deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39157
Published: 2021-08-24
Description: detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in [detect-character-encoding v0.7.0](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.7.0). No workaround are available and all users should update to resolve this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://github.com/sonicdoe/detect-character-encoding/commit/992a11007fff6cfd40b952150ab8d30410c4a20a; https://github.com/sonicdoe/detect-character-encoding/issues/15; https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-jqfh-8hw5-fqjr
CVE: CVE-2021-39509
Published: 2021-08-24
Description: An issue was discovered in D-Link DIR-816 DIR-816A2_FWv1.10CNB05_R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/doudoudedi/main-DIR-816_A2_Command-injection; https://github.com/doudoudedi/main-DIR-816_A2_Command-injection/blob/main/injection.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2021-39510
Published: 2021-08-24
Description: An issue was discovered in D-Link DIR816_A1_FW101CNB04 750m11ac wireless router, The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/doudoudedi/main-DIR-816_A1_Command-injection; https://github.com/doudoudedi/main-DIR-816_A1_Command-injection/blob/main/injection_A1.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2020-18913
Published: 2021-08-24
Description: EARCLINK ESPCMS-P8 was discovered to contain a SQL injection vulnerability in the espcms_web/Search.php component via the attr_array parameter. This vulnerability allows attackers to access sensitive database information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://tusk1.cn/2019/03/21/ESPCMS-P8%E5%89%8D%E5%8F%B0SQL%E6%B3%A8%E5%85%A5%E4%B8%8E%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB%E6%BC%8F%E6%B4%9E/; http://tusk1.cn/2019/03/21/ESPCMS-P8%E5%89%8D%E5%8F%B0SQL%E6%B3%A8%E5%85%A5%E4%B8%8E%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB%E6%BC%8F%E6%B4%9E/
CVE: CVE-2020-18917
Published: 2021-08-24
Description: The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://tusk1.cn/2019/05/12/DeDecms-v5-7-sp2-CRSF-%E6%96%87%E4%BB%B6%E6%93%8D%E4%BD%9C-%E5%89%8D%E5%8F%B0getshell/; http://tusk1.cn/2019/05/12/DeDecms-v5-7-sp2-CRSF-%E6%96%87%E4%BB%B6%E6%93%8D%E4%BD%9C-%E5%89%8D%E5%8F%B0getshell/
CVE: CVE-2021-31151
Published: 2021-08-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none
CVE: CVE-2021-32777
Published: 2021-08-24
Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.
CVSS Score: 8.6 (HIGH)
CWE: CWE-551, CWE-863, CWE-863
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h; https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history; https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h
CVE: CVE-2021-32778
Published: 2021-08-24
Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-834, CWE-834
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc; https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history; https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc
CVE: CVE-2021-32779
Published: 2021-08-24
Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a final "/admin" path element, or is using a negative assertion with final path element of "/admin". The client sends request to "/app1/admin#foo". In Envoy prior to 1.18.0, or 1.18.0+ configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when present, or as a suffix of the path when query string is absent, so it evaluates the final path element as "/admin#foo" and mismatches with the configured "/admin" path element. In Envoy 1.18.0+ configured with path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured /admin prefix. The resulting URI is sent to the next server-agent with the offending "#foo" fragment which violates RFC3986 or with the nonsensical "%23foo" text appended. A specifically constructed request with URI containing '#fragment' element delivered by an untrusted client in the presence of path based request authorization resulting in escalation of Privileges when path based request authorization extensions. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes that removes fragment from URI path in incoming requests.
CVSS Score: 8.6 (HIGH)
CWE: CWE-551, CWE-863, CWE-697
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9; https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history; https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9
CVE: CVE-2021-32780
Published: 2021-08-24
Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to DRAINING when it receives a SETTING frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. Receiving these two frames in the same I/O event results in abnormal termination of the Envoy process due to invalid state transition from CLOSED to DRAINING. A sequence of H/2 frames delivered by an untrusted upstream server will result in Denial of Service in the presence of untrusted **upstream** servers. Envoy versions 1.19.1, 1.18.4 contain fixes to stop processing of pending H/2 frames after connection transition to the CLOSED state.
CVSS Score: 8.6 (HIGH)
CWE: CWE-754, CWE-754
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8; https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history; https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8
CVE: CVE-2021-32781
Published: 2021-08-24
Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.
CVSS Score: 8.6 (HIGH)
CWE: CWE-416, CWE-120
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qv; https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history; https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qv
CVE: CVE-2021-39155
Published: 2021-08-24
Description: Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive. The proxy will route the request hostname in a case-insensitive way which means the authorization policy could be bypassed. As an example, the user may have an authorization policy that rejects request with hostname "httpbin.foo" for some source IPs, but the attacker can bypass this by sending the request with hostname "Httpbin.Foo". Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize Host header before the authorization check. This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.
CVSS Score: 8.3 (HIGH)
CWE: CWE-178, CWE-178, CWE-863
References: https://datatracker.ietf.org/doc/html/rfc4343; https://github.com/istio/istio/security/advisories/GHSA-7774-7vr3-cc8j; https://datatracker.ietf.org/doc/html/rfc4343
CVE: CVE-2021-39156
Published: 2021-08-24
Description: Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863, CWE-706
References: https://github.com/istio/istio/security/advisories/GHSA-hqxw-mm44-gc4r; https://istio.io/latest/news/security/istio-security-2021-008; https://github.com/istio/istio/security/advisories/GHSA-hqxw-mm44-gc4r
CVE: CVE-2021-40083
Published: 2021-08-25
Description: Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a remote attacker in an edge case (NSEC3 with too many iterations used for a positive wildcard proof).
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1169; https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1169
CVE: CVE-2021-40084
Published: 2021-08-25
Description: opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://bugs.debian.org/992058; https://github.com/artix-linux/opensysusers/releases; https://bugs.debian.org/992058
CVE: CVE-2021-40086
Published: 2021-08-25
Description: An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page (that can only be viewed by an administrator). While hidden from direct view, checking the page source would reveal the secret.
CVSS Score: 2.2 (LOW)
CWE: CWE-200
References: https://support.primekey.com/news/posts/52; https://support.primekey.com/news/posts/52
CVE: CVE-2021-40087
Published: 2021-08-25
Description: An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log (that can only be viewed by an administrator). This affects use of any of the following protocols: SCEP, CMP, or EST.
CVSS Score: 2.7 (LOW)
CWE: CWE-312
References: https://support.primekey.com/news/posts/53; https://support.primekey.com/news/posts/53
CVE: CVE-2021-40088
Published: 2021-08-25
Description: An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://support.primekey.com/news/posts/51; https://support.primekey.com/news/posts/51
CVE: CVE-2021-40089
Published: 2021-08-25
Description: An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
CVSS Score: 2.3 (LOW)
References: https://support.primekey.com/news/posts/54; https://support.primekey.com/news/posts/54
CVE: CVE-2021-39112
Published: 2021-08-25
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-1022, CWE-601
References: https://jira.atlassian.com/browse/JRASERVER-72433; https://jira.atlassian.com/browse/JRASERVER-72433
CVE: CVE-2021-33882
Published: 2021-08-25
Description: A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://www.bbraunusa.com/en.htm; https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/; https://www.bbraunusa.com/en.htm
CVE: CVE-2021-33883
Published: 2021-08-25
Description: A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.bbraunusa.com/en.htm; https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/; https://www.bbraunusa.com/en.htm
CVE: CVE-2021-33884
Published: 2021-08-25
Description: An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://www.bbraunusa.com/en.htm; https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/; https://www.bbraunusa.com/en.htm
CVE: CVE-2021-33885
Published: 2021-08-25
Description: An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-347
References: https://www.bbraunusa.com/en.htm; https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/; https://www.bbraunusa.com/en.htm
CVE: CVE-2021-33886
Published: 2021-08-25
Description: An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device.
CVSS Score: 8.1 (HIGH)
CWE: CWE-134
References: https://www.bbraunusa.com/en.htm; https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump/; https://www.bbraunusa.com/en.htm
CVE: CVE-2021-33605
Published: 2021-08-25
Description: Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://github.com/vaadin/flow-components/pull/1903; https://vaadin.com/security/cve-2021-33605; https://github.com/vaadin/flow-components/pull/1903
CVE: CVE-2018-10790
Published: 2021-08-25
Description: The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory allocation failure, as demonstrated by mp2aac.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://docs.google.com/document/d/1OSwQjtyALgV3OulmWGaTqZrSzk7Ta-xGrcLI0I7SPyM; https://github.com/axiomatic-systems/Bento4/issues/390; https://docs.google.com/document/d/1OSwQjtyALgV3OulmWGaTqZrSzk7Ta-xGrcLI0I7SPyM
CVE: CVE-2020-18971
Published: 2021-08-25
Description: Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://sourceforge.net/p/podofo/tickets/48/; https://sourceforge.net/p/podofo/tickets/48/
CVE: CVE-2020-18972
Published: 2021-08-25
Description: Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToken' in the component 'src/base/PdfToenizer.cpp'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://sourceforge.net/p/podofo/tickets/49/; https://sourceforge.net/p/podofo/tickets/49/
CVE: CVE-2020-18974
Published: 2021-08-25
Description: Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the component 'nasmlib/crc64'. This issue is different than CVE-2019-7147.
CVSS Score: 3.3 (LOW)
CWE: CWE-120
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392568; https://bugzilla.nasm.us/show_bug.cgi?id=3392568
CVE: CVE-2020-18976
Published: 2021-08-25
Description: Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the 'do_checksum' function in 'checksum.c'. It can be triggered by sending a crafted pcap file to the 'tcpreplay-edit' binary. This issue is different than CVE-2019-8381.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/appneta/tcpreplay/issues/556; https://github.com/appneta/tcpreplay/issues/556
CVE: CVE-2021-39136
Published: 2021-08-25
Description: baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN14134801/index.html; https://basercms.net/security/JVN_14134801; https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc
CVE: CVE-2021-39160
Published: 2021-08-25
Description: nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-94, CWE-78
References: https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25; https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481; https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j