deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41592
Published: 2021-10-04
Description: Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-770
References: https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixing; https://github.com/ElementsProject/lightning; https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-May/002714.html
CVE: CVE-2021-41593
Published: 2021-10-04
Description: Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.
CVSS Score: 8.6 (HIGH)
CWE: CWE-770
References: https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixing; https://github.com/lightningnetwork/lnd/blob/master/docs/release-notes/release-notes-0.13.3.md; https://github.com/lightningnetwork/lnd/releases/tag/v0.13.3-beta
CVE: CVE-2021-41595
Published: 2021-10-04
Description: SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22; https://github.com/ach-ing/cves/blob/main/CVE-2021-41595.md
CVE: CVE-2021-41596
Published: 2021-10-04
Description: SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22; https://github.com/ach-ing/cves/blob/main/CVE-2021-41596.md
CVE: CVE-2021-23855
Published: 2021-10-04
Description: The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200, CWE-326
References: https://psirt.bosch.com/security-advisories/bosch-sa-741752.html; https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
CVE: CVE-2021-23856
Published: 2021-10-04
Description: The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://psirt.bosch.com/security-advisories/bosch-sa-741752.html; https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
CVE: CVE-2021-23857
Published: 2021-10-04
Description: Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-836, CWE-287
References: https://psirt.bosch.com/security-advisories/bosch-sa-741752.html; https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
CVE: CVE-2021-23858
Published: 2021-10-04
Description: Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200, CWE-306
References: https://psirt.bosch.com/security-advisories/bosch-sa-741752.html; https://psirt.bosch.com/security-advisories/bosch-sa-741752.html
CVE: CVE-2021-32626
Published: 2021-10-04
Description: Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787, CWE-787
References: https://github.com/redis/redis/commit/666ed7facf4524bf6d19b11b20faa2cf93fdf591; https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c; https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2021-32627
Published: 2021-10-04
Description: Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-680, CWE-190
References: https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3; https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
CVE: CVE-2021-32628
Published: 2021-10-04
Description: Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-680, CWE-190
References: https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3; https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
CVE: CVE-2021-32672
Published: 2021-10-04
Description: Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd; https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
CVE: CVE-2021-32675
Published: 2021-10-04
Description: Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8; https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p; https://lists.apache.org/thread.html/ra603ff6e04549d7f290f61f9b11e2d2e4dba693b05ff053f4ec6bc47%40%3Cnotifications.geode.apache.org%3E
CVE: CVE-2021-32687
Published: 2021-10-04
Description: Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-680, CWE-190
References: https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f; https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
CVE: CVE-2021-32762
Published: 2021-10-04
Description: Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-680, CWE-190
References: https://github.com/redis/redis/commit/0215324a66af949be39b34be2d55143232c1cb71; https://github.com/redis/redis/security/advisories/GHSA-833w-8v3m-8wwr; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
CVE: CVE-2021-38392
Published: 2021-10-04
Description: A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE: CVE-2021-38394
Published: 2021-10-04
Description: An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1278
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE: CVE-2021-38396
Published: 2021-10-04
Description: The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could leverage this weakness to install unauthorized software using a specially crafted USB.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-353, CWE-345
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE: CVE-2021-38398
Published: 2021-10-04
Description: The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access to the affected device could exploit these vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1329
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE: CVE-2021-38400
Published: 2021-10-04
Description: An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-916, CWE-916
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE: CVE-2021-38618
Published: 2021-10-04
Description: In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone (who knows a user's credentials except the password) to get access to an account. This occurs because of JSESSIONID mismanagement.
CVSS Score: 7.4 (HIGH)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38618; https://excellium-services.com/cert-xlm-advisory/cve-2021-38618/; https://excellium-services.com/cert-xlm-advisory/cve-2021-38618/
CVE: CVE-2021-39347
Published: 2021-10-04
Description: The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/2601162/woo-stripe-payment/trunk/includes/admin/class-wc-stripe-admin-user-edit.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39347; https://plugins.trac.wordpress.org/changeset/2601162/woo-stripe-payment/trunk/includes/admin/class-wc-stripe-admin-user-edit.php
CVE: CVE-2021-41099
Published: 2021-10-04
Description: Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-680, CWE-190
References: https://github.com/redis/redis/commit/c6ad876774f3cc11e32681ea02a2eead00f2c521; https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
CVE: CVE-2021-41578
Published: 2021-10-04
Description: mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://github.com/jacob-baines/vuln_disclosure/blob/main/vuln_2021_05.txt; https://github.com/jacob-baines/vuln_disclosure/blob/main/vuln_2021_05.txt
CVE: CVE-2021-41579
Published: 2021-10-04
Description: LCDS LAquis SCADA through 4.3.1.1085 is vulnerable to a control bypass and path traversal. If an attacker can get a victim to load a malicious els project file and use the play feature, then the attacker can bypass a consent popup and write arbitrary files to OS locations where the user has permission, leading to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://github.com/jacob-baines/vuln_disclosure/blob/main/vuln_2021_04.txt; https://github.com/jacob-baines/vuln_disclosure/blob/main/vuln_2021_04.txt
CVE: CVE-2021-41093
Published: 2021-10-04
Description: Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together.
CVSS Score: 7.4 (HIGH)
CWE: CWE-285, CWE-863
References: https://github.com/wireapp/wire-ios-sync-engine/security/advisories/GHSA-w727-5f74-49xj; https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-p354-6r3m-g4xr; https://github.com/wireapp/wire-ios/commit/b0e7bb3b13dd8212032cb46e32edf701694687c7
CVE: CVE-2021-41094
Published: 2021-10-04
Description: Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fail silently if no device passcode is set. The user has no indication that encryption at rest is not active since the feature is hidden to them. This issue has been resolved in version 3.70
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-668
References: https://github.com/wireapp/wire-ios/commit/5ba3eb180efc3fc795d095f9c84ae7f109b84746; https://github.com/wireapp/wire-ios/security/advisories/GHSA-h4m7-pr8h-j7rf; https://github.com/wireapp/wire-ios/commit/5ba3eb180efc3fc795d095f9c84ae7f109b84746
CVE: CVE-2021-41100
Published: 2021-10-04
Description: Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of a user with only the short-lived session token in the `Authorization` header. As the short-lived token is only meant as means of authentication by the client for less critical requests to the backend, the ability to change the email address with a short-lived token constitutes a privilege escalation attack. Since the attacker can change the password after setting the email address to one that they control, changing the email address can result in an account takeover by the attacker. Short-lived tokens can be requested from the backend by Wire clients using the long lived tokens, after which the long lived tokens can be stored securely, for example on the devices key chain. The short lived tokens can then be used to authenticate the client towards the backend for frequently performed actions such as sending and receiving messages. While short-lived tokens should not be available to an attacker per-se, they are used more often and in the shape of an HTTP header, increasing the risk of exposure to an attacker relative to the long-lived tokens, which are stored and transmitted in cookies. If you are running an on-prem instance and provision all users with SCIM, you are not affected by this issue (changing email is blocked for SCIM users). SAML single-sign-on is unaffected by this issue, and behaves identically before and after this update. The reason is that the email address used as SAML NameID is stored in a different location in the databse from the one used to contact the user outside wire. Version 2021-08-16 and later provide a new end-point that requires both the long-lived client cookie and `Authorization` header. The old end-point has been removed. If you are running an on-prem instance with at least some of the users invited or provisioned via SAML SSO and you cannot update then you can block `/self/email` on nginz (or in any other proxies or firewalls you may have set up). You don't need to discriminate by verb: `/self/email` only accepts `PUT` and `DELETE`, and `DELETE` is almost never used.
CVSS Score: 7.4 (HIGH)
CWE: CWE-285, CWE-613
References: https://github.com/wireapp/wire-server/security/advisories/GHSA-9rm2-w6pq-333m; https://github.com/wireapp/wire-server/security/advisories/GHSA-9rm2-w6pq-333m
CVE: CVE-2021-41118
Published: 2021-10-04
Description: The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised input of regular expression date within the parameters of the DPL parser function, allowed for the possibility of ReDoS (Regex Denial of Service). This has been resolved in version 3.3.6. If you are unable to update you may also set `$wgDplSettings['functionalRichness'] = 0;` or disable DynamicPageList3 to mitigate.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/Universal-Omega/DynamicPageList3/commit/2c04dafb37a14d9ccfe070f53e7f11bbca0156e7; https://github.com/Universal-Omega/DynamicPageList3/releases/tag/3.3.6; https://github.com/Universal-Omega/DynamicPageList3/security/advisories/GHSA-8f24-q75c-jhf4
CVE: CVE-2021-41651
Published: 2021-10-04
Description: A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system. A malicious attacker can retrieve sensitive database information and interact with the database using the vulnerable cid parameter in process_update_profile.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/MobiusBinary/CVE-2021-41651/; https://github.com/tramyardg/hotel-mgmt-system; https://github.com/MobiusBinary/CVE-2021-41651/
CVE: CVE-2020-21386
Published: 2021-10-04
Description: A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/magicblack/maccms10/issues/126; https://github.com/magicblack/maccms10/issues/126
CVE: CVE-2020-21387
Published: 2021-10-04
Description: A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/magicblack/maccms10/issues/126; https://github.com/magicblack/maccms10/issues/126
CVE: CVE-2021-39433
Published: 2021-10-04
Description: A local file inclusion (LFI) vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user.
CVSS Score: 7.5 (HIGH)
References: https://biqs-drive.be/; https://github.com/PinkDraconian/CVE-2021-39433/blob/main/README.md; https://biqs-drive.be/