deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37364
Published: 2021-10-26
Description: OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://sourceforge.net/projects/open-clinic/; https://sourceforge.net/projects/open-clinic/files/latest/download; https://www.exploit-db.com/exploits/50448
CVE: CVE-2021-41157
Published: 2021-10-26
Description: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Abuse of this security issue allows attackers to subscribe to user agent event notifications without the need to authenticate. This abuse poses privacy concerns and might lead to social engineering or similar attacks. For example, attackers may be able to monitor the status of target SIP extensions. Although this issue was fixed in version v1.10.6, installations upgraded to the fixed version of FreeSWITCH from an older version, may still be vulnerable if the configuration is not updated accordingly. Software upgrades do not update the configuration by default. SIP SUBSCRIBE messages should be authenticated by default so that FreeSWITCH administrators do not need to explicitly set the `auth-subscriptions` parameter. When following such a recommendation, a new parameter can be introduced to explicitly disable authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-306
References: http://seclists.org/fulldisclosure/2021/Oct/41; https://github.com/signalwire/freeswitch/commit/b21dd4e7f3a6f1d5f7be3ea500a319a5bc11db9e; https://github.com/signalwire/freeswitch/releases/tag/v1.10.6
CVE: CVE-2021-41158
Published: 2021-10-26
Description: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, an attacker can perform a SIP digest leak attack against FreeSWITCH and receive the challenge response of a gateway configured on the FreeSWITCH server. This is done by challenging FreeSWITCH's SIP requests with the realm set to that of the gateway, thus forcing FreeSWITCH to respond with the challenge response which is based on the password of that targeted gateway. Abuse of this vulnerability allows attackers to potentially recover gateway passwords by performing a fast offline password cracking attack on the challenge response. The attacker does not require special network privileges, such as the ability to sniff the FreeSWITCH's network traffic, to exploit this issue. Instead, what is required for this attack to work is the ability to cause the victim server to send SIP request messages to the malicious party. Additionally, to exploit this issue, the attacker needs to specify the correct realm which might in some cases be considered secret. However, because many gateways are actually public, this information can easily be retrieved. The vulnerability appears to be due to the code which handles challenges in `sofia_reg.c`, `sofia_reg_handle_sip_r_challenge()` which does not check if the challenge is originating from the actual gateway. The lack of these checks allows arbitrary UACs (and gateways) to challenge any request sent by FreeSWITCH with the realm of the gateway being targeted. This issue is patched in version 10.10.7. Maintainers recommend that one should create an association between a SIP session for each gateway and its realm to make a check be put into place for this association when responding to challenges.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200, CWE-346
References: http://seclists.org/fulldisclosure/2021/Oct/40; https://github.com/signalwire/freeswitch/releases/tag/v1.10.7; https://github.com/signalwire/freeswitch/security/advisories/GHSA-3v3f-99mv-qvj4
CVE: CVE-2021-41172
Published: 2021-10-26
Description: AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is patched in version 0.5.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/AntSword-Store/AS_Redis/issues/1; https://github.com/Medicean/AS_Redis/security/advisories/GHSA-j8j6-f829-w425; https://mp.weixin.qq.com/s/yjuG6DLT_bSRnpggPj21Xw
CVE: CVE-2021-41173
Published: 2021-10-26
Description: Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside from upgrading.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: https://github.com/ethereum/go-ethereum/commit/e40b37718326b8b4873b3b00a0db2e6c6d9ea738; https://github.com/ethereum/go-ethereum/pull/23801; https://github.com/ethereum/go-ethereum/releases/tag/v1.10.9
CVE: CVE-2021-41175
Published: 2021-10-26
Description: Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/pi-hole/AdminLTE/commit/01191c7a1b8d5032991ed9d88e0db8d3dbec744d; https://github.com/pi-hole/AdminLTE/releases/tag/v5.8; https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-mhr8-7rvg-8r43
CVE: CVE-2021-41182
Published: 2021-10-26
Description: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/; https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63; https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc
CVE: CVE-2021-41183
Published: 2021-10-26
Description: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/; https://bugs.jqueryui.com/ticket/15284; https://github.com/jquery/jquery-ui/pull/1953
CVE: CVE-2021-41184
Published: 2021-10-26
Description: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/; https://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280; https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
CVE: CVE-2021-41185
Published: 2021-10-26
Description: Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may manually apply the changes from the fix commit.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/kizniche/Mycodo/commit/23ac5dd422029c2b6ae1701a3599b6d41b66a6a9; https://github.com/kizniche/Mycodo/issues/1105; https://github.com/kizniche/Mycodo/releases/tag/v8.12.7
CVE: CVE-2021-41188
Published: 2021-10-26
Description: Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021; https://github.com/shopware/shopware/commit/37213e91d525c95df262712cba80d1497e395a58; https://github.com/shopware/shopware/releases/tag/v5.7.6
CVE: CVE-2021-35499
Published: 2021-10-26
Description: The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: versions 10.4.0 and below.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-26-2021-tibco-nimbus-2021-35499; https://www.tibco.com/services/support/advisories
CVE: CVE-2019-3556
Published: 2021-10-26
Description: HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/facebook/hhvm/commit/abe0b29e4d3a610f9bc920b8be4ad8403364c2d4; https://hhvm.com/blog/2020/11/12/security-update.html; https://www.facebook.com/security/advisories/cve-2019-3556
CVE: CVE-2020-22864
Published: 2021-10-26
Description: A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/froala/wysiwyg-editor/issues/3880; https://www.youtube.com/watch?v=WE3b1iSnWJY; https://github.com/froala/wysiwyg-editor/issues/3880
CVE: CVE-2021-23877
Published: 2021-10-26
Description: Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary code as the admin user by replacing a specific temporary file created during the installation of the trial version of MTP.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103215; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103215
CVE: CVE-2021-41866
Published: 2021-10-26
Description: MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mybb/mybb/security/advisories/; https://github.com/mybb/mybb/security/advisories/GHSA-gxhv-r3m5-6qv7; https://github.com/mybb/mybb/security/advisories/
CVE: CVE-2011-4124
Published: 2021-10-27
Description: Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://bugs.launchpad.net/calibre/+bug/885027; https://git.zx2c4.com/calibre-mount-helper-exploit/about/; https://lwn.net/Articles/464824/
CVE: CVE-2011-4125
Published: 2021-10-27
Description: A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-426
References: https://bugs.launchpad.net/calibre/+bug/885027; https://git.zx2c4.com/calibre-mount-helper-exploit/about/; https://lwn.net/Articles/464824/
CVE: CVE-2011-4126
Published: 2021-10-27
Description: Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.
CVSS Score: 8.1 (HIGH)
CWE: CWE-367
References: https://bugs.launchpad.net/calibre/+bug/885027; https://git.zx2c4.com/calibre-mount-helper-exploit/about/; https://lwn.net/Articles/464824/
CVE: CVE-2011-4574
Published: 2021-10-27
Description: PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high resolution timer (the RDTSC instruction). This instruction can be virtualized, and some virtual machine hosts have chosen to disable this instruction, returning 0s or predictable results.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-338
References: https://tls.mbed.org/tech-updates/security-advisories/polarssl-security-advisory-2011-02; https://tls.mbed.org/tech-updates/security-advisories/polarssl-security-advisory-2011-02
CVE: CVE-2020-7867
Published: 2021-10-27
Description: An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of administrator.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36303; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36303
CVE: CVE-2021-26610
Published: 2021-10-27
Description: The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-353, CWE-345
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36304; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36304
CVE: CVE-2021-32951
Published: 2021-10-27
Description: WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses and names of all the devices managed via WebAccess/NMS.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-229-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-229-02
CVE: CVE-2021-35233
Published: 2021-10-27
Description: The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-16
References: https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35233; https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm
CVE: CVE-2021-35235
Published: 2021-10-27
Description: The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely monitor and control the execution of an application. If an attacker could successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in targeting SWI with malicious intent.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-11
References: https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35235; https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm
CVE: CVE-2021-35236
Published: 2021-10-27
Description: The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.
CVSS Score: 3.1 (LOW)
CWE: CWE-614, CWE-311
References: https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35236; https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm
CVE: CVE-2021-37122
Published: 2021-10-27
Description: There is a use-after-free (UAF) vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation may cause the service abnormal. Affected product versions include:CloudEngine 12800 V200R005C10SPC800,V200R019C00SPC800;CloudEngine 5800 V200R005C10SPC800,V200R019C00SPC800;CloudEngine 6800 V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800;CloudEngine 7800 V200R005C10SPC800,V200R019C00SPC800.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211008-01-cloudengine-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211008-01-cloudengine-en
CVE: CVE-2021-37124
Published: 2021-10-27
Description: There is a path traversal vulnerability in Huawei PC product. Because the product does not filter path with special characters,attackers can construct a file path with special characters to exploit this vulnerability. Successful exploitation could allow the attacker to transport a file to certain path.Affected product versions include:PC Smart Full Scene 11.1 versions PCManager 11.1.1.97.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211008-01-share-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211008-01-share-en
CVE: CVE-2021-37127
Published: 2021-10-27
Description: There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update process, successful exploit this vulnerability can cause the forged system file overwrite the correct system file. Affected product versions include:iManager NetEco V600R010C00CP2001,V600R010C00CP2002,V600R010C00SPC100,V600R010C00SPC110,V600R010C00SPC120,V600R010C00SPC200,V600R010C00SPC210,V600R010C00SPC300;iManager NetEco 6000 V600R009C00SPC100,V600R009C00SPC110,V600R009C00SPC120,V600R009C00SPC190,V600R009C00SPC200,V600R009C00SPC201,V600R009C00SPC202,V600R009C00SPC210.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-signature-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-signature-en
CVE: CVE-2021-37129
Published: 2021-10-27
Description: There is an out of bounds write vulnerability in some Huawei products. The vulnerability is caused by a function of a module that does not properly verify input parameter. Successful exploit could cause out of bounds write leading to a denial of service condition.Affected product versions include:IPS Module V500R005C00,V500R005C20;NGFW Module V500R005C00;NIP6600 V500R005C00,V500R005C20;S12700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600,V200R013C00SPC500,V200R019C00SPC200,V200R019C00SPC500,V200R019C10SPC200,V200R020C00,V200R020C10;S1700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;S2700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;S5700 V200R010C00SPC600,V200R010C00SPC700,V200R011C10SPC500,V200R011C10SPC600,V200R019C00SPC500;S6700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;S7700 V200R010C00SPC600,V200R010C00SPC700,V200R011C10SPC500,V200R011C10SPC600;S9700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;USG9500 V500R005C00,V500R005C20.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-outofwrite-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-outofwrite-en
CVE: CVE-2021-37130
Published: 2021-10-27
Description: There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a directory that is located underneath a restricted parent directory, but the software does not properly validate the pathname. Successful exploit could allow the attacker to access a location that is outside of the restricted directory by a crafted filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-pathtraversal-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-pathtraversal-en
CVE: CVE-2021-37131
Published: 2021-10-27
Description: There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1236
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-csv-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-csv-en
CVE: CVE-2021-38450
Published: 2021-10-27
Description: The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-266-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-266-02