deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1569
Published: 2021-06-16
Description: Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive information or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-GuC5mLwG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-GuC5mLwG
CVE: CVE-2021-1570
Published: 2021-06-16
Description: Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive information or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-GuC5mLwG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-GuC5mLwG
CVE: CVE-2021-1571
Published: 2021-06-16
Description: Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E
CVE: CVE-2021-34551
Published: 2021-06-16
Description: PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJYSOFCUBS67J3TKR74SD3C454N7VTYM/
CVE: CVE-2021-34813
Published: 2021-06-16
Description: Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the homeserver) because olm_pk_decrypt has a stack-based buffer overflow. Remote code execution might be possible for some nonstandard build configurations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://gitlab.matrix.org/matrix-org/olm/-/commit/ccc0d122ee1b4d5e5ca4ec1432086be17d5f901b; https://gitlab.matrix.org/matrix-org/olm/-/releases/3.2.3; https://matrix.org/blog/2021/06/14/adventures-in-fuzzing-libolm
CVE: CVE-2020-25752
Published: 2021-06-16
Description: An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. The serial number can be retrieved by an unauthenticated user at /info.xml. These passwords can be easily calculated by an attacker; users are unable to change these passwords.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798
References: https://enphase.com/en-us/products-and-services/envoy-and-combiner; https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a; https://stage2sec.com
CVE: CVE-2020-25753
Published: 2021-06-16
Description: An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml.
CVSS Score: 9.8 (CRITICAL)
References: https://enphase.com/en-us/products-and-services/envoy-and-combiner; https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a; https://stage2sec.com
CVE: CVE-2020-25754
Published: 2021-06-16
Description: An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an unauthenticated user at /info.xml. Attempts to change the user password via passwd or other tools have no effect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: https://enphase.com/en-us/products-and-services/envoy-and-combiner; https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a; https://stage2sec.com
CVE: CVE-2020-25755
Published: 2021-06-16
Description: An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://enphase.com/en-us/products-and-services/envoy-and-combiner; https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a; https://stage2sec.com
CVE: CVE-2021-32659
Published: 2021-06-16
Description: Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. Versions 2.6.1 and greater are patched. As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34fcfd858df33e4631e420da07b9f; https://github.com/matrix-org/matrix-appservice-bridge/releases/tag/2.6.1; https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhx
CVE: CVE-2021-34202
Published: 2021-06-16
Description: There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permissions can be elevated to administrator permissions, resulting in local arbitrary code execution. An attacker can combine other vulnerabilities to further achieve the purpose of remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://d-link.com; http://dir-2640-us.com; https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34202
CVE: CVE-2021-34201
Published: 2021-06-16
Description: D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Local ordinary users can overwrite the global variables in the .bss section, causing the process crashes or changes.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: http://d-link.com; http://dir-2640-us.com; https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34201
CVE: CVE-2021-34203
Published: 2021-06-16
Description: D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify routing information, monitor the traffic of all devices under the router, hijack DNS and phishing attacks. In addition, this interface is likely to be questioned by customers as a backdoor, because the interface should not be exposed.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1188
References: http://d-link.com; http://dir-2640-us.com; https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34203
CVE: CVE-2021-34204
Published: 2021-06-16
Description: D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text. It does not use linux user management. In addition, the passwords of all devices are the same, and they cannot be modified by normal users. An attacker can easily log in to the target router through the serial port and obtain root privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-522
References: http://d-link.com; http://dir-2640-us.com; https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204
CVE: CVE-2021-32243
Published: 2021-06-16
Description: FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/FOGProject/fogproject/issues/422; https://github.com/FOGProject/fogproject/issues/422
CVE: CVE-2021-32244
Published: 2021-06-16
Description: Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/langkexiansheng/Images/blob/master/moodle_xss.gif; https://github.com/langkexiansheng/Images/blob/master/moodle_xss.gif
CVE: CVE-2021-32245
Published: 2021-06-16
Description: In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pagekit/pagekit/issues/963; https://github.com/pagekit/pagekit/issues/963
CVE: CVE-2021-32690
Published: 2021-06-16
Description: Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/helm/helm/releases/tag/v3.6.1; https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf; https://github.com/helm/helm/releases/tag/v3.6.1
CVE: CVE-2021-32691
Published: 2021-06-16
Description: Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one's server by overriding the `create` data source method on the `People` class.
CVSS Score: 8.8 (HIGH)
CWE: CWE-303, CWE-287
References: https://github.com/ApollosProject/apollos-apps/commit/cb5f8f1c0b24f1b215b2bb5eb6f9a8e16d728ce2; https://github.com/ApollosProject/apollos-apps/releases/tag/v2.20.0; https://github.com/ApollosProject/apollos-apps/security/advisories/GHSA-r578-pj6f-r4ff
CVE: CVE-2021-31476
Published: 2021-06-16
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA templates. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13531.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-21-614/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2021-31477
Published: 2021-06-16
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-coded default credentials. An attacker can leverage this vulnerability to execute code in the context of the download user. Was ZDI-CAN-11852.
CVSS Score: 7.3 (HIGH)
CWE: CWE-798
References: https://www.gegridsolutions.com/products/support/GES-2021-005%20-%20RPV311%20Security%20Notice.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-616/; https://www.gegridsolutions.com/products/support/GES-2021-005%20-%20RPV311%20Security%20Notice.pdf
CVE: CVE-2021-21777
Published: 2021-06-17
Description: An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A specially crafted network request can lead to an out-of-bounds read.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1234; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1234
CVE: CVE-2021-0143
Published: 2021-06-17
Description: Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00546.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00546.html
CVE: CVE-2021-31521
Published: 2021-06-17
Description: Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in the product's Captive Portal.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/solution/000286452; https://success.trendmicro.com/solution/000286452
CVE: CVE-2021-32582
Published: 2021-06-17
Description: An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://home.connectwise.com/securityBulletin/609a9dd75cb8450001e85369; https://www.connectwise.com/company/trust/security-bulletins; https://www.connectwise.com/platform/unified-management/automate
CVE: CVE-2021-32946
Published: 2021-06-17
Description: An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper validation of the user-supplied data. This may result in several of out-of-bounds problems and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-754, CWE-754
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-938030.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02
CVE: CVE-2021-3603
Published: 2021-06-17
Description: PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
CVSS Score: 8.1 (HIGH)
CWE: CWE-829, CWE-829
References: https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJYSOFCUBS67J3TKR74SD3C454N7VTYM/
CVE: CVE-2021-32936
Published: 2021-06-17
Description: An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a write past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-365397.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2021-32938
Published: 2021-06-17
Description: Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allows attackers to cause a denial-of service condition or read sensitive information from memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-365397.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2021-32940
Published: 2021-06-17
Description: An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022.5) resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or read sensitive information from memory locations.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-365397.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02
CVE: CVE-2021-32944
Published: 2021-06-17
Description: A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a memory corruption or arbitrary code execution, allowing attackers to cause a denial-of-service condition or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-365397.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02
CVE: CVE-2021-32948
Published: 2021-06-17
Description: An out-of-bounds write issue exists in the DWG file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a write past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-365397.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2021-32950
Published: 2021-06-17
Description: An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allows attackers to cause a denial-of-service condition or read sensitive information from memory locations.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-365397.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02
CVE: CVE-2021-32952
Published: 2021-06-17
Description: An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper validation of user-supplied data. This can result in a write past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-938030.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02
CVE: CVE-2021-31818
Published: 2021-06-17
Description: Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://advisories.octopus.com/adv/2021-04---SQL-Injection-in-the-Events-REST-API-%28CVE-2021-31818%29[PII_REDACTED].html; https://advisories.octopus.com/adv/2021-04---SQL-Injection-in-the-Events-REST-API-%28CVE-2021-31818%29[PII_REDACTED].html
CVE: CVE-2021-34825
Published: 2021-06-17
Description: Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://github.com/quassel/quassel/pull/581; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZFWRN5P2WG23MWMVAEVV3YBHGFJHDSW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JOFTSGJUJHCA3KGQBO6OZXWU7JFKVHMJ/
CVE: CVE-2020-25414
Published: 2021-06-17
Description: A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-829
References: https://github.com/monstra-cms/monstra/issues/469; https://github.com/monstra-cms/monstra/issues/469