deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-23452
Published: 2021-10-20
Description: This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.
CVSS Score: 8.6 (HIGH)
CWE: CWE-1321
References: https://runkit.com/embed/sq8qjwemyn8t; https://snyk.io/vuln/SNYK-JS-XASSIGN-1759314; https://runkit.com/embed/sq8qjwemyn8t
CVE: CVE-2021-21746
Published: 2021-10-20
Description: ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE: CVE-2021-21747
Published: 2021-10-20
Description: ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE: CVE-2021-3542
Published: 2021-10-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42739. Reason: This candidate is a reservation duplicate of CVE-2021-42739. Notes: All CVE users should reference CVE-2021-42739 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-21743
Published: 2021-10-20
Description: ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP response header information through a specially crafted HTTP request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE: CVE-2021-21744
Published: 2021-10-20
Description: ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration parameters of the device, causing some security functions of the device to be disabled.
CVSS Score: 7.5 (HIGH)
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE: CVE-2021-21745
Published: 2021-10-20
Description: ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE: CVE-2021-21748
Published: 2021-10-20
Description: ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE: CVE-2021-21749
Published: 2021-10-20
Description: ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
CVE: CVE-2021-41135
Published: 2021-10-20
Description: The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includes a user-defined expiration time for when the authorization grant expires. In Grant.ValidateBasic(), that time is compared to the node’s local clock time. Any chain running an affected version of the SDK with the authz module enabled could be halted by anyone with the ability to send transactions on that chain. Recovery would require applying the patch and rolling back the latest block. Users are advised to update to version 0.44.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349; https://github.com/cosmos/cosmos-sdk/commit/68ab790a761e80d3674f821794cf18ccbfed45ee; https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-2p6r-37p9-89p2
CVE: CVE-2021-38896
Published: 2021-10-20
Description: IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209566.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209566; https://www.ibm.com/support/pages/node/6506461; https://exchange.xforce.ibmcloud.com/vulnerabilities/209566
CVE: CVE-2021-41167
Published: 2021-10-20
Description: modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436; https://github.com/nicolas-van/modern-async/issues/5; https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2
CVE: CVE-2021-42762
Published: 2021-10-20
Description: BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
CVSS Score: 5.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/10/26/9; http://www.openwall.com/lists/oss-security/2021/10/27/1; http://www.openwall.com/lists/oss-security/2021/10/27/2
CVE: CVE-2021-42764
Published: 2021-10-20
Description: The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (delayed consensus decisions), and also increase the profits of individual validators, via short-range reorganizations of the underlying consensus chain.
CVSS Score: 9.1 (CRITICAL)
References: https://arxiv.org/abs/2110.10086; https://arxiv.org/abs/2110.10086
CVE: CVE-2021-42765
Published: 2021-10-20
Description: The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of service (indefinite stalling of consensus decisions).
CVSS Score: 7.5 (HIGH)
References: https://arxiv.org/abs/2110.10086; https://arxiv.org/abs/2110.10086
CVE: CVE-2021-42766
Published: 2021-10-20
Description: The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (long-range consensus chain reorganizations), even when this adversary has little stake and cannot influence network message propagation. This can cause a protocol stall, or an increase in the profits of individual validators.
CVSS Score: 9.1 (CRITICAL)
References: https://arxiv.org/abs/2110.10086; https://arxiv.org/abs/2110.10086
CVE: CVE-2021-42771
Published: 2021-10-20
Description: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://github.com/python-babel/babel/pull/782; https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html; https://lists.debian.org/debian-lts/2021/10/msg00040.html
CVE: CVE-2021-42299
Published: 2021-10-20
Description: Microsoft Surface Pro 3 Security Feature Bypass Vulnerability
CVSS Score: 5.6 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42299; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42299
CVE: CVE-2021-41163
Published: 2021-10-20
Description: Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. To workaround the issue without updating, requests with a path starting /webhooks/aws path could be blocked at an upstream proxy.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://github.com/discourse/discourse/commit/fa3c46cf079d28b086fe1025349bb00223a5d5e9; https://github.com/discourse/discourse/security/advisories/GHSA-jcjx-pvpc-qgwq; https://github.com/discourse/discourse/commit/fa3c46cf079d28b086fe1025349bb00223a5d5e9
CVE: CVE-2021-42096
Published: 2021-10-21
Description: GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-307
References: http://www.openwall.com/lists/oss-security/2021/10/21/4; https://bugs.launchpad.net/mailman/+bug/1947639; https://mail.python.org/archives/list/mailman-announce%40python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/
CVE: CVE-2021-42097
Published: 2021-10-21
Description: GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2021/10/21/4; https://bugs.launchpad.net/mailman/+bug/1947640; https://mail.python.org/archives/list/mailman-announce%40python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/
CVE: CVE-2021-1529
Published: 2021-10-21
Description: A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the system CLI. An attacker could exploit this vulnerability by authenticating to an affected device and submitting crafted input to the system CLI. A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-rhpbE34A; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-rhpbE34A
CVE: CVE-2021-34736
Published: 2021-10-21
Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to cause the web-based management interface to unexpectedly restart. The vulnerability is due to insufficient input validation on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to cause the interface to restart, resulting in a denial of service (DoS) condition.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imc-gui-dos-TZjrFyZh; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imc-gui-dos-TZjrFyZh
CVE: CVE-2021-34738
Published: 2021-10-21
Description: Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V
CVE: CVE-2021-34743
Published: 2021-10-21
Description: A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation of cross-site request forgery (CSRF) tokens. An attacker could exploit this vulnerability by convincing a targeted user who is currently authenticated to Cisco Webex Software to follow a link designed to pass malicious input to the Cisco Webex Software application authorization interface. A successful exploit could allow the attacker to cause Cisco Webex Software to authorize an application on the user's behalf without the express consent of the user, possibly allowing external applications to read data from that user's profile.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-2FmKd7T; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-2FmKd7T
CVE: CVE-2021-34760
Published: 2021-10-21
Description: A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-xss-CwjZJSQc; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-xss-CwjZJSQc
CVE: CVE-2021-34789
Published: 2021-10-21
Description: A vulnerability in the web-based management interface of Cisco Tetration could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected system. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need valid administrative credentials.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-work-xss-t6SYtu8Q; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-work-xss-t6SYtu8Q
CVE: CVE-2021-39126
Published: 2021-10-21
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-71806; https://jira.atlassian.com/browse/JRASERVER-71806
CVE: CVE-2021-39127
Published: 2021-10-21
Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-72003; https://jira.atlassian.com/browse/JRASERVER-72003
CVE: CVE-2021-40121
Published: 2021-10-21
Description: Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V
CVE: CVE-2021-40122
Published: 2021-10-21
Description: A vulnerability in an API of the Call Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper handling of large series of message requests. An attacker could exploit this vulnerability by sending a series of messages to the vulnerable API. A successful exploit could allow the attacker to cause the affected device to reload, dropping all ongoing calls and resulting in a DoS condition.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399, CWE-404
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cms-LAHe8z5v; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cms-LAHe8z5v
CVE: CVE-2021-40123
Published: 2021-10-21
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative read-only privileges to download files that should be restricted. This vulnerability is due to incorrect permissions settings on an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request to the device. A successful exploit could allow the attacker to download files that should be restricted.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-276
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-download-B3BR5KQA; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-download-B3BR5KQA
CVE: CVE-2021-23139
Published: 2021-10-21
Description: A null pointer vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an attacker to crash the CGI program on affected installations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://success.trendmicro.com/solution/000289229; https://success.trendmicro.com/solution/000289230; https://success.trendmicro.com/solution/000289229
CVE: CVE-2021-42011
Published: 2021-10-21
Description: An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://success.trendmicro.com/solution/000289229; https://www.zerodayinitiative.com/advisories/ZDI-21-1220/; https://success.trendmicro.com/solution/000289229
CVE: CVE-2021-42012
Published: 2021-10-21
Description: A stack-based buffer overflow vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://success.trendmicro.com/solution/000289229; https://success.trendmicro.com/solution/000289230; https://www.zerodayinitiative.com/advisories/ZDI-21-1221/
CVE: CVE-2021-42101
Published: 2021-10-21
Description: An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42103.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://success.trendmicro.com/solution/000289229; https://www.zerodayinitiative.com/advisories/ZDI-21-1219/; https://success.trendmicro.com/solution/000289229
CVE: CVE-2021-42102
Published: 2021-10-21
Description: An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://success.trendmicro.com/solution/000289229; https://www.zerodayinitiative.com/advisories/ZDI-21-1222/; https://success.trendmicro.com/solution/000289229
CVE: CVE-2021-42103
Published: 2021-10-21
Description: An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42101.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://success.trendmicro.com/solution/000289229; https://www.zerodayinitiative.com/advisories/ZDI-21-1213/; https://success.trendmicro.com/solution/000289229
CVE: CVE-2021-42104
Published: 2021-10-21
Description: Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42105, 42106 and 42107.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/solution/000289229; https://success.trendmicro.com/solution/000289230; https://www.zerodayinitiative.com/advisories/ZDI-21-1216/