Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-20164 State: PUBLISHED Published: 2021-12-30T21:31:13 Last Updated: 2024-08-03T17:30:07.479Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Information Disclosure Description: Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. Usernames and passwords for all smb users are revealed in plaintext on the smbserver.asp page. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20165 State: PUBLISHED Published: 2021-12-30T21:31:14 Last Updated: 2024-08-03T17:30:07.434Z Vendors: n/a Products: Trendnet AC2600 TEW-827DRU Problem Types: Cross site request forgery Description: Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Additionally, pages that do make use of CSRF tokens are trivially bypassable as the server does not appear to validate them properly (i.e. re-using an old token or finding the token thru some other method is possible). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2
sible). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-54
CVE ID: CVE-2021-20166 State: PUBLISHED Published: 2021-12-30T21:31:16 Last Updated: 2024-08-03T17:30:07.653Z Vendors: n/a Products: Netgear RAX43 Problem Types: Buffer Overrun Description: Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-55
CVE ID: CVE-2021-20167 State: PUBLISHED Published: 2021-12-30T21:31:17 Last Updated: 2024-08-03T17:30:07.925Z Vendors: n/a Products: Netgear RAX43 Problem Types: Command Injection Description: Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-55
CVE ID: CVE-2021-20168 State: PUBLISHED Published: 2021-12-30T21:31:17 Last Updated: 2024-08-03T17:30:07.570Z Vendors: n/a Products: Netgear RAX43 Problem Types: Improper Access Controls Description: Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection, login with default credentials, and execute commands as the root user. These default credentials are admin:admin. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-55
CVE ID: CVE-2021-20169 State: PUBLISHED Published: 2021-12-30T21:31:18 Last Updated: 2024-08-03T17:30:07.449Z Vendors: n/a Products: Netgear RAX43 Problem Types: Improper Access Controls Description: Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communication to/from the device is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-55
CVE ID: CVE-2021-20170 State: PUBLISHED Published: 2021-12-30T21:31:15 Last Updated: 2024-08-03T17:30:07.477Z Vendors: n/a Products: Netgear RAX43 Problem Types: Hardcoded Credential Description: Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be
ure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-55
CVE ID: CVE-2021-20171 State: PUBLISHED Published: 2021-12-30T21:31:15 Last Updated: 2024-08-03T17:30:07.477Z Vendors: n/a Products: Netgear RAX43 Problem Types: Plaintext Passwords Description: Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-55
CVE ID: CVE-2021-20172 State: PUBLISHED Published: 2021-12-30T21:31:19 Last Updated: 2024-08-03T17:30:07.693Z Vendors: n/a Products: Netgear Genie Installer for macOS Problem Types: Local Privilege Escalation Description: All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear Genie handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which the software is going to be installed may overwrite certain files to obtain privilege escalation to root. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/rese
calation to root. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-56
CVE ID: CVE-2021-20173 State: PUBLISHED Published: 2021-12-30T21:31:22 Last Updated: 2024-08-03T17:30:07.501Z Vendors: n/a Products: Netgear Nighthawk R6700 Problem Types: Command Injection Description: Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface, the device is susceptible to command injection via preconfigured values. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-57
CVE ID: CVE-2021-20174 State: PUBLISHED Published: 2021-12-30T21:31:23 Last Updated: 2024-08-03T17:30:07.580Z Vendors: n/a Products: Netgear Nighthawk R6700 Problem Types: Improper Access Control Description: Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-57
CVE ID: CVE-2021-20175 State: PUBLISHED Published: 2021-12-30T21:31:23 Last Updated: 2024-08-03T17:30:07.419Z Vendors: n/a Products: Netgear Nighthawk R6700 Problem Types: Improper Access Control Description: Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device's SOAP Interface (port 5000) is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-57
CVE ID: CVE-2021-20176 State: PUBLISHED Published: 2021-02-05T00:00:00 Last Updated: 2024-08-03T17:30:07.469Z Vendors: n/a Products: ImageMagick Problem Types: CWE-369 Description: A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1916610 - https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html - https://lists.debian.org/debian-l
.cgi?id=1916610 - https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
CVE ID: CVE-2021-20177 State: PUBLISHED Published: 2021-05-26T20:48:25 Last Updated: 2024-08-03T17:30:07.528Z Vendors: n/a Products: kernel Problem Types: CWE-125 Description: A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1914719
CVE ID: CVE-2021-20178 State: PUBLISHED Published: 2021-05-26T00:00:00 Last Updated: 2024-08-03T17:30:07.440Z Vendors: n/a Products: Ansible Problem Types: CWE-532 Description: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIU7QZUV73U6ZQ65VJWSFBTCALVXLH55/ -
s.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIU7QZUV73U6ZQ65VJWSFBTCALVXLH55/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUQ2QKAQA5OW2TY3ACZZMFIAJ2EQTG37/ - https://bugzilla.redhat.com/show_bug.cgi?id=1914774 - https://github.com/ansible-collections/community.general/pull/1635%2C - https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst#security-fixes%2C - https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
CVE ID: CVE-2021-20179 State: PUBLISHED Published: 2021-03-15T12:01:25 Last Updated: 2024-08-03T17:30:07.814Z Vendors: n/a Products: pki-core Problem Types: CWE-863 Description: A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1914379 - https://github.com/dogtagpki/pki/pull/3478 - https://github.com/dogtagpki/pki/pull/3477 - https://github.com/dogtagp
9 - https://github.com/dogtagpki/pki/pull/3478 - https://github.com/dogtagpki/pki/pull/3477 - https://github.com/dogtagpki/pki/pull/3476 - https://github.com/dogtagpki/pki/pull/3475 - https://github.com/dogtagpki/pki/pull/3474 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3I7BRAHLE2WWSY76W3CKFCF5WSSAE24/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRE44N6P24AEDKRMWK7RPRLMCUUBRJII/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDOLFOLEIV7I4EUC3SCZBXL6E2ER7ZEN/
CVE ID: CVE-2021-20180 State: PUBLISHED Published: 2022-03-16T14:12:30 Last Updated: 2024-08-03T17:30:07.435Z Vendors: n/a Products: Ansible Problem Types: CWE-532 Description: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1915808
CVE ID: CVE-2021-20181 State: PUBLISHED Published: 2021-05-13T15:24:15 Last Updated: 2024-08-03T17:30:07.767Z Vendors: n/a Products: qemu Problem Types: CWE-367 Description: A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-159/ - https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html
://www.zerodayinitiative.com/advisories/ZDI-21-159/ - https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html - https://bugzilla.redhat.com/show_bug.cgi?id=1927007 - https://security.netapp.com/advisory/ntap-20210720-0009/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2021-20182 State: PUBLISHED Published: 2021-02-23T21:32:26 Last Updated: 2024-08-03T17:30:07.425Z Vendors: n/a Products: openshift Problem Types: CWE-552 Description: A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted environment instead of runc. If an attacker can gain access to this build container, they can potentially utilize the raw devices of the underlying node, such as the network and storage devices, to at least escalate their privileges to that of the cluster admin. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additio
highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1915110
CVE ID: CVE-2021-20183 State: PUBLISHED Published: 2021-01-28T18:36:39 Last Updated: 2024-08-03T17:30:07.569Z Vendors: n/a Products: moodle Problem Types: CWE-79 Description: It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=417166
CVE ID: CVE-2021-20184 State: PUBLISHED Published: 2021-01-28T18:44:27 Last Updated: 2024-08-03T17:30:07.485Z Vendors: n/a Products: moodle Problem Types: CWE-354 Description: It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other students grades. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=417167
CVE ID: CVE-2021-20185 State: PUBLISHED Published: 2021-01-28T19:01:04 Last Updated: 2024-08-03T17:30:07.687Z Vendors: n/a Products: moodle Problem Types: CWE-400 Description: It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=417168
CVE ID: CVE-2021-20186 State: PUBLISHED Published: 2021-01-28T18:38:03 Last Updated: 2024-08-03T17:30:07.769Z Vendors: n/a Products: moodle Problem Types: CWE-79 Description: It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=417170
CVE ID: CVE-2021-20187 State: PUBLISHED Published: 2021-01-28T18:30:03 Last Updated: 2024-08-03T17:30:07.535Z Vendors: n/a Products: moodle Problem Types: CWE-94 Description: It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=417171
CVE ID: CVE-2021-20188 State: PUBLISHED Published: 2021-02-11T15:31:47 Last Updated: 2024-08-03T17:30:07.619Z Vendors: n/a Products: podman Problem Types: CWE-863 Description: A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data
lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1915734
CVE ID: CVE-2021-20189 State: REJECTED Published: 2021-01-15T15:00:56 Last Updated: 2021-01-15T15:00:56 Description: No description available.
CVE ID: CVE-2021-20190 State: PUBLISHED Published: 2021-01-19T16:27:58.000Z Last Updated: 2025-08-27T20:36:03.139Z Vendors: n/a Products: jackson-databind Problem Types: CWE-502 Description: A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FasterXML/jackson-databind/issues/2854 - https://bugzilla.redhat.com/show_bug.cgi?id=1916633 - https://lists.apache.org/thread.html/r380e9257bacb8551ee
es/2854 - https://bugzilla.redhat.com/show_bug.cgi?id=1916633 - https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.nifi.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210219-0008/
CVE ID: CVE-2021-20191 State: PUBLISHED Published: 2021-05-26T00:00:00 Last Updated: 2024-08-03T17:30:07.571Z Vendors: n/a Products: ansible Problem Types: CWE-532 Description: A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1916813 - https://lists.debian.org/debian-lts-announ
ontainer: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1916813 - https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
CVE ID: CVE-2021-20192 State: REJECTED Published: 2022-08-25T17:23:11 Last Updated: 2022-08-25T17:23:11 Description: No description available.
CVE ID: CVE-2021-20193 State: PUBLISHED Published: 2021-03-26T16:41:23 Last Updated: 2024-08-03T17:30:07.480Z Vendors: n/a Products: tar Problem Types: CWE-401 Description: A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1917565 - https://savannah.gnu.org/bugs/?59897 - https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777 - https://security.gentoo.or
tps://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777 - https://security.gentoo.org/glsa/202105-29
CVE ID: CVE-2021-20194 State: PUBLISHED Published: 2021-02-23T22:33:24 Last Updated: 2024-08-03T17:30:07.585Z Vendors: n/a Products: kernel Problem Types: CWE-20 Description: There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation. Addi
because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1912683 - https://security.netapp.com/advisory/ntap-20210326-0003/
CVE ID: CVE-2021-20195 State: PUBLISHED Published: 2021-05-28T10:42:09 Last Updated: 2024-08-03T17:30:07.464Z Vendors: n/a Products: keycloak Problem Types: CWE-20 Description: A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1919143
CVE ID: CVE-2021-20196 State: PUBLISHED Published: 2021-05-26T21:16:58 Last Updated: 2024-08-03T17:30:07.781Z Vendors: n/a Products: qemu Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/qemu/+bug/1912780 - https://www.openwall
nalyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/qemu/+bug/1912780 - https://www.openwall.com/lists/oss-security/2021/01/28/1 - https://security.netapp.com/advisory/ntap-20210708-0004/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2021-20197 State: PUBLISHED Published: 2021-03-26T16:47:20 Last Updated: 2024-08-03T17:30:07.480Z Vendors: n/a Products: binutils Problem Types: CWE-59 Description: There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1913743 - https://sourceware.org/bug