deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-25335
Published: 2022-02-18
Description: RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8; https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1f; https://raw.globalsecuritydatabase.org/GSD-2[PII_REDACTED]
CVE: CVE-2022-25336
Published: 2022-02-18
Description: Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://developers.ibexa.co/security-advisories/ibexa-sa-2022-001-image-filenames-sanitization; https://developers.ibexa.co/security-advisories/ibexa-sa-2022-001-image-filenames-sanitization
CVE: CVE-2022-25337
Published: 2022-02-18
Description: Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://developers.ibexa.co/security-advisories/ibexa-sa-2022-001-image-filenames-sanitization; https://developers.ibexa.co/security-advisories/ibexa-sa-2022-001-image-filenames-sanitization
CVE: CVE-2021-46036
Published: 2022-02-18
Description: An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities/; https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities/
CVE: CVE-2021-46037
Published: 2022-02-18
Description: MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
CVSS Score: 8.1 (HIGH)
References: https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities/; https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities/
CVE: CVE-2021-23702
Published: 2022-02-18
Description: The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend.
CVSS Score: 7.6 (HIGH)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-OBJECTEXTEND-2401470; https://snyk.io/vuln/SNYK-JS-OBJECTEXTEND-2401470
CVE: CVE-2021-46062
Published: 2022-02-18
Description: MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
CVSS Score: 7.1 (HIGH)
References: https://github.com/ming-soft/MCMS/issues/59; https://github.com/ming-soft/MCMS/issues/59
CVE: CVE-2021-46063
Published: 2022-02-18
Description: MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://github.com/ming-soft/MCMS/issues/59; https://github.com/ming-soft/MCMS/issues/59
CVE: CVE-2021-46082
Published: 2022-02-18
Description: Moxa TN-5900 v3.1 series routers, MGate 5109 v2.2 series protocol gateways, and MGate 5101-PBM-MN v2.1 series protocol gateways were discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via crafted packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://www.moxa.com/en/support/product-support/security-advisory/mgate-5109-5101-protocol-gateways-vulnerability; https://www.moxa.com/en/support/product-support/security-advisory/tn-5900-secure-routers-vulnerability; https://www.moxa.com/en/support/product-support/security-advisory/mgate-5109-5101-protocol-gateways-vulnerability
CVE: CVE-2021-46562
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14987.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-149/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46563
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14990.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-150/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46564
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15023.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-151/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46565
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15024.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-152/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46566
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15027.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-153/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46567
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15028.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-154/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46568
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15030.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-155/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46569
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15031.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-156/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46570
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15364.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-157/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46571
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15365.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-158/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46572
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15366.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-159/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46573
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15367.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-160/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46574
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15368.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-161/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46575
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15369.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004; https://www.zerodayinitiative.com/advisories/ZDI-22-162/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004
CVE: CVE-2021-46576
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15370.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-163/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46577
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15371.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-164/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46578
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15372.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-165/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46579
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15373.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-166/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46580
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15374.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-167/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46581
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15375.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-168/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46582
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15376.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0008; https://www.zerodayinitiative.com/advisories/ZDI-22-169/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0008
CVE: CVE-2021-46583
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K images. Crafted data in a J2K image can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15377.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-170/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0006
CVE: CVE-2021-46584
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K images. Crafted data in a J2K image can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15378.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-171/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0006
CVE: CVE-2021-46585
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15379.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-172/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005