ists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210416-0001/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210723-0001/ - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf