deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44178
Published: 2022-01-13
Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a reflected Cross-Site Scripting (XSS) vulnerability via the itemResourceType parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE: CVE-2021-45053
Published: 2022-01-13
Description: Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-04.html; https://helpx.adobe.com/security/products/incopy/apsb22-04.html
CVE: CVE-2021-45054
Published: 2022-01-13
Description: Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/incopy/apsb22-04.html; https://helpx.adobe.com/security/products/incopy/apsb22-04.html
CVE: CVE-2021-45055
Published: 2022-01-13
Description: Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/incopy/apsb22-04.html; https://helpx.adobe.com/security/products/incopy/apsb22-04.html
CVE: CVE-2021-45056
Published: 2022-01-13
Description: Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-04.html; https://helpx.adobe.com/security/products/incopy/apsb22-04.html
CVE: CVE-2021-45057
Published: 2022-01-13
Description: Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPEG2000 file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-05.html; https://helpx.adobe.com/security/products/indesign/apsb22-05.html
CVE: CVE-2021-45058
Published: 2022-01-13
Description: Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPEG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-05.html; https://helpx.adobe.com/security/products/indesign/apsb22-05.html
CVE: CVE-2021-45059
Published: 2022-01-13
Description: Adobe InDesign version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/indesign/apsb22-05.html; https://helpx.adobe.com/security/products/indesign/apsb22-05.html
CVE: CVE-2022-21682
Published: 2022-01-13
Description: Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/flatpak/flatpak/commit/445bddeee657fdc8d2a0a1f0de12975400d4fc1a; https://github.com/flatpak/flatpak/commit/4d11f77aa7fd3e64cfa80af89d92567ab9e8e6fa; https://github.com/flatpak/flatpak/security/advisories/GHSA-8ch7-5j3h-g4fx
CVE: CVE-2022-21684
Published: 2022-01-13
Description: Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with `must_approve_users` enabled is going to be automatically logged in, bypassing the check that does not allow unapproved users to sign in. They will be able to do everything an approved user can do. If they logout, they cannot log back in. This issue is patched in the `stable` version 2.7.13, `beta` version 2.8.0.beta11, and `tests-passed` version 2.8.0.beta11. One may disable invites as a workaround. Administrators can increase `min_trust_level_to_allow_invite` to reduce the attack surface to more trusted users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/discourse/discourse/commit/584c6a2e8bc705072b09a9c4b55126d6f8ed4ad2; https://github.com/discourse/discourse/security/advisories/GHSA-p63q-jp48-h8xh; https://meta.discourse.org/t/invite-redemption-allowed-user-to-access-forum-before-approval/214328
CVE: CVE-2022-22988
Published: 2022-01-13
Description: File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once an attacker has already found a way to get authenticated access to the device.
CVSS Score: 7.7 (HIGH)
CWE: CWE-275, CWE-732
References: https://www.westerndigital.com/support/product-security/wdc-22003-edgerover-desktop-app-version-1-5-0-576; https://www.westerndigital.com/support/product-security/wdc-22003-edgerover-desktop-app-version-1-5-0-576
CVE: CVE-2022-22989
Published: 2022-01-13
Description: My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network. Addressed the vulnerability by adding defenses against stack overflow issues.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117; https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
CVE: CVE-2022-22990
Published: 2022-01-13
Description: A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287, CWE-697
References: https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117; https://www.zerodayinitiative.com/advisories/ZDI-22-076/; https://www.zerodayinitiative.com/advisories/ZDI-22-347/
CVE: CVE-2022-22991
Published: 2022-01-13
Description: A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117; https://www.zerodayinitiative.com/advisories/ZDI-22-077/; https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
CVE: CVE-2021-34858
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TVS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13606.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://community.teamviewer.com/English/discussion/117794/august-updates-security-patches/p1; https://www.zerodayinitiative.com/advisories/ZDI-21-1001/; https://community.teamviewer.com/English/discussion/117794/august-updates-security-patches/p1
CVE: CVE-2021-34871
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14695.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002; https://www.zerodayinitiative.com/advisories/ZDI-21-1459/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002
CVE: CVE-2021-34872
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14737.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0014; https://www.zerodayinitiative.com/advisories/ZDI-21-1462/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0014
CVE: CVE-2021-34873
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14696.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0003; https://www.zerodayinitiative.com/advisories/ZDI-21-1460/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0003
CVE: CVE-2021-34874
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of 3DS files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14736.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004; https://www.zerodayinitiative.com/advisories/ZDI-21-1461/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004
CVE: CVE-2021-34875
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14827.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004; https://www.zerodayinitiative.com/advisories/ZDI-21-1463/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004
CVE: CVE-2021-34876
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14828.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-21-1464/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-34877
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14829.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-21-1465/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-34878
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14830.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-21-1466/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-34879
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14832.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0006; https://www.zerodayinitiative.com/advisories/ZDI-21-1468/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0006
CVE: CVE-2021-34880
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14833.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004; https://www.zerodayinitiative.com/advisories/ZDI-21-1469/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004
CVE: CVE-2021-34881
Published: 2022-01-13
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14834.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0007; https://www.zerodayinitiative.com/advisories/ZDI-21-1470/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0007
CVE: CVE-2021-34882
Published: 2022-01-13
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14835.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0008; https://www.zerodayinitiative.com/advisories/ZDI-21-1471/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0008
CVE: CVE-2021-34883
Published: 2022-01-13
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14836.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0006; https://www.zerodayinitiative.com/advisories/ZDI-21-1472/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0006
CVE: CVE-2021-34884
Published: 2022-01-13
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14837.
CVSS Score: 3.3 (LOW)
CWE: CWE-416, CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0008; https://www.zerodayinitiative.com/advisories/ZDI-21-1473/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0008
CVE: CVE-2021-34885
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14838.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-21-1474/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-34886
Published: 2022-01-13
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14839.
CVSS Score: 3.3 (LOW)
CWE: CWE-416, CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0012; https://www.zerodayinitiative.com/advisories/ZDI-21-1475/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0012