auren-research/cyber-sec huggingface dataset:
cveID: CVE-2018-15982
vendorProject: Adobe
product: Flash Player
vulnerabilityName: Adobe Flash Player Use-After-Free Vulnerability
dateAdded: 2022-02-15
shortDescription: Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-08-15
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-15982
cwes: CWE-416
cveID: CVE-2014-1761
vendorProject: Microsoft
product: Word
vulnerabilityName: Microsoft Word Memory Corruption Vulnerability
dateAdded: 2022-02-15
shortDescription: Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-15
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2014-1761
cwes: CWE-119
cveID: CVE-2013-3906
vendorProject: Microsoft
product: Graphics Component
vulnerabilityName: Microsoft Graphics Component Memory Corruption Vulnerability
dateAdded: 2022-02-15
shortDescription: Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-15
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2013-3906
cwes: CWE-94
cveID: CVE-2022-22620
vendorProject: Apple
product: iOS, iPadOS, and macOS
vulnerabilityName: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability
dateAdded: 2022-02-11
shortDescription: Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-25
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22620
cwes: CWE-416
cveID: CVE-2021-36934
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows SAM Local Privilege Escalation Vulnerability
dateAdded: 2022-02-10
shortDescription: If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-24
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-36934
cwes: CWE-1220
cveID: CVE-2020-0796
vendorProject: Microsoft
product: SMBv3
vulnerabilityName: Microsoft SMBv3 Remote Code Execution Vulnerability
dateAdded: 2022-02-10
shortDescription: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-0796
cwes: CWE-119
cveID: CVE-2018-1000861
vendorProject: Jenkins
product: Jenkins Stapler Web Framework
vulnerabilityName: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
dateAdded: 2022-02-10
shortDescription: A code execution vulnerability exists in the Stapler web framework used by Jenkins
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-1000861
cwes: CWE-502
cveID: CVE-2017-9791
vendorProject: Apache
product: Struts 1
vulnerabilityName: Apache Struts 1 Improper Input Validation Vulnerability
dateAdded: 2022-02-10
shortDescription: The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-9791
cwes: CWE-20
cveID: CVE-2017-8464
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability
dateAdded: 2022-02-10
shortDescription: Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-8464
cveID: CVE-2017-10271
vendorProject: Oracle
product: WebLogic Server
vulnerabilityName: Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
dateAdded: 2022-02-10
shortDescription: Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-10271
cveID: CVE-2017-0263
vendorProject: Microsoft
product: Win32k
vulnerabilityName: Microsoft Win32k Privilege Escalation Vulnerability
dateAdded: 2022-02-10
shortDescription: Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-0263
cwes: CWE-416
cveID: CVE-2017-0262
vendorProject: Microsoft
product: Office
vulnerabilityName: Microsoft Office Remote Code Execution Vulnerability
dateAdded: 2022-02-10
shortDescription: A remote code execution vulnerability exists in Microsoft Office.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-0262
cveID: CVE-2017-0145
vendorProject: Microsoft
product: SMBv1
vulnerabilityName: Microsoft SMBv1 Remote Code Execution Vulnerability
dateAdded: 2022-02-10
shortDescription: The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-0145
cwes: CWE-20
cveID: CVE-2017-0144
vendorProject: Microsoft
product: SMBv1
vulnerabilityName: Microsoft SMBv1 Remote Code Execution Vulnerability
dateAdded: 2022-02-10
shortDescription: The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-0144
cwes: CWE-20
cveID: CVE-2016-3088
vendorProject: Apache
product: ActiveMQ
vulnerabilityName: Apache ActiveMQ Improper Input Validation Vulnerability
dateAdded: 2022-02-10
shortDescription: The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2016-3088
cwes: CWE-20
cveID: CVE-2015-2051
vendorProject: D-Link
product: DIR-645 Router
vulnerabilityName: D-Link DIR-645 Router Remote Code Execution Vulnerability
dateAdded: 2022-02-10
shortDescription: D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-2051
cwes: CWE-77
cveID: CVE-2015-1635
vendorProject: Microsoft
product: HTTP.sys
vulnerabilityName: Microsoft HTTP.sys Remote Code Execution Vulnerability
dateAdded: 2022-02-10
shortDescription: Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-1635
cwes: CWE-94
cveID: CVE-2015-1130
vendorProject: Apple
product: OS X
vulnerabilityName: Apple OS X Authentication Bypass Vulnerability
dateAdded: 2022-02-10
shortDescription: The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-1130
cwes: CWE-254
cveID: CVE-2014-4404
vendorProject: Apple
product: OS X
vulnerabilityName: Apple OS X Heap-Based Buffer Overflow Vulnerability
dateAdded: 2022-02-10
shortDescription: Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-10
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2014-4404
cwes: CWE-119
cveID: CVE-2022-21882
vendorProject: Microsoft
product: Win32k
vulnerabilityName: Microsoft Win32k Privilege Escalation Vulnerability
dateAdded: 2022-02-04
shortDescription: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-21882
cwes: CWE-787
cveID: CVE-2022-22587
vendorProject: Apple
product: iOS and macOS
vulnerabilityName: Apple Memory Corruption Vulnerability
dateAdded: 2022-01-28
shortDescription: Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-11
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22587
cwes: CWE-20
CWE-787
cveID: CVE-2021-20038
vendorProject: SonicWall
product: SMA 100 Appliances
vulnerabilityName: SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
dateAdded: 2022-01-28
shortDescription: SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-11
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-20038
cwes: CWE-121
cveID: CVE-2020-5722
vendorProject: Grandstream
product: UCM6200
vulnerabilityName: Grandstream Networks UCM6200 Series SQL Injection Vulnerability
dateAdded: 2022-01-28
shortDescription: Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-28
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-5722
cwes: CWE-89
cveID: CVE-2020-0787
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
dateAdded: 2022-01-28
shortDescription: Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-28
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-0787
cwes: CWE-269
CWE-59
cveID: CVE-2017-5689
vendorProject: Intel
product: Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability
vulnerabilityName: Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
dateAdded: 2022-01-28
shortDescription: Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-28
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-5689
cveID: CVE-2014-1776
vendorProject: Microsoft
product: Internet Explorer
vulnerabilityName: Microsoft Internet Explorer Memory Corruption Vulnerability
dateAdded: 2022-01-28
shortDescription: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-28
knownRansomwareCampaignUse: Unknown
notes: https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2014/ms14-021?redirectedfrom=MSDN; https://nvd.nist.gov/vuln/detail/CVE-2014-1776
cwes: CWE-416
cveID: CVE-2014-6271
vendorProject: GNU
product: Bourne-Again Shell (Bash)
vulnerabilityName: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
dateAdded: 2022-01-28
shortDescription: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-28
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2014-6271
cwes: CWE-78
cveID: CVE-2014-7169
vendorProject: GNU
product: Bourne-Again Shell (Bash)
vulnerabilityName: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
dateAdded: 2022-01-28
shortDescription: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-28
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2014-7169
cwes: CWE-78
cveID: CVE-2006-1547
vendorProject: Apache
product: Struts 1
vulnerabilityName: Apache Struts 1 ActionForm Denial-of-Service Vulnerability
dateAdded: 2022-01-21
shortDescription: ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-21
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2006-1547
cveID: CVE-2012-0391
vendorProject: Apache
product: Struts 2
vulnerabilityName: Apache Struts 2 Improper Input Validation Vulnerability
dateAdded: 2022-01-21
shortDescription: The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-21
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2012-0391
cwes: CWE-20
cveID: CVE-2018-8453
vendorProject: Microsoft
product: Win32k
vulnerabilityName: Microsoft Win32k Privilege Escalation Vulnerability
dateAdded: 2022-01-21
shortDescription: Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-21
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-8453
cwes: CWE-404
cveID: CVE-2021-35247
vendorProject: SolarWinds
product: Serv-U
vulnerabilityName: SolarWinds Serv-U Improper Input Validation Vulnerability
dateAdded: 2022-01-21
shortDescription: SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-04
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-35247
cwes: CWE-20
cveID: CVE-2021-32648
vendorProject: October CMS
product: October CMS
vulnerabilityName: October CMS Improper Authentication
dateAdded: 2022-01-18
shortDescription: In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-32648
cwes: CWE-287
cveID: CVE-2021-25296
vendorProject: Nagios
product: Nagios XI
vulnerabilityName: Nagios XI OS Command Injection
dateAdded: 2022-01-18
shortDescription: Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-25296
cwes: CWE-78
CWE-138
cveID: CVE-2021-25297
vendorProject: Nagios
product: Nagios XI
vulnerabilityName: Nagios XI OS Command Injection
dateAdded: 2022-01-18
shortDescription: Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-25297
cwes: CWE-78
CWE-138
cveID: CVE-2021-25298
vendorProject: Nagios
product: Nagios XI
vulnerabilityName: Nagios XI OS Command Injection
dateAdded: 2022-01-18
shortDescription: Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-25298
cwes: CWE-78
CWE-138
cveID: CVE-2021-40870
vendorProject: Aviatrix
product: Aviatrix Controller
vulnerabilityName: Aviatrix Controller Unrestricted Upload of File
dateAdded: 2022-01-18
shortDescription: Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-40870
cwes: CWE-25
CWE-96
cveID: CVE-2021-33766
vendorProject: Microsoft
product: Exchange Server
vulnerabilityName: Microsoft Exchange Server Information Disclosure
dateAdded: 2022-01-18
shortDescription: Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-33766
cwes: CWE-287
cveID: CVE-2021-21975
vendorProject: VMware
product: vRealize Operations Manager API
vulnerabilityName: VMware Server Side Request Forgery in vRealize Operations Manager API
dateAdded: 2022-01-18
shortDescription: Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-01
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-21975
cwes: CWE-918
cveID: CVE-2021-21315
vendorProject: Npm package
product: System Information Library for Node.JS
vulnerabilityName: System Information Library for Node.JS Command Injection
dateAdded: 2022-01-18
shortDescription: In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-21315
cwes: CWE-78
cveID: CVE-2021-22991
vendorProject: F5
product: BIG-IP Traffic Management Microkernel
vulnerabilityName: F5 BIG-IP Traffic Management Microkernel Buffer Overflow
dateAdded: 2022-01-18
shortDescription: The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-02-01
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-22991
cwes: CWE-119
cveID: CVE-2020-14864
vendorProject: Oracle
product: Intelligence Enterprise Edition
vulnerabilityName: Oracle Business Intelligence Enterprise Edition Path Transversal
dateAdded: 2022-01-18
shortDescription: Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-14864
cwes: CWE-22
cveID: CVE-2020-13671
vendorProject: Drupal
product: Drupal core
vulnerabilityName: Drupal core Un-restricted Upload of File
dateAdded: 2022-01-18
shortDescription: Improper sanitization in the extension file names is present in Drupal core.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-13671
cwes: CWE-434
cveID: CVE-2020-11978
vendorProject: Apache
product: Airflow
vulnerabilityName: Apache Airflow Command Injection
dateAdded: 2022-01-18
shortDescription: A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-11978
cwes: CWE-78
cveID: CVE-2020-13927
vendorProject: Apache
product: Airflow's Experimental API
vulnerabilityName: Apache Airflow's Experimental API Authentication Bypass
dateAdded: 2022-01-18
shortDescription: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-13927
cwes: CWE-1188
CWE-306
cveID: CVE-2021-22017
vendorProject: VMware
product: vCenter Server
vulnerabilityName: VMware vCenter Server Improper Access Control
dateAdded: 2022-01-10
shortDescription: Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-01-24
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-22017
cwes: CWE-23
cveID: CVE-2021-36260
vendorProject: Hikvision
product: Security cameras web server
vulnerabilityName: Hikvision Improper Input Validation
dateAdded: 2022-01-10
shortDescription: A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-01-24
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-36260
cwes: CWE-78