Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
om/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m - https://x-stream.github.io/CVE-2021-21342.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E - https://security.netapp.com/advisory/ntap-20210430-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://list
ct.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21343 State: PUBLISHED Published: 2021-03-22T23:40:34 Last Updated: 2024-08-03T18:09:15.634Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-73, CWE-502 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a
. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf - https://x-stream.github.io/CVE-2021-21343.html -
//github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf - https://x-stream.github.io/CVE-2021-21343.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E - https://security.netapp.com/advisory/ntap-20210430-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - ht
edoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21344 State: PUBLISHED Published: 2021-03-22T23:40:29 Last Updated: 2024-08-03T18:09:15.795Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream'
on to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-59jw-jqf4-3wq3 - https://x-stream.github.io/CVE-2021-21344.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
s://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E - https://security.netapp.com/advisory/ntap-20210430-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https:
aproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21345 State: PUBLISHED Published: 2021-03-22T23:40:25 Last Updated: 2024-08-03T18:09:15.855Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-94, CWE-502 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStre
ation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4 - https://x-stream.github.io/CVE-2021-21345.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org
ttps://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210430-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - htt
doraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21346 State: PUBLISHED Published: 2021-03-22T23:40:20 Last Updated: 2024-08-03T18:09:15.764Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream'
on to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-4hrm-m67v-5cxr - https://x-stream.github.io/CVE-2021-21346.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
CVE ID: CVE-2021-21347 State: PUBLISHED Published: 2021-03-22T23:40:13 Last Updated: 2024-08-03T18:09:15.686Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream'
on to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://x-stream.github.io/CVE-2021-21347.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
CVE ID: CVE-2021-21348 State: PUBLISHED Published: 2021-03-22T23:45:29 Last Updated: 2024-08-03T18:09:15.691Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-400, CWE-502 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Sec
framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq - https://x-stream.github.io/CVE-2021-21348.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/th
ml/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E - https://security.netapp.com/advisory/ntap-20210430-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/arch
G6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21349 State: PUBLISHED Published: 2021-03-22T23:45:24 Last Updated: 2024-08-03T18:09:15.735Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-502, CWE-918 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If yo
d the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv - https://x-stream.github.io/CVE-2021-21349.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jm
g00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E - https://security.netapp.com/advisory/ntap-20210430-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct
unce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21350 State: PUBLISHED Published: 2021-03-22T23:45:20 Last Updated: 2024-08-03T18:09:15.914Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the S
ty framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq - https://x-stream.github.io/CVE-2021-21350.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/
html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E - https://security.netapp.com/advisory/ntap-20210430-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/ar
DPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21351 State: PUBLISHED Published: 2021-03-22T23:45:15 Last Updated: 2024-08-03T18:09:15.774Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's defa
setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c - https://x-stream.github.io/CVE-2021-21351.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - htt
sts.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E - https://security.netapp.com/advisory/ntap-20210430-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://list
ct.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21352 State: PUBLISHED Published: 2021-03-03T00:20:16 Last Updated: 2024-08-03T18:09:15.965Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: anuko Products: timetracker Problem Types: CWE-330 Description: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess user tokens and, once successful, change user passwords, including that of a system administrator. This vulnerability is pathced in version 1.19.2
essful, change user passwords, including that of a system administrator. This vulnerability is pathced in version 1.19.24.5415 (started to use more secure tokens) with an additional improvement in 1.19.24.5416 (limited an available window for brute force token guessing). Additional Analyst Notes: - CVE Program Container: References: - https://www.anuko.com/time-tracker/index.htm - https://github.com/anuko/timetracker/security/advisories/GHSA-43c9-rx4h-4gqq - https://github.com/anuko/timetracker/commit/40f3d9345adc20e6f28eb9f59e2489aff87fecf5
CVE ID: CVE-2021-21353 State: PUBLISHED Published: 2021-03-03T01:50:18 Last Updated: 2025-04-16T22:10:03.957Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: pugjs Products: pug Problem Types: CWE-74 Description: Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages
e code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pugjs/pug/security/advisories/GHSA-p493-635q-r6gr - https://github.com/pugjs/pug/issues/3312 - https://github.com/pugjs/pug/pull/3314 - https://github.com/pugjs/pug/commit/991e78f7c4220b2f8
m/pugjs/pug/issues/3312 - https://github.com/pugjs/pug/pull/3314 - https://github.com/pugjs/pug/commit/991e78f7c4220b2f8da042877c6f0ef5a4683be0 - https://github.com/pugjs/pug/releases/tag/pug%403.0.1 - https://www.npmjs.com/package/pug - https://www.npmjs.com/package/pug-code-gen