deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-35244
Published: 2021-12-20
Description: The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434
References: https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm; https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_US; https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242
CVE: CVE-2021-35248
Published: 2021-12-20
Description: It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm; https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3; https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35248
CVE: CVE-2021-36887
Published: 2021-12-20
Description: Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/tarteaucitronjs/wordpress-tarteaucitron-js-cookies-legislation-gdpr-plugin-1-5-4-cross-site-request-forgery-csrf-vulnerability-leading-to-cross-site-scripting-xss; https://wordpress.org/plugins/tarteaucitronjs/#developers; https://patchstack.com/database/vulnerability/tarteaucitronjs/wordpress-tarteaucitron-js-cookies-legislation-gdpr-plugin-1-5-4-cross-site-request-forgery-csrf-vulnerability-leading-to-cross-site-scripting-xss
CVE: CVE-2021-36889
Published: 2021-12-20
Description: Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
CVSS Score: 3.4 (LOW)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/tarteaucitronjs/wordpress-tarteaucitron-js-cookies-legislation-gdpr-plugin-1-6-multiple-stored-authenticated-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/tarteaucitronjs/#developers; https://patchstack.com/database/vulnerability/tarteaucitronjs/wordpress-tarteaucitron-js-cookies-legislation-gdpr-plugin-1-6-multiple-stored-authenticated-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2021-38401
Published: 2021-12-20
Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allow an attacker to execute arbitrary code and cause the application to crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE: CVE-2021-38409
Published: 2021-12-20
Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an access of uninitialized pointer, which may allow an attacker read from or write to unexpected memory locations, leading to a denial-of-service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE: CVE-2021-38413
Published: 2021-12-20
Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to a stack-based buffer overflow, which may allow an attacker to achieve code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE: CVE-2021-38415
Published: 2021-12-20
Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable a heap-based buffer overflow when parsing a specially crafted project file, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE: CVE-2021-38419
Published: 2021-12-20
Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data corruption, a system crash, or code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE: CVE-2021-38421
Published: 2021-12-20
Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read, which may allow an attacker to read sensitive information from other memory locations or cause a crash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE: CVE-2021-40783
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-40784
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-42138
Published: 2021-12-20
Description: A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine.
CVSS Score: 7.2 (HIGH)
CWE: CWE-331
References: https://cpl.thalesgroup.com/support/security-updates; https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e[PII_REDACTED]94a&id=kb_article_view&sysparm_rank=1&sysparm_tsqueryId=b3bdd932db33b010f0e[PII_REDACTED]955; https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c[PII_REDACTED]eb&id=kb_article_view&sysparm_rank=2&sysparm_tsqueryId=b3bdd932db33b010f0e[PII_REDACTED]955
CVE: CVE-2021-42808
Published: 2021-12-20
Description: Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://cpl.thalesgroup.com/fr/software-monetization/security-updates; https://cpl.thalesgroup.com/fr/software-monetization/security-updates
CVE: CVE-2021-42809
Published: 2021-12-20
Description: Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-913, CWE-913
References: https://cpl.thalesgroup.com/fr/software-monetization/security-updates; https://cpl.thalesgroup.com/fr/software-monetization/security-updates
CVE: CVE-2021-43021
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious EXR file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43022
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious PNG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43023
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious EPS/TIFF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43024
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43025
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43026
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43028
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43029
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43030
Published: 2021-12-20
Description: Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose arbitrary data on affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of memory prior to accessing it.
CVSS Score: 3.3 (LOW)
CWE: CWE-824, CWE-824
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43746
Published: 2021-12-20
Description: Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of memory prior to accessing it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43747
Published: 2021-12-20
Description: Adobe Premiere Rush version 1.5.16 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43748
Published: 2021-12-20
Description: Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43749
Published: 2021-12-20
Description: Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43750
Published: 2021-12-20
Description: Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html; https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
CVE: CVE-2021-43763
Published: 2021-12-20
Description: Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb21-116.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1561/; https://helpx.adobe.com/security/products/dimension/apsb21-116.html
CVE: CVE-2021-44179
Published: 2021-12-20
Description: Adobe Dimension versions 3.4.3 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious GIF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/dimension/apsb21-116.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1569/; https://helpx.adobe.com/security/products/dimension/apsb21-116.html
CVE: CVE-2021-44180
Published: 2021-12-20
Description: Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious GIF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/dimension/apsb21-116.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1571/; https://helpx.adobe.com/security/products/dimension/apsb21-116.html
CVE: CVE-2021-44181
Published: 2021-12-20
Description: Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious GIF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/dimension/apsb21-116.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1570/; https://helpx.adobe.com/security/products/dimension/apsb21-116.html
CVE: CVE-2021-44182
Published: 2021-12-20
Description: Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious SVG file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb21-116.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1573/; https://helpx.adobe.com/security/products/dimension/apsb21-116.html
CVE: CVE-2021-44183
Published: 2021-12-20
Description: Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb21-116.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1572/; https://helpx.adobe.com/security/products/dimension/apsb21-116.html
CVE: CVE-2021-44697
Published: 2021-12-20
Description: Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MOV file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/audition/apsb21-121.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1578/; https://helpx.adobe.com/security/products/audition/apsb21-121.html
CVE: CVE-2021-44698
Published: 2021-12-20
Description: Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MP4 file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/audition/apsb21-121.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1577/; https://helpx.adobe.com/security/products/audition/apsb21-121.html
CVE: CVE-2021-44699
Published: 2021-12-20
Description: Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MP4 file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/audition/apsb21-121.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1579/; https://helpx.adobe.com/security/products/audition/apsb21-121.html
CVE: CVE-2021-3860
Published: 2021-12-20
Description: JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/177162/JFrog-Artifactory-SQL-Injection.html; https://www.jfrog.com/confluence/display/JFROG/CVE-2021-3860%3A+Artifactory+Low+Privileged+Blind+SQL+Injection; http://packetstormsecurity.com/files/177162/JFrog-Artifactory-SQL-Injection.html
CVE: CVE-2021-43843
Published: 2021-12-20
Description: jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient tfor protection from a Regular Expression Denial of Service (ReDoS) attack. If an attacker can put a lot of JSX elements into `<blockquote>` tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources. v4.5.1 passes the test against ASCII characters but misses the case of multibyte characters. jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29ecc; https://github.com/yhatt/jsx-slack/releases/tag/v4.5.2; https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q