Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ated with "Upload Only" privileges. (aka "File Drop"). A link share recipient is not expected to see which folders or files exist in a "File Drop" share. Using this vulnerability an attacker is able to enumerate folders in such a share. Exploitation requires that the attacker has access to a valid affected "File Drop" link share. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.0.1. Users who are unable to upgrade are advised to disable the Nextcloud Text application in the app settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr - https://github.com/
rences: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr - https://github.com/nextcloud/text/pull/1716 - https://hackerone.com/reports/1253475
CVE ID: CVE-2021-32767 State: PUBLISHED Published: 2021-07-20T16:00:11 Last Updated: 2024-08-03T23:33:55.829Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-532 Description: TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://githu
1 contain a patch for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-34fr-fhqr-7235 - https://typo3.org/security/advisory/typo3-core-sa-2021-012
CVE ID: CVE-2021-32768 State: PUBLISHED Published: 2021-08-10T16:30:11 Last Updated: 2024-08-03T23:33:55.826Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-79 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per defaul
Script functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-core-sa-2021-013 - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-c5c9-8c6m-727v
CVE ID: CVE-2021-32769 State: PUBLISHED Published: 2021-07-16T18:25:09 Last Updated: 2024-08-03T23:33:55.862Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: micronaut-projects Products: micronaut-core Problem Types: CWE-22 Description: Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in
ict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjx7-399x-p2rj - https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d16d4a3b91b34b7456bb11
CVE ID: CVE-2021-32770 State: PUBLISHED Published: 2021-07-15T18:30:11 Last Updated: 2024-08-03T23:33:56.071Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: gatsbyjs Products: gatsby Problem Types: CWE-200 Description: Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering
en introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the `auth: { }` section. Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`. One may manually edit the app.js file post-build as a workaround. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-rqjw-p5vr-c695
CVE ID: CVE-2021-32771 State: PUBLISHED Published: 2022-08-04T20:25:16.000Z Last Updated: 2025-04-23T17:53:33.843Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-120 Description: Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have joined an RPL DODAG. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits.
. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits. The problem was fixed after the release of Contiki-NG 4.7. Users unable to upgrade may apply the patch in Contiki-NG PR #1615. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-jqjf-v7v9-xp6w - https://github.com/contiki-ng/contiki-ng/pull/1615 - https://github.com/contiki-ng/contiki-ng/pull/1615/commits/587ae59956e00316fd44fd7072ac3a6a07b4b20f - https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.8
CVE ID: CVE-2021-32772 State: PUBLISHED Published: 2021-08-03T14:15:13 Last Updated: 2024-08-03T23:33:56.048Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MrChuckomo Products: poddycast Problem Types: CWE-78 Description: Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allows the injection of HTML and JS code (cross-site scripting). Being an application made in electron, cross-site scripting can be scaled to remote co
d JS code (cross-site scripting). Being an application made in electron, cross-site scripting can be scaled to remote code execution, making it possible to execute commands on the machine where the application is running. The vulnerability is patched in Poddycast version 0.8.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MrChuckomo/poddycast/security/advisories/GHSA-wjmh-9fj2-rqh6 - https://github.com/MrChuckomo/poddycast/blob/8d31daa5cee04a389ec35f974959ea3fe4638be9/app/js/favorite.js#L4-L14 - https://github.com/MrChuckomo/poddycast/blob/8d31daa5cee04a389ec35f974959ea3fe4638be9/app/js/feed.js#L285 - https://github.com/MrChuckomo/poddycast/blob/8d31daa
blob/8d31daa5cee04a389ec35f974959ea3fe4638be9/app/js/feed.js#L285 - https://github.com/MrChuckomo/poddycast/blob/8d31daa5cee04a389ec35f974959ea3fe4638be9/app/js/helper/helper_entries.js#L80
CVE ID: CVE-2021-32773 State: PUBLISHED Published: 2021-07-19T23:55:11 Last Updated: 2024-08-03T23:33:55.527Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: racket Products: racket Problem Types: CWE-441 Description: Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules instead of their intended dependencies. This could allow system functions to be controlled by the attacker, giving access to facilities intended to be restricted. This problem is fixed in Racket version 8.2. A
by the attacker, giving access to facilities intended to be restricted. This problem is fixed in Racket version 8.2. A workaround is available, depending on system settings. For systems that provide arbitrary Racket evaluation, external sandboxing such as containers limit the impact of the problem. For multi-user evaluation systems, such as the `handin-server` system, it is not possible to work around this problem and upgrading is required. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/racket/racket/security/advisories/GHSA-cgrw-p7p7-937c - https://github.com/racket/racket/commit/6ca4ffeca1e5877d44f835760ad89f18488d97e1
CVE ID: CVE-2021-32774 State: PUBLISHED Published: 2021-07-20T00:35:11 Last Updated: 2024-08-03T23:33:55.818Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: miraheze Products: DataDump Problem Types: CWE-352 Description: DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in commit 67a82b76e186925330b89ace9c5fd893a300830b. There are no known workarounds. You must completely disable DataDump. Additional Analyst Notes: - CVE Program Container: References: -
own workarounds. You must completely disable DataDump. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miraheze/DataDump/security/advisories/GHSA-29mh-4vhv-x8mr - https://github.com/miraheze/DataDump/commit/67a82b76e186925330b89ace9c5fd893a300830b - https://phabricator.miraheze.org/T7593
CVE ID: CVE-2021-32775 State: PUBLISHED Published: 2021-07-21T20:20:09 Last Updated: 2024-08-03T23:33:56.079Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-209 Description: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-xh7w-rrp3-fhpq
CVE ID: CVE-2021-32776 State: PUBLISHED Published: 2021-07-21T20:25:09 Last Updated: 2024-08-03T23:33:55.825Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-352 Description: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-cxw7-2x7h-f7pr
CVE ID: CVE-2021-32777 State: PUBLISHED Published: 2021-08-24T20:25:09 Last Updated: 2024-08-03T23:33:55.865Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-551, CWE-863 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate
value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h - https://www.envoyprox
ainer: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h - https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history
CVE ID: CVE-2021-32778 State: PUBLISHED Published: 2021-08-24T20:30:11 Last Updated: 2024-08-03T23:33:55.854Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: envoyproxy Products: envoy Problem Types: CWE-834 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability
ce when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100. Additional Analyst Notes: - CVE Program Container: References: - https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history - https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc
CVE ID: CVE-2021-32779 State: PUBLISHED Published: 2021-08-24T20:45:09 Last Updated: 2024-08-03T23:33:55.667Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-551, CWE-863 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a final "/admin" path element, or is using a negative assertion with final path element of "/admin". The client sends r
a final "/admin" path element, or is using a negative assertion with final path element of "/admin". The client sends request to "/app1/admin#foo". In Envoy prior to 1.18.0, or 1.18.0+ configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when present, or as a suffix of the path when query string is absent, so it evaluates the final path element as "/admin#foo" and mismatches with the configured "/admin" path element. In Envoy 1.18.0+ configured with path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured /admin prefix. The resulting URI is sent to the next server-agent with the offending "#foo" fragmen
with the configured /admin prefix. The resulting URI is sent to the next server-agent with the offending "#foo" fragment which violates RFC3986 or with the nonsensical "%23foo" text appended. A specifically constructed request with URI containing '#fragment' element delivered by an untrusted client in the presence of path based request authorization resulting in escalation of Privileges when path based request authorization extensions. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes that removes fragment from URI path in incoming requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history
tes: - CVE Program Container: References: - https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history - https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9
CVE ID: CVE-2021-32780 State: PUBLISHED Published: 2021-08-24T20:55:10 Last Updated: 2024-08-03T23:33:56.068Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-754 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to DRAINING when it receives a SETTING frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. Receiving these two frames in the same I/O event r
NG frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. Receiving these two frames in the same I/O event results in abnormal termination of the Envoy process due to invalid state transition from CLOSED to DRAINING. A sequence of H/2 frames delivered by an untrusted upstream server will result in Denial of Service in the presence of untrusted **upstream** servers. Envoy versions 1.19.1, 1.18.4 contain fixes to stop processing of pending H/2 frames after connection transition to the CLOSED state. Additional Analyst Notes: - CVE Program Container: References: - https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history - https://github.com/envoyproxy/envoy/securi
ttps://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history - https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8
CVE ID: CVE-2021-32781 State: PUBLISHED Published: 2021-08-24T20:50:10 Last Updated: 2024-08-03T23:33:55.673Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-416 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a fr
st or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extens
ssing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible. Additional Analyst Notes: - CVE Program Container: References: - https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history - https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qv
CVE ID: CVE-2021-32782 State: PUBLISHED Published: 2021-09-07T20:00:19 Last Updated: 2024-08-03T23:33:55.634Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-79 Description: Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21
rowsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hgpq-28gj-jrj9 - https://github.com/nextcloud/circles/commit/dbb97a83ccb342c839a54f088aa19b8ba6844b0e - https://hackerone.com/reports/1217606
CVE ID: CVE-2021-32783 State: PUBLISHED Published: 2021-07-23T21:50:10 Last Updated: 2024-08-03T23:33:55.624Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H) Vendors: projectcontour Products: contour Problem Types: CWE-441 Description: Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy remotely (a denial of service), or to expose the existence of any Secret that Envoy is using for its configuration, including most notably TLS K
rvice), or to expose the existence of any Secret that Envoy is using for its configuration, including most notably TLS Keypairs. However, it *cannot* be used to get the *content* of those secrets. Since this attack allows access to the administration interface, a variety of administration options are available, such as shutting down the Envoy or draining traffic. In general, the Envoy admin interface cannot easily be used for making changes to the cluster, in-flight requests, or backend services, but it could be used to shut down or drain Envoy, change traffic routing, or to retrieve secret metadata, as mentioned above. The issue will be addressed in Contour v1.18.0 and a cherry-picked patch
o retrieve secret metadata, as mentioned above. The issue will be addressed in Contour v1.18.0 and a cherry-picked patch release, v1.17.1, has been released to cover users who cannot upgrade at this time. For more details refer to the linked GitHub Security Advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectcontour/contour/security/advisories/GHSA-5ph6-qq5x-7jwc - https://github.com/projectcontour/contour/commit/b53a5c4fd927f4ea2c6cf02f1359d8e28bef852e - https://github.com/projectcontour/contour/releases/tag/v1.17.1