deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-31160
Published: 2021-06-29
Description: Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
CVSS Score: 7.5 (HIGH)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-31160; https://excellium-services.com/cert-xlm-advisory/cve-2021-31160/; https://www.manageengine.com/products/service-desk-msp/readme.html#10521
CVE: CVE-2021-31530
Published: 2021-06-29
Description: Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.
CVSS Score: 7.5 (HIGH)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-31530; https://excellium-services.com/cve-2021-31530/; https://www.manageengine.com/products/service-desk-msp/readme.html#10522
CVE: CVE-2021-31531
Published: 2021-06-29
Description: Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-31531; https://excellium-services.com/cert-xlm-advisory/cve-2021-31531/; https://www.manageengine.com/products/service-desk-msp/readme.html#10521
CVE: CVE-2021-34824
Published: 2021-06-29
Description: Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces.
CVSS Score: 8.8 (HIGH)
References: https://github.com/istio/istio/releases; https://istio.io/latest/news/security/istio-security-2021-007; https://github.com/istio/istio/releases
CVE: CVE-2021-29479
Published: 2021-06-29
Description: Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production.
CVSS Score: 7.0 (HIGH)
CWE: CWE-807
References: https://github.com/ratpack/ratpack/security/advisories/GHSA-w6rq-6h34-vh7q; https://portswigger.net/web-security/web-cache-poisoning; https://github.com/ratpack/ratpack/security/advisories/GHSA-w6rq-6h34-vh7q
CVE: CVE-2021-31505
Published: 2021-06-29
Description: This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus 1.9.0.3_278. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSH service. The device can be booted into a special operation mode where hard-coded credentials are accepted for SSH authentication. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-12890.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798
References: https://kb.arlo.com/000062592/Security-Advisory-for-Arlo-Q-Plus-SSH-Use-of-Hard-coded-Credentials-Allowing-Privilege-Escalation; https://www.zerodayinitiative.com/advisories/ZDI-21-683/; https://kb.arlo.com/000062592/Security-Advisory-for-Arlo-Q-Plus-SSH-Use-of-Hard-coded-Credentials-Allowing-Privilege-Escalation
CVE: CVE-2021-31506
Published: 2021-06-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-13674.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-21-647/; https://www.cvedetails.com/vulnerability-list/vendor_id-2032/product_id-96672/Opentext-Brava-Desktop.html?page=1&opec=1&order=1&trc=35&sha=37f4ed0596f8ccacca7d571f22a38c97b0f19f4c; https://www.opentext.com/products/brava
CVE: CVE-2021-31507
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12653.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-21-685/; https://www.cvedetails.com/vulnerability-list/vendor_id-2032/product_id-96672/Opentext-Brava-Desktop.html?page=1&opec=1&order=1&trc=35&sha=37f4ed0596f8ccacca7d571f22a38c97b0f19f4c; https://www.opentext.com/products/brava
CVE: CVE-2021-31508
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13306.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-21-686/; https://www.cvedetails.com/vulnerability-list/vendor_id-2032/product_id-96672/Opentext-Brava-Desktop.html?page=1&opec=1&order=1&trc=35&sha=37f4ed0596f8ccacca7d571f22a38c97b0f19f4c; https://www.opentext.com/products/brava
CVE: CVE-2021-31509
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13309.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-21-687/; https://www.cvedetails.com/vulnerability-list/vendor_id-2032/product_id-96672/Opentext-Brava-Desktop.html?page=1&opec=1&order=1&trc=35&sha=37f4ed0596f8ccacca7d571f22a38c97b0f19f4c; https://www.opentext.com/products/brava
CVE: CVE-2021-31510
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13675.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-21-688/; https://www.cvedetails.com/vulnerability-list/vendor_id-2032/product_id-96672/Opentext-Brava-Desktop.html?page=1&opec=1&order=1&trc=35&sha=37f4ed0596f8ccacca7d571f22a38c97b0f19f4c; https://www.opentext.com/products/brava
CVE: CVE-2021-31511
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13676.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-21-689/; https://www.cvedetails.com/vulnerability-list/vendor_id-2032/product_id-96672/Opentext-Brava-Desktop.html?page=1&opec=1&order=1&trc=35&sha=37f4ed0596f8ccacca7d571f22a38c97b0f19f4c; https://www.opentext.com/products/brava
CVE: CVE-2021-31512
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13677.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-21-690/; https://www.cvedetails.com/vulnerability-list/vendor_id-2032/product_id-96672/Opentext-Brava-Desktop.html?page=1&opec=1&order=1&trc=35&sha=37f4ed0596f8ccacca7d571f22a38c97b0f19f4c; https://www.opentext.com/products/brava
CVE: CVE-2021-31513
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13678.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-21-691/; https://www.cvedetails.com/vulnerability-list/vendor_id-2032/product_id-96672/Opentext-Brava-Desktop.html?page=1&opec=1&order=1&trc=35&sha=37f4ed0596f8ccacca7d571f22a38c97b0f19f4c; https://www.opentext.com/products/brava
CVE: CVE-2021-31514
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13679.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-21-692/; https://www.cvedetails.com/vulnerability-list/vendor_id-2032/product_id-96672/Opentext-Brava-Desktop.html?page=1&opec=1&order=1&trc=35&sha=37f4ed0596f8ccacca7d571f22a38c97b0f19f4c; https://www.opentext.com/products/brava
CVE: CVE-2021-31515
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13668.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://binary.ninja/2021/06/03/2.4-release.html#security-advisories; https://www.zerodayinitiative.com/advisories/ZDI-21-678/; https://binary.ninja/2021/06/03/2.4-release.html#security-advisories
CVE: CVE-2021-31516
Published: 2021-06-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13670.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://binary.ninja/2021/06/03/2.4-release.html#security-advisories; https://www.zerodayinitiative.com/advisories/ZDI-21-677/; https://binary.ninja/2021/06/03/2.4-release.html#security-advisories
CVE: CVE-2021-32988
Published: 2021-06-29
Description: FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-175-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-175-01
CVE: CVE-2021-32990
Published: 2021-06-29
Description: FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-175-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-175-01
CVE: CVE-2021-32992
Published: 2021-06-29
Description: FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may allow an attacker to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-175-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-175-01
CVE: CVE-2021-20101
Published: 2021-06-29
Description: Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malformed content.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/; https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE: CVE-2021-20102
Published: 2021-06-29
Description: Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/; https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE: CVE-2021-20103
Published: 2021-06-29
Description: Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through upload.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/; https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE: CVE-2021-20104
Published: 2021-06-29
Description: Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms through upload.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/; https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE: CVE-2021-20105
Published: 2021-06-29
Description: Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/; https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/
CVE: CVE-2021-20477
Published: 2021-06-29
Description: IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196949.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196949; https://www.ibm.com/support/pages/node/6462331; https://exchange.xforce.ibmcloud.com/vulnerabilities/196949
CVE: CVE-2021-20490
Published: 2021-06-29
Description: IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID: 197791.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197791; https://www.ibm.com/support/pages/node/6466609; https://exchange.xforce.ibmcloud.com/vulnerabilities/197791
CVE: CVE-2021-20580
Published: 2021-06-29
Description: IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 198241.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198241; https://www.ibm.com/support/pages/node/6462331; https://exchange.xforce.ibmcloud.com/vulnerabilities/198241
CVE: CVE-2021-21871
Published: 2021-06-29
Description: A memory corruption vulnerability exists in the DMG File Format Handler functionality of PowerISO 7.9. A specially crafted DMG file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability. The vendor fixed it in a bug-release of the current version.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1308; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1308
CVE: CVE-2020-21394
Published: 2021-06-29
Description: SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/mumu0215/cve_reference/blob/master/CRMEB_system.md; https://github.com/mumu0215/cve_reference/blob/master/CRMEB_system.md
CVE: CVE-2021-22119
Published: 2021-06-29
Description: Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-863
References: https://lists.apache.org/thread.html/r08a449010786e0bcffa4b5781b04fcb55d6eafa62cb79b8347680aad%40%3Cissues.nifi.apache.org%3E; https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E; https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E
CVE: CVE-2020-18066
Published: 2021-06-29
Description: Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/94fzb/zrlog/issues/42; https://github.com/94fzb/zrlog/issues/42
CVE: CVE-2021-23275
Published: 2021-06-29
Description: The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275; http://www.tibco.com/services/support/advisories