deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37713
Published: 2021-08-31
Description: The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh; https://www.npmjs.com/package/tar
CVE: CVE-2021-39134
Published: 2021-08-31
Description: `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in their `package.json` file such as `"foo": "file:/some/path"`. Another package, `pwn-b` could define a dependency such as `FOO: "file:foo.tgz"`. On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above.
CVSS Score: 8.2 (HIGH)
CWE: CWE-61, CWE-178
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc; https://www.npmjs.com/package/%40npmcli/arborist
CVE: CVE-2021-39135
Published: 2021-08-31
Description: `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.
CVSS Score: 8.2 (HIGH)
CWE: CWE-61, CWE-59
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2; https://www.npmjs.com/package/%40npmcli/arborist
CVE: CVE-2021-39164
Published: 2021-08-31
Description: Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
CVSS Score: 3.1 (LOW)
CWE: CWE-200, CWE-863
References: https://github.com/matrix-org/synapse/commit/cb35df940a; https://github.com/matrix-org/synapse/releases/tag/v1.41.1; https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q
CVE: CVE-2021-3634
Published: 2021-08-31
Description: A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1978810; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRK67AJCWYYVAGF5SGAHNZXCX3PN3ZFP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKYD3ZRAMDAQX3ZW6THHUF3GXN7FF6B4/
CVE: CVE-2021-27668
Published: 2021-08-31
Description: HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427; https://security.gentoo.org/glsa/202207-01; https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427
CVE: CVE-2021-36231
Published: 2021-08-31
Description: Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands by crafting serialized objects.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-035.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-035.txt
CVE: CVE-2021-36232
Published: 2021-08-31
Description: Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-036.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-036.txt
CVE: CVE-2021-36233
Published: 2021-08-31
Description: The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesystem by specifying the file path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-037.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-037.txt
CVE: CVE-2021-36234
Published: 2021-08-31
Description: Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://www.syss.de; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-039.txt; https://www.syss.de
CVE: CVE-2021-37794
Published: 2021-08-31
Description: A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/omriinbar/1e28649f31d795b0e9b7698a9d255b5c; https://github.com/filebrowser/filebrowser; https://github.com/filebrowser/filebrowser/commit/201329abce4e92ae9071b9ded81e267aae159fbd
CVE: CVE-2021-39176
Published: 2021-08-31
Description: detect-character-encoding is a package for detecting character encoding using ICU. In detect-character-encoding v0.3.0 and earlier, allocated memory is not released. The problem has been patched in detect-character-encoding v0.3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588; https://github.com/sonicdoe/detect-character-encoding/pull/6; https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1
CVE: CVE-2021-39180
Published: 2021-08-31
Description: OpenOLAT is a web-based learning management system (LMS). A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user (e.g. the tomcat user). Depending on the configuration this can be limited to files of the OpenOlat user data directory, however, if not properly set up, the attack could also be used to overwrite application server config files, java code or even operating system files. The attack could be used to corrupt or modify any OpenOlat file such as course structures, config files or temporary test data. Those attack would require in-depth knowledge of the installation and thus more theoretical. If the app server configuration allows the execution of jsp files and the path to the context is known, it is also possible to execute java code. If the app server runs with the same user that is used to deploy the OpenOlat code or has write permissions on the OpenOlat code files and the path to the context is know, code injection is possible. The attack requires an OpenOlat user account to upload a ZIP file and trigger the unzip method. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3 and 16.0.0. There are no known workarounds aside from upgrading.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/OpenOLAT/OpenOLAT/commit/2cf73c972e23ccd69cc1e103e43c2c8253571d3e; https://github.com/OpenOLAT/OpenOLAT/commit/5668a41ab3f1753102a89757be[PII_REDACTED]79d5; https://github.com/OpenOLAT/OpenOLAT/commit/699490be8e931af0ef1f135c55384db1f4232637
CVE: CVE-2021-40085
Published: 2021-08-31
Description: An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/08/31/2; https://launchpad.net/bugs/1939733; https://lists.debian.org/debian-lts-announce/2021/10/msg00005.html
CVE: CVE-2021-22029
Published: 2021-08-31
Description: VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API denial of service due to improper rate limiting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.vmware.com/security/advisories/VMSA-2021-0017.html; https://www.vmware.com/security/advisories/VMSA-2021-0017.html
CVE: CVE-2021-22002
Published: 2021-08-31
Description: VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in addition a malicious actor could access /cfg diagnostic endpoints without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.vmware.com/security/advisories/VMSA-2021-0016.html; https://www.vmware.com/security/advisories/VMSA-2021-0016.html
CVE: CVE-2021-22003
Published: 2021-08-31
Description: VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and password complexity for the target account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://www.vmware.com/security/advisories/VMSA-2021-0016.html; https://www.vmware.com/security/advisories/VMSA-2021-0016.html
CVE: CVE-2020-20486
Published: 2021-08-31
Description: IEC104 v1.0 contains a stack-buffer overflow in the parameter Iec10x_Sta_Addr.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/airpig2011/IEC104/issues/14; https://github.com/airpig2011/IEC104/issues/14
CVE: CVE-2020-20490
Published: 2021-08-31
Description: A heap buffer-overflow in the client_example1.c component of libiec_iccp_mod v1.5 leads to a denial of service (DOS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/fcovatti/libiec_iccp_mod/issues/5; https://github.com/fcovatti/libiec_iccp_mod/issues/5
CVE: CVE-2020-20495
Published: 2021-09-01
Description: bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/bludit/bludit/issues/1246; https://github.com/bludit/bludit/issues/1246
CVE: CVE-2021-36235
Published: 2021-09-01
Description: An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the attacker can start applications with elevated privileges.
CVSS Score: 7.8 (HIGH)
References: https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-bypass-the-File-and-Folder-Security-by-leveraging-an-unspecified-attack-vector; https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-bypass-the-File-and-Folder-Security-by-leveraging-an-unspecified-attack-vector
CVE: CVE-2021-40353
Published: 2021-09-01
Description: A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/5qu1n7/CVE-2021-40353; https://www.opensis.com/download/english; https://github.com/5qu1n7/CVE-2021-40353
CVE: CVE-2021-33582
Published: 2021-09-01
Description: Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407
References: https://cyrus.topicbox.com/groups/announce/T3dde0a[PII_REDACTED]-M1386fc44adf967e072f8df13/cyrus-imap-3-4-2-3-2-8-and-3-0-16-released; https://github.com/cyrusimap/cyrus-imapd/commits/master; https://github.com/cyrusimap/cyrus-imapd/security/advisories
CVE: CVE-2021-37415
Published: 2021-09-01
Description: Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.manageengine.com; https://www.manageengine.com/products/service-desk/on-premises/readme.html#11302; https://www.manageengine.com
CVE: CVE-2021-39109
Published: 2021-09-01
Description: The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://bitbucket.org/atlassian/atlasboard/commits/9c03df09f09399e[PII_REDACTED]e8ba3a28236eb9c; https://bitbucket.org/atlassian/atlasboard/commits/9c03df09f09399e[PII_REDACTED]e8ba3a28236eb9c
CVE: CVE-2020-9000
Published: 2021-09-01
Description: An issue was discovered in iPortalis iCS 7.1.13.0. Attackers can send a sequence of requests to rapidly cause .NET Input Validation errors. This increases the size of the log file on the remote server until memory is exhausted, therefore consuming the maximum amount of resources (triggering a denial of service condition).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://websec.nl/blog/; https://websec.nl/blog/[PII_REDACTED]e759c7d31286d0/cve%20report%20august%202021/; https://websec.nl/blog/
CVE: CVE-2020-9002
Published: 2021-09-01
Description: An issue was discovered in iPortalis iCS 7.1.13.0. An attacker can gain privileges by intercepting a request and changing UserRoleKey=COMPANY_ADMIN to UserRoleKey=DOMAIN_ADMIN (to achieve Domain Administrator access).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://websec.nl/blog/; https://websec.nl/blog/[PII_REDACTED]e759c7d31286d0/cve%20report%20august%202021/; https://websec.nl/blog/
CVE: CVE-2021-35238
Published: 2021-09-01
Description: User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm; https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US; https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35238
CVE: CVE-2021-38703
Published: 2021-09-01
Description: Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be exploited in conjunction with CVE-2021-20090.
CVSS Score: 8.8 (HIGH)
References: https://7bits.nl/journal/posts/cve-2021-38703-kpn-experia-wifi-root-shell/; https://www.kpnwebshop.com/modems-routers/producten/experia-wifi/2; https://7bits.nl/journal/posts/cve-2021-38703-kpn-experia-wifi-root-shell/
CVE: CVE-2021-37151
Published: 2021-09-01
Description: CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://www.cyberark.com/products/; https://www.gov.il/en/departments/faq/cve_advisories; https://www.cyberark.com/products/
CVE: CVE-2021-39373
Published: 2021-09-01
Description: Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management. WideCharToMultiByte, WideCharStr, and MultiByteStr can contribute to password exposure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-j3f7-346q-97f4; https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-j3f7-346q-97f4
CVE: CVE-2021-39377
Published: 2021-09-01
Description: A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the index.php username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/security-n/CVE-2021-39377; https://opensis.com/
CVE: CVE-2021-39378
Published: 2021-09-01
Description: A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the NamesList.php str parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/security-n/CVE-2021-39378; https://opensis.com/
CVE: CVE-2021-39379
Published: 2021-09-01
Description: A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the ResetUserInfo.php password_stn_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/security-n/CVE-2021-39379; https://opensis.com/
CVE: CVE-2021-40352
Published: 2021-09-01
Description: OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: http://packetstormsecurity.com/files/164011/OpenEMR-6.0.0-Insecure-Direct-Object-Reference.html; https://github.com/allenenosh/CVE-2021-40352; https://www.open-emr.org/wiki/index.php/Securing_OpenEMR