deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-27234
Published: 2021-04-13
Description: An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207
CVE: CVE-2020-27235
Published: 2021-04-13
Description: An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207
CVE: CVE-2020-27236
Published: 2021-04-13
Description: An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207
CVE: CVE-2021-21729
Published: 2021-04-13
Description: Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H108N V2.5.5_BTMT1
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330, CWE-352
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904
CVE: CVE-2021-21730
Published: 2021-04-13
Description: A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This affects: ZXHN H168N V3.5.0_TY.T6
CVSS Score: 9.8 (CRITICAL)
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864
CVE: CVE-2021-21731
Published: 2021-04-13
Description: A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the request comes from a trusted user. The attacker could submit a malicious request to the affected device to delete the data. This affects: ZXCLOUD iRAI All versions up to KVM-ProductV6.03.04
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014824; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014824
CVE: CVE-2021-28973
Published: 2021-04-13
Description: The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611
References: https://www.compass-security.com/fileadmin/Research/Advisories/2021-01_CSNC-2021-005_Helix_ALM_XXE.txt; https://www.compass-security.com/fileadmin/Research/Advisories/2021-01_CSNC-2021-005_Helix_ALM_XXE.txt
CVE: CVE-2021-29997
Published: 2021-04-13
Description: An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2021-29997; https://support2.windriver.com/index.php?page=security-notices; https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2021-29997
CVE: CVE-2021-29998
Published: 2021-04-13
Description: An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-560465.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-910883.pdf; https://support2.windriver.com/index.php?page=security-notices
CVE: CVE-2021-29999
Published: 2021-04-13
Description: An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support2.windriver.com/index.php?page=security-notices; https://support2.windriver.com/index.php?page=security-notices
CVE: CVE-2020-28590
Published: 2021-04-13
Description: An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A specially crafted obj file could lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1213; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1213
CVE: CVE-2021-0400
Published: 2021-04-13
Description: In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11Android ID: A-177561690
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0426
Published: 2021-04-13
Description: In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174485572
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0427
Published: 2021-04-13
Description: In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174488848
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0428
Published: 2021-04-13
Description: In getSimSerialNumber of TelephonyManager.java, there is a possible way to read a trackable identifier due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-173421434
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0429
Published: 2021-04-13
Description: In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-175074139
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0430
Published: 2021-04-13
Description: In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution via a malicious NFC packet with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-178725766
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/162380/Android-NFC-Stack-Out-Of-Bounds-Write.html; https://source.android.com/security/bulletin/2021-04-01; http://packetstormsecurity.com/files/162380/Android-NFC-Stack-Out-Of-Bounds-Write.html
CVE: CVE-2021-0431
Published: 2021-04-13
Description: In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174149901
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0432
Published: 2021-04-13
Description: In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173552790
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0433
Published: 2021-04-13
Description: In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege and pairing malicious devices with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171221090
CVSS Score: 8.0 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0435
Published: 2021-04-13
Description: In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174150451
CVSS Score: 7.5 (HIGH)
CWE: CWE-665
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0436
Published: 2021-04-13
Description: In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds read due to integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176496160
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0437
Published: 2021-04-13
Description: In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local escalation of privilege in a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-176168330
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0438
Published: 2021-04-13
Description: In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10Android ID: A-152064592
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0439
Published: 2021-04-13
Description: In setPowerModeWithHandle of com_android_server_power_PowerManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174243830
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0442
Published: 2021-04-13
Description: In updateInfo of android_hardware_input_InputApplicationHandle.cpp, there is a possible control of code flow due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174768985
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0443
Published: 2021-04-13
Description: In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due to a race condition. This could lead to local information disclosure across user profiles with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-170474245
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0444
Published: 2021-04-13
Description: In onActivityResult of QuickContactActivity.java, there is an unnecessary return of an intent. This could lead to local information disclosure of contact data with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-178825358
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0445
Published: 2021-04-13
Description: In start of WelcomeActivity.java, there is a possible residual profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9Android ID: A-172322502
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0446
Published: 2021-04-13
Description: In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-172252122
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0468
Published: 2021-04-13
Description: In LK, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege for an attacker who has physical access to the device with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-180427272
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-1188
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-0471
Published: 2021-04-13
Description: In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-176444786
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-190
References: https://source.android.com/security/bulletin/2021-04-01; https://source.android.com/security/bulletin/2021-04-01
CVE: CVE-2021-21482
Published: 2021-04-13
Description: SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password using a brute force method. If successful, the attacker could obtain access to highly sensitive data and MDM administrative privileges leading to information disclosure vulnerability thereby affecting the confidentiality and integrity of the application. This happens when security guidelines and recommendations concerning administrative accounts of an SAP NetWeaver Master Data Management installation have not been thoroughly reviewed.
CVSS Score: 8.3 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3017908; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649; https://launchpad.support.sap.com/#/notes/3017908
CVE: CVE-2021-21483
Published: 2021-04-13
Description: Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct serious impact beyond the exploitable component thereby affecting the confidentiality in the application.
CVSS Score: 4.9 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3017823; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649; https://launchpad.support.sap.com/#/notes/3017823
CVE: CVE-2021-21485
Published: 2021-04-13
Description: An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user.
CVSS Score: 6.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3001824; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649; https://launchpad.support.sap.com/#/notes/3001824
CVE: CVE-2021-21492
Published: 2021-04-13
Description: SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://launchpad.support.sap.com/#/notes/3025637; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649; https://launchpad.support.sap.com/#/notes/3025637
CVE: CVE-2021-21784
Published: 2021-04-13
Description: An out-of-bounds write vulnerability exists in the JPG format SOF marker processing of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1248; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1248
CVE: CVE-2021-22716
Published: 2021-04-13
Description: A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unprivileged user modifies a file. Affected Product: C-Bus Toolkit (V1.15.9 and prior)
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-103-01_C-Bus_Toolkit_C-Gate_Server_Security_Notification.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-105-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-103-01_C-Bus_Toolkit_C-Gate_Server_Security_Notification.pdf
CVE: CVE-2021-22717
Published: 2021-04-13
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when processing config files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01; https://www.zerodayinitiative.com/advisories/ZDI-21-447/; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01
CVE: CVE-2021-22718
Published: 2021-04-13
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when restoring project files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01; https://www.zerodayinitiative.com/advisories/ZDI-21-448/; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01
CVE: CVE-2021-22719
Published: 2021-04-13
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when a file is uploaded.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01; https://www.zerodayinitiative.com/advisories/ZDI-21-449/; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01
CVE: CVE-2021-22720
Published: 2021-04-13
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when restoring a project.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01; https://www.tenable.com/security/research/tra-2021-50; https://www.zerodayinitiative.com/advisories/ZDI-21-450/
CVE: CVE-2021-23276
Published: 2021-04-13
Description: Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users in the data base.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf; https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf