Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-39133 State: PUBLISHED Published: 2021-08-30T19:50:10 Last Updated: 2024-08-04T01:58:17.706Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: rundeck Products: rundeck Problem Types: CWE-352 Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14. Additional Analyst Notes: - CVE Program Container: References: - https:/
available in Rundeck versions 3.4.3 and 3.3.14. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rundeck/rundeck/security/advisories/GHSA-3jmw-c69h-426c - https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9
CVE ID: CVE-2021-39134 State: PUBLISHED Published: 2021-08-31T16:55:11 Last Updated: 2024-08-04T01:58:17.840Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: npm Products: arborist Problem Types: CWE-61 Description: `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nes
ed by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem. For example, a package `pwn-a` could define a
ch arbitrary contents could be written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in their `package.json` file such as `"foo": "file:/some/path"`. Another package, `pwn-b` could define a dependency such as `FOO: "file:foo.tgz"`. On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. Additional Analyst
ally affected. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc - https://www.npmjs.com/package/%40npmcli/arborist - https://www.oracle.com/security-alerts/cpuoct2021.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-39135 State: PUBLISHED Published: 2021-08-31T17:10:10 Last Updated: 2024-08-04T01:58:18.069Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: npm Products: arborist Problem Types: CWE-61 Description: `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of
ting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root
tacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/%40npmcli/arborist - https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2 - https://www.oracle.com/security-alerts/cpuoct2
https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-39136 State: PUBLISHED Published: 2021-08-25T18:05:13 Last Updated: 2024-08-04T01:58:17.928Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: baserproject Products: basercms Problem Types: CWE-79 Description: baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/baserproject/basercms/securit
issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3 - https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc - https://basercms.net/security/JVN_14134801 - http://jvn.jp/en/jp/JVN14134801/index.html
CVE ID: CVE-2021-39137 State: PUBLISHED Published: 2021-08-24T16:05:10 Last Updated: 2024-08-04T01:58:17.913Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ethereum Products: go-ethereum Problem Types: CWE-436 Description: go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming `v1.10.8` release. No workaround are available. Additional Analyst Notes: - CVE Program Container:
luded in the upcoming `v1.10.8` release. No workaround are available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/security/advisories/GHSA-9856-9gg9-qcmq - https://github.com/ethereum/go-ethereum/releases/tag/v1.10.8
CVE ID: CVE-2021-39138 State: PUBLISHED Published: 2021-08-18T21:40:11 Last Updated: 2024-08-04T01:58:18.164Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-287 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and also allow users to login anonymously. Prior to version 4.5.1, when an anonymous user is first signed up using REST, the server creates session incorrectly. Particularly, the `authProvider` field in `_Session` class under `createdWith` shows the user logged in creating a passw
Particularly, the `authProvider` field in `_Session` class under `createdWith` shows the user logged in creating a password. If a developer later depends on the `createdWith` field to provide a different level of access between a password user and anonymous user, the server incorrectly classified the session type as being created with a `password`. The server does not currently use `createdWith` to make decisions about internal functions, so if a developer is not using `createdWith` directly, they are not affected. The vulnerability only affects users who depend on `createdWith` by using it directly. The issue is patched in Parse Server version 4.5.1. As a workaround, do not use the `created
With` by using it directly. The issue is patched in Parse Server version 4.5.1. As a workaround, do not use the `createdWith` Session field to make decisions if one allows anonymous login. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-23r4-5mxp-c7g5 - https://github.com/parse-community/parse-server/commit/147bd9a3dc43391e92c36e05d5db860b04ca27db - https://github.com/parse-community/parse-server/releases/tag/4.5.1
CVE ID: CVE-2021-39139 State: PUBLISHED Published: 2021-08-23T17:50:14 Last Updated: 2024-08-04T01:58:18.173Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-502, CWE-434 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of th
or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44 - https://x-stream.github.io/CVE-2021-39139.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-
ps://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210923-0003/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.or
curity.netapp.com/advisory/ntap-20210923-0003/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-39140 State: PUBLISHED Published: 2021-08-23T18:15:13 Last Updated: 2024-08-04T01:58:18.112Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-502, CWE-835 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whiteli
input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-6wf9-jmg9-vxcc - https://x-stream.github.io/CVE-2021-39140.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/l
nnounce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210923-0003/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-39141 State: PUBLISHED Published: 2021-08-23T18:05:11 Last Updated: 2024-08-04T01:58:18.244Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by def
urity framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2 - https://x-stream.github.io/CVE-2021-39141.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ -
s.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210923-0003/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-39143 State: PUBLISHED Published: 2022-01-04T17:25:10.000Z Last Updated: 2025-04-22T18:34:51.842Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: spinnaker Products: spinnaker Problem Types: CWE-22 Description: Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system files. This would allow an attacker to override files on the container, POTENTIALLY introducing a MITM type attack vector by replacing libra
low an attacker to override files on the container, POTENTIALLY introducing a MITM type attack vector by replacing libraries or injecting wrapper files. Users are advised to update as soon as possible. For users unable to update disable Google AppEngine deployments and/or disable artifacts that provide TARs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spinnaker/spinnaker/security/advisories/GHSA-34jx-3vmr-56v8
CVE ID: CVE-2021-39144 State: PUBLISHED Published: 2021-08-23T00:00:00.000Z Last Updated: 2025-10-21T23:25:37.489Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-94, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by
security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh - https://x-stream.github.io/CVE-2021-39144.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3
IO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210923-0003/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2021-39145 State: PUBLISHED Published: 2021-08-23T18:05:23 Last Updated: 2024-08-04T01:58:18.135Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by def
urity framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-8jrj-525p-826v - https://x-stream.github.io/CVE-2021-39145.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ -
CVE ID: CVE-2021-39146 State: PUBLISHED Published: 2021-08-23T18:05:28 Last Updated: 2024-08-04T01:58:18.118Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by def
urity framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-p8pq-r894-fm8f - https://x-stream.github.io/CVE-2021-39146.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ -
CVE ID: CVE-2021-39147 State: PUBLISHED Published: 2021-08-23T18:05:33 Last Updated: 2024-08-04T01:58:18.103Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by def
urity framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc - https://x-stream.github.io/CVE-2021-39147.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ -
CVE ID: CVE-2021-39148 State: PUBLISHED Published: 2021-08-23T18:05:38 Last Updated: 2024-08-04T01:58:18.136Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by def