deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33063
Published: 2021-11-17
Description: Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00557.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00557.html
CVE: CVE-2021-33071
Published: 2021-11-17
Description: Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00564.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00564.html
CVE: CVE-2021-33073
Published: 2021-11-17
Description: Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow an unauthenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00538.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00538.html
CVE: CVE-2021-33097
Published: 2021-11-17
Description: Time-of-check time-of-use vulnerability in the Crypto API Toolkit for Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via network access.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-367
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00565.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00565.html
CVE: CVE-2021-33098
Published: 2021-11-17
Description: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00555.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-33118
Published: 2021-11-17
Description: Improper access control in the software installer for the Intel(R) Serial IO driver for Intel(R) NUC 11 Gen before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00560.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00560.html
CVE: CVE-2021-41165
Published: 2021-11-17
Description: CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417; https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2; https://www.drupal.org/sa-core-2021-011
CVE: CVE-2021-41190
Published: 2021-11-17
Description: The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.
CVSS Score: 3.0 (LOW)
CWE: CWE-843, CWE-843
References: http://www.openwall.com/lists/oss-security/2021/11/19/10; https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923; https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m
CVE: CVE-2021-41273
Published: 2021-11-17
Description: Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5; https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6; https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5
CVE: CVE-2021-41274
Published: 2021-11-17
Description: solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-352
References: https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555; https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2; https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555
CVE: CVE-2021-41275
Published: 2021-11-17
Description: spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both: * Executed whether as: * A before_action callback (the default) * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). * Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. Thanks @waiting-for-dev for reporting and providing a patch �� ### Patches Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 ### Workarounds If possible, change your strategy to :exception: ```ruby class ApplicationController < ActionController::Base protect_from_forgery with: :exception end ``` Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller: ```ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end ``` ### References https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-352, CWE-352
References: https://github.com/spree/spree_auth_devise/commit/adf6ed4cd94d66091776b5febd4ff3767362de63; https://github.com/spree/spree_auth_devise/security/advisories/GHSA-26xx-m4q2-xhq8; https://github.com/spree/spree_auth_devise/commit/adf6ed4cd94d66091776b5febd4ff3767362de63
CVE: CVE-2021-41277
Published: 2021-11-17
Description: Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-200, CWE-22, CWE-22
References: https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0; https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr; https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0
CVE: CVE-2021-43996
Published: 2021-11-17
Description: The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/facade/ignition/compare/1.16.14...1.16.15; https://github.com/facade/ignition/compare/2.0.5...2.0.6; https://github.com/facade/ignition/pull/285
CVE: CVE-2021-43997
Published: 2021-11-17
Description: FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal function to raise privilege. FreeRTOS versions through 10.4.6 do not prevent a third party that has already independently gained the ability to execute injected code to achieve further privilege escalation by branching directly inside a FreeRTOS MPU API wrapper function with a manually crafted stack frame. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with MPU support enabled (i.e. configENABLE_MPU set to 1). These are fixed in V10.5.0 and in V10.4.3-LTS Patch 3.
CVSS Score: 7.8 (HIGH)
References: https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V10.4.3-LTS-Patch-2; https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V10.4.3-LTS-Patch-3; https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V10.4.6
CVE: CVE-2021-0619
Published: 2021-11-18
Description: In ape extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561395; Issue ID: ALPS05561395.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0620
Published: 2021-11-18
Description: In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05489178; Issue ID: ALPS05561381.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0621
Published: 2021-11-18
Description: In asf extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05489178; Issue ID: ALPS05561383.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0622
Published: 2021-11-18
Description: In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05489178; Issue ID: ALPS05561388.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0623
Published: 2021-11-18
Description: In asf extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05489178; Issue ID: ALPS05585817.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0624
Published: 2021-11-18
Description: In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05594988; Issue ID: ALPS05594988.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0629
Published: 2021-11-18
Description: In mdlactl driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05776625; Issue ID: ALPS05776625.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0655
Published: 2021-11-18
Description: In mdlactl driver, there is a possible memory corruption due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05673424; Issue ID: ALPS05673424.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0656
Published: 2021-11-18
Description: In edma driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05709376; Issue ID: ALPS05709376.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0657
Published: 2021-11-18
Description: In apusys, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672103; Issue ID: ALPS05672103.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0658
Published: 2021-11-18
Description: In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672107.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0659
Published: 2021-11-18
Description: In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05687559; Issue ID: ALPS05687559.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0664
Published: 2021-11-18
Description: In ccu, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05827158; Issue ID: ALPS05827158.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0665
Published: 2021-11-18
Description: In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672113; Issue ID: ALPS05672113.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0666
Published: 2021-11-18
Description: In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672086; Issue ID: ALPS05672086.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0667
Published: 2021-11-18
Description: In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05670581; Issue ID: ALPS05670581.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0668
Published: 2021-11-18
Description: In apusys, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05670521; Issue ID: ALPS05670521.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-755
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0669
Published: 2021-11-18
Description: In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05681550; Issue ID: ALPS05681550.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0670
Published: 2021-11-18
Description: In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05654663; Issue ID: ALPS05654663.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0671
Published: 2021-11-18
Description: In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05664273; Issue ID: ALPS05664273.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2021; https://corp.mediatek.com/product-security-bulletin/November-2021
CVE: CVE-2021-0672
Published: 2021-11-18
Description: In Browser app, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-199678035
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-11-01; https://source.android.com/security/bulletin/2021-11-01
CVE: CVE-2021-27023
Published: 2021-11-18
Description: A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2[PII_REDACTED]
CVSS Score: 9.8 (CRITICAL)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/; https://puppet.com/security/cve/CVE-2021-27023; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
CVE: CVE-2021-27024
Published: 2021-11-18
Description: A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet Enterprise API token. This issue is resolved in CD4PE 4.10.0
CVSS Score: 8.1 (HIGH)
References: https://puppet.com/security/cve/cve-2021-27024; https://puppet.com/security/cve/cve-2021-27024