deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20799
Published: 2021-10-13
Description: Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN52694228/index.html; https://kb.cybozu.support/article/37425; https://jvn.jp/en/jp/JVN52694228/index.html
CVE: CVE-2021-20800
Published: 2021-10-13
Description: Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN52694228/index.html; https://kb.cybozu.support/article/37420; https://jvn.jp/en/jp/JVN52694228/index.html
CVE: CVE-2021-20801
Published: 2021-10-13
Description: Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Firefox.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://jvn.jp/en/jp/JVN52694228/index.html; https://kb.cybozu.support/article/37423; https://jvn.jp/en/jp/JVN52694228/index.html
CVE: CVE-2021-20802
Published: 2021-10-13
Description: HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://jvn.jp/en/jp/JVN52694228/index.html; https://kb.cybozu.support/article/37428; https://jvn.jp/en/jp/JVN52694228/index.html
CVE: CVE-2021-20803
Published: 2021-10-13
Description: Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the management screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://jvn.jp/en/jp/JVN52694228/index.html; https://kb.cybozu.support/article/37421; https://jvn.jp/en/jp/JVN52694228/index.html
CVE: CVE-2021-20804
Published: 2021-10-13
Description: Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to cause a denial of service (DoS) condition via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN52694228/index.html; https://kb.cybozu.support/article/37426; https://jvn.jp/en/jp/JVN52694228/index.html
CVE: CVE-2021-20805
Published: 2021-10-13
Description: Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.7 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN52694228/index.html; https://kb.cybozu.support/article/37431; https://jvn.jp/en/jp/JVN52694228/index.html
CVE: CVE-2021-20806
Published: 2021-10-13
Description: Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://jvn.jp/en/jp/JVN52694228/index.html; https://kb.cybozu.support/article/37419; https://jvn.jp/en/jp/JVN52694228/index.html
CVE: CVE-2021-20807
Published: 2021-10-13
Description: Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.0.0 to 3.1.9 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN52694228/index.html; https://kb.cybozu.support/article/37430; https://jvn.jp/en/jp/JVN52694228/index.html
CVE: CVE-2021-20831
Published: 2021-10-13
Description: Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of administrators and unintended operation may be performed via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN29428319/index.html; https://wordpress.org/plugins/og-tags/; https://jvn.jp/en/jp/JVN29428319/index.html
CVE: CVE-2021-20832
Published: 2021-10-13
Description: InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510) contain a vulnerability which may lead to information disclosure only when it works with the body composition analyzer InBody Dial. This may allow an attacker who can connect to the InBody Dial with InBody App may obtain a victim's measurement result measured by InBody Dial.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://jvn.jp/en/jp/JVN63023305/index.html; https://www.inbody.co.jp/inbody-news/?uid=55&mod=document&pageid=1; https://jvn.jp/en/jp/JVN63023305/index.html
CVE: CVE-2021-20833
Published: 2021-10-13
Description: The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle attackers to eavesdrop on and/or alter encrypted communication via a crafted certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://jvn.jp/en/jp/JVN10168753/index.html; https://snkrdunk.com/information/37/; https://jvn.jp/en/jp/JVN10168753/index.html
CVE: CVE-2021-20834
Published: 2021-10-13
Description: Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2.177.1 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-862
References: https://apps.apple.com/app/nike/id[PII_REDACTED]; https://jvn.jp/en/jp/JVN89126639/index.html; https://play.google.com/store/apps/details?id=com.nike.omega
CVE: CVE-2021-33609
Published: 2021-10-13
Description: Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-20
References: https://github.com/vaadin/framework/pull/12415; https://vaadin.com/security/cve-2021-33609; https://github.com/vaadin/framework/pull/12415
CVE: CVE-2021-41137
Published: 2021-10-13
Description: Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true for rootCreds. In the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts. This issue is fixed in `RELEASE.2021-10-13T00-23-17Z`. A downgrade back to release `RELEASE.2021-10-08T23-58-24Z` is available as a workaround.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://github.com/minio/minio/commit/415bbc74aacd53a120e54a663e941b1809982dbd; https://github.com/minio/minio/pull/13388; https://github.com/minio/minio/pull/13422
CVE: CVE-2021-34814
Published: 2021-10-13
Description: Proofpoint Spam Engine before 8.12.0[PII_REDACTED] has a Security Control Bypass.
CVSS Score: 7.5 (HIGH)
References: https://www.proofpoint.com/us/security/security-advisories; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0010; https://www.proofpoint.com/us/security/security-advisories
CVE: CVE-2021-39304
Published: 2021-10-13
Description: Proofpoint Enterprise Protection before 8.12.0[PII_REDACTED] allows security control bypass.
CVSS Score: 7.5 (HIGH)
References: https://www.proofpoint.com/us/blog; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0007; https://www.proofpoint.com/us/blog
CVE: CVE-2021-20123
Published: 2021-10-13
Description: A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.tenable.com/security/research/tra-2021-42; https://www.tenable.com/security/research/tra-2021-42; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20123
CVE: CVE-2021-20124
Published: 2021-10-13
Description: A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.tenable.com/security/research/tra-2021-42; https://www.tenable.com/security/research/tra-2021-42; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20124
CVE: CVE-2021-20125
Published: 2021-10-13
Description: An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3. An unauthenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with root privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-434
References: https://www.tenable.com/security/research/tra-2021-42; https://www.tenable.com/security/research/tra-2021-42
CVE: CVE-2021-20126
Published: 2021-10-13
Description: Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2021-42; https://www.tenable.com/security/research/tra-2021-42
CVE: CVE-2021-20127
Published: 2021-10-13
Description: An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-B3. This allows an authenticated user to arbitrarily delete files in any location on the target operating system with root privileges.
CVSS Score: 8.1 (HIGH)
References: https://www.tenable.com/security/research/tra-2021-42; https://www.tenable.com/security/research/tra-2021-42
CVE: CVE-2021-20128
Published: 2021-10-13
Description: The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as user input is not properly sanitized.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-42; https://www.tenable.com/security/research/tra-2021-42
CVE: CVE-2021-20129
Published: 2021-10-13
Description: An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://www.tenable.com/security/research/tra-2021-42; https://www.tenable.com/security/research/tra-2021-42
CVE: CVE-2021-22033
Published: 2021-10-13
Description: Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.
CVSS Score: 2.7 (LOW)
CWE: CWE-918
References: https://www.vmware.com/security/advisories/VMSA-2021-0021.html; https://www.vmware.com/security/advisories/VMSA-2021-0021.html
CVE: CVE-2021-22035
Published: 2021-10-13
Description: VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://www.vmware.com/security/advisories/VMSA-2021-0022.html; https://www.vmware.com/security/advisories/VMSA-2021-0022.html
CVE: CVE-2021-22036
Published: 2021-10-13
Description: VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.vmware.com/security/advisories/VMSA-2021-0023.html; https://www.vmware.com/security/advisories/VMSA-2021-0023.html
CVE: CVE-2021-3057
Published: 2021-10-13
Description: A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.9 on Windows; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.8 on Windows; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.8 on the Universal Windows Platform; GlobalProtect app 5.3 versions earlier than GlobalProtect app 5.3.1 on Linux.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://security.paloaltonetworks.com/CVE-2021-3057; https://security.paloaltonetworks.com/CVE-2021-3057
CVE: CVE-2021-41138
Published: 2021-10-13
Description: Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block. The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent `pallet-evm` execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors. The issue is patched in commit `146bb48849e5393004be5c88beefe76fdf009aba`.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/paritytech/frontier/commit/146bb48849e5393004be5c88beefe76fdf009aba; https://github.com/paritytech/frontier/pull/497; https://github.com/paritytech/frontier/security/advisories/GHSA-vj62-g63v-f8mf
CVE: CVE-2021-35498
Published: 2021-10-13
Description: The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it will be accepted as valid. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.123 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, and 5.9.14, TIBCO EBX: versions 6.0.0 and 6.0.1, and TIBCO Product and Service Catalog powered by TIBCO EBX: version 1.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-13-2021-tibco-ebx-2021-35498; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-40732
Published: 2021-10-13
Description: XMP Toolkit version 2020.1 (and earlier) is affected by a null pointer dereference vulnerability that could result in leaking data from certain memory locations and causing a local denial of service in the context of the current user. User interaction is required to exploit this vulnerability in that the victim will need to open a specially crafted MXF file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://helpx.adobe.com/security/products/xmpcore/apsb21-85.html; https://lists.debian.org/debian-lts-announce/2023/09/msg00032.html; https://helpx.adobe.com/security/products/xmpcore/apsb21-85.html
CVE: CVE-2021-41139
Published: 2021-10-13
Description: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions prior to 1.19.30.5600, it was possible to craft the URI with malicious JavaScript, use social engineering to convince logged on user to click on such link, and have the attacker-supplied JavaScript to be executed in user's browser. This issue is patched in version 1.19.30.5600. As a workaround, one may introduce `ttValidDbDateFormatDate` function as in the latest version and add a call to it within the access checks block in time.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/anuko/timetracker/commit/559906731f153c9b3a632c2839ed11669b76d593; https://github.com/anuko/timetracker/commit/d3f60bd3e3ea8ff8ec31a596baec6750af601b7c; https://github.com/anuko/timetracker/security/advisories/GHSA-h2v8-87c9-86cw
CVE: CVE-2021-20130
Published: 2021-10-13
Description: ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PasswordExpiry interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.tenable.com/security/research/tra-2021-43; https://www.tenable.com/security/research/tra-2021-43
CVE: CVE-2021-20131
Published: 2021-10-13
Description: ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Personalization interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.tenable.com/security/research/tra-2021-43; https://www.tenable.com/security/research/tra-2021-43
CVE: CVE-2021-40842
Published: 2021-10-13
Description: Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the server could be used to blindly execute arbitrary SQL statements on the backend database. Version 7.12.0 and all versions prior to 7.11.2 are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.proofpoint.com/us/security/security-advisories; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0008; https://www.proofpoint.com/us/security/security-advisories
CVE: CVE-2021-40843
Published: 2021-10-13
Description: Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local database could cause arbitrary code to execute with SYSTEM privileges on the underlying server when a Web Console user triggers retrieval of that data. When chained with a SQL injection vulnerability, the vulnerability could be exploited remotely if Web Console users click a series of maliciously crafted URLs. All versions prior to 7.11.2 are affected.
CVSS Score: 7.3 (HIGH)
CWE: CWE-502
References: https://www.proofpoint.com/us/security/security-advisories; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0009; https://www.proofpoint.com/us/security/security-advisories
CVE: CVE-2021-42223
Published: 2021-10-13
Description: Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/50386; https://www.exploit-db.com/exploits/50386
CVE: CVE-2021-42224
Published: 2021-10-13
Description: SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/164514/IFSC-Code-Finder-Project-1.0-SQL-Injection.html; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42224; https://www.exploit-db.com/exploits/50391
CVE: CVE-2021-26318
Published: 2021-10-13
Description: A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1017; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1017
CVE: CVE-2021-40493
Published: 2021-10-13
Description: Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.manageengine.com/network-monitoring/security-updates/cve-2021-40493.html; https://www.manageengine.com/network-monitoring/security-updates/cve-2021-40493.html
CVE: CVE-2021-41075
Published: 2021-10-13
Description: The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.manageengine.com/network-monitoring/help/read-me-complete.html#build_125455; https://www.manageengine.com/network-monitoring/help/read-me-complete.html#build_125455
CVE: CVE-2021-40854
Published: 2021-10-14
Description: AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to launch a privileged Notepad process that can launch other applications.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://anydesk.com/cve/2021-40854/; https://anydesk.com/cve/2021-40854/
CVE: CVE-2021-42341
Published: 2021-10-14
Description: checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.
CVSS Score: 7.5 (HIGH)
References: https://bugs.gentoo.org/816900; https://github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae; https://github.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204
CVE: CVE-2021-42342
Published: 2021-10-14
Description: An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/embedthis/goahead/issues/305; https://github.com/embedthis/goahead/issues/305