deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21376
Published: 2021-03-23
Description: OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information exposure vulnerability. Some additional information being loaded is not used by the webclient and is being removed in this release. This is fixed in version 5.9.0.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021; https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb[PII_REDACTED]29d137908c; https://github.com/ome/omero-web/security/advisories/GHSA-gfp2-w5jm-955q
CVE: CVE-2021-21377
Published: 2021-03-23
Description: OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-601
References: https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021; https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb[PII_REDACTED]29d137908c; https://github.com/ome/omero-web/security/advisories/GHSA-g4rf-pc26-6hmr
CVE: CVE-2020-12483
Published: 2021-03-23
Description: The appstore before 8.12.0.0 exposes some of its components, and the attacker can cause remote download and install apps through carefully constructed parameters.
CVSS Score: 8.2 (HIGH)
CWE: CWE-601, CWE-601
References: https://www.vivo.com/en/support/security-advisory-detail?id=1; https://www.vivo.com/en/support/security-advisory-detail?id=1
CVE: CVE-2021-20219
Published: 2021-03-23
Description: A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a normal user privilege could delay the loop (due to a changing ldata->read_head, and a missing sanity check) and cause a threat to the system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-697
References: https://bugzilla.redhat.com/show_bug.cgi?id=1923738; https://bugzilla.redhat.com/show_bug.cgi?id=1923738
CVE: CVE-2021-20222
Published: 2021-03-23
Description: A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1924606; https://bugzilla.redhat.com/show_bug.cgi?id=1924606
CVE: CVE-2021-20227
Published: 2021-03-23
Description: A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1924886; https://security.gentoo.org/glsa/202103-04; https://security.gentoo.org/glsa/202210-40
CVE: CVE-2021-20270
Published: 2021-03-23
Description: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=1922136; https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html; https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html
CVE: CVE-2021-23274
Published: 2021-03-23
Description: The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack using this vulnerability does not require human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO API Exchange Gateway: versions 2.3.3 and below and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric: versions 2.3.3 and below.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1021
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-23-2021-tibco-api-exchange-gateway; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-23362
Published: 2021-03-23
Description: The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7; https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01
CVE: CVE-2021-21401
Published: 2021-03-23
Description: Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.
CVSS Score: 7.1 (HIGH)
CWE: CWE-763
References: https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1; https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261; https://github.com/nanopb/nanopb/issues/647
CVE: CVE-2021-3444
Published: 2021-03-23
Description: The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.
CVSS Score: 7.8 (HIGH)
CWE: CWE-681, CWE-125, CWE-681
References: http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html; http://packetstormsecurity.com/files/164950/Kernel-Live-Patch-Security-Notice-LSN-0082-1.html; http://www.openwall.com/lists/oss-security/2021/03/23/2
CVE: CVE-2020-24994
Published: 2021-03-23
Description: Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-770
References: https://github.com/libass/libass/commit/6835731c2fe4164a0c50bc91d12c43b2a2b4e; https://github.com/libass/libass/issues/422; https://github.com/libass/libass/issues/422#issuecomment-806002919
CVE: CVE-2021-21402
Published: 2021-03-23
Description: Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://github.com/jellyfin/jellyfin/commit/0183ef8e89195f420c48d2600bc0b72f6d3a7fd7; https://github.com/jellyfin/jellyfin/releases/tag/v10.7.1; https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wg4c-c9g9-rxhx
CVE: CVE-2021-27908
Published: 2021-03-23
Description: In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200, CWE-74
References: https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx; https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx
CVE: CVE-2021-3392
Published: 2021-03-23
Description: A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
CVSS Score: 3.2 (LOW)
CWE: CWE-416, CWE-416
References: https://bugs.launchpad.net/qemu/+bug/1914236; https://bugzilla.redhat.com/show_bug.cgi?id=1924042; https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html
CVE: CVE-2019-19343
Published: 2021-03-23
Description: A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. Versions before undertow 2.0.25.SP1 and jboss-remoting 5.0.14.SP1 are believed to be vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-404
References: https://bugzilla.redhat.com/show_bug.cgi?id=1780445; https://issues.redhat.com/browse/JBEAP-16695; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-28099
Published: 2021-03-23
Description: In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-330
References: https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-001.md; https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-001.md
CVE: CVE-2021-28100
Published: 2021-03-23
Description: Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-002.md; https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-002.md
CVE: CVE-2021-28817
Published: 2021-03-23
Description: The Windows Installation component of TIBCO Software Inc.'s TIBCO Rendezvous and TIBCO Rendezvous Developer Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Rendezvous: versions 8.5.1 and below and TIBCO Rendezvous Developer Edition: versions 8.5.1 and below.
CVSS Score: 8.8 (HIGH)
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28818
Published: 2021-03-23
Description: The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), Rendezvous Secure C API, Rendezvous Java API, and Rendezvous .Net API components of TIBCO Software Inc.'s TIBCO Rendezvous and TIBCO Rendezvous Developer Edition contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO Rendezvous: versions 8.5.1 and below and TIBCO Rendezvous Developer Edition: versions 8.5.1 and below.
CVSS Score: 8.8 (HIGH)
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28819
Published: 2021-03-23
Description: The Windows Installation component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.5.0 and below, TIBCO FTL - Developer Edition: versions 6.5.0 and below, and TIBCO FTL - Enterprise Edition: versions 6.5.0 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28820
Published: 2021-03-23
Description: The FTL Server (tibftlserver), FTL C API, FTL Golang API, FTL Java API, and FTL .Net API components of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.5.0 and below, TIBCO FTL - Developer Edition: versions 6.5.0 and below, and TIBCO FTL - Enterprise Edition: versions 6.5.0 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28821
Published: 2021-03-23
Description: The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Message Service: versions 8.5.1 and below, TIBCO Enterprise Message Service - Community Edition: versions 8.5.1 and below, and TIBCO Enterprise Message Service - Developer Edition: versions 8.5.1 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28822
Published: 2021-03-23
Description: The Enterprise Message Service Server (tibemsd), Enterprise Message Service Central Administration (tibemsca), Enterprise Message Service JSON configuration generator (tibemsconf2json), and Enterprise Message Service C API components of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Message Service: versions 8.5.1 and below, TIBCO Enterprise Message Service - Community Edition: versions 8.5.1 and below, and TIBCO Enterprise Message Service - Developer Edition: versions 8.5.1 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28823
Published: 2021-03-23
Description: The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28824
Published: 2021-03-23
Description: The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.5.0 and below, TIBCO ActiveSpaces - Developer Edition: versions 4.5.0 and below, and TIBCO ActiveSpaces - Enterprise Edition: versions 4.5.0 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-3409
Published: 2021-03-23
Description: The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928146; https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html; https://security.gentoo.org/glsa/202208-27
CVE: CVE-2021-22864
Published: 2021-03-23
Description: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to override environment variables leading to code execution on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.0.3 and was fixed in 3.0.3, 2.22.9, and 2.21.17. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.17; https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.9; https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.3
CVE: CVE-2020-13604
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-13605
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-13606
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-13607
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-13608
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-13609
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-13610
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-13611
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-13612
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none