deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33602
Published: 2021-10-06
Description: A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive (LZW decompression method), and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.
CVSS Score: 5.5 (MEDIUM)
References: https://www.f-secure.com/en/business/support-and-downloads/security-advisories; https://www.f-secure.com/en/business/support-and-downloads/security-advisories
CVE: CVE-2021-36170
Published: 2021-10-06
Description: An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext.
CVSS Score: 3.2 (LOW)
CWE: CWE-522
References: https://fortiguard.com/advisory/FG-IR-21-112; https://fortiguard.com/advisory/FG-IR-21-112
CVE: CVE-2021-36175
Published: 2021-10-06
Description: An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-20-027; https://fortiguard.com/advisory/FG-IR-20-027
CVE: CVE-2021-36178
Published: 2021-10-06
Description: A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices credential information via configuration page lookup.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://fortiguard.com/advisory/FG-IR-20-183; https://fortiguard.com/advisory/FG-IR-20-183
CVE: CVE-2021-3848
Published: 2021-10-06
Description: An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services could allow a local attacker to create an arbitrary file with higher privileges that could lead to a denial-of-service (DoS) on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 5.5 (MEDIUM)
References: https://success.trendmicro.com/solution/000289183; https://success.trendmicro.com/solution/000289183
CVE: CVE-2020-19003
Published: 2021-10-06
Description: An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://cwe.mitre.org/data/definitions/290.html; https://github.com/liftoff/GateOne/issues/728; https://cwe.mitre.org/data/definitions/290.html
CVE: CVE-2021-28702
Published: 2021-10-06
Description: PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
CVSS Score: 7.6 (HIGH)
CWE: CWE-269
References: http://www.openwall.com/lists/oss-security/2021/10/07/2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OIHEJ3R3EH5DYI2I5UMD2ULJ2ELA3EX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDPRMOBBLS74ONYP3IXZZXSTLKR7GRQB/
CVE: CVE-2021-0595
Published: 2021-10-06
Description: In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-177457096
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0598
Published: 2021-10-06
Description: In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-180422108
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0635
Published: 2021-10-06
Description: When extracting the incorrectly formatted flv file, the memory is damaged, the playback interface shows that the video cannot be played, and the log is found to be crashed. This problem may lead to hacker malicious code attacks, resulting in the loss of user rights.Product: Androidversion:Android-10Android ID: A-189402477
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0636
Published: 2021-10-06
Description: When extracting the incorrectly formatted avi file, the memory is damaged, the playback interface shows that the video cannot be played, and the log is found to be crashed. This problem may lead to hacker malicious code attacks, resulting in the loss of user rights.Product: Androidversion: Android-10Android ID: A-189392423
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0644
Published: 2021-10-06
Description: In conditionallyRemoveIdentifiers of SubscriptionController.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-181053462
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0680
Published: 2021-10-06
Description: In system properties, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-192535676
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0681
Published: 2021-10-06
Description: In system properties, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-192535337
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0682
Published: 2021-10-06
Description: In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-159624555
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0683
Published: 2021-10-06
Description: In runTraceIpcStop of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-185398942
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0684
Published: 2021-10-06
Description: In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-179839665
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0685
Published: 2021-10-06
Description: In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-191055353
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0686
Published: 2021-10-06
Description: In getDefaultSmsPackage of RoleManagerService.java, there is a possible way to get information about the default sms app of a different device user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-177927831
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0687
Published: 2021-10-06
Description: In ellipsize of Layout.java, there is a possible ANR due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-188913943
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-834
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0688
Published: 2021-10-06
Description: In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-161149543
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0689
Published: 2021-10-06
Description: In RGB_to_BGR1_portable of SkSwizzler_opts.h, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-190188264
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0690
Published: 2021-10-06
Description: In ih264d_mark_err_slice_skip of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-182152757
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0691
Published: 2021-10-06
Description: In the SELinux policy configured in system_app.te, there is a possible way for system_app to gain code execution in other processes due to an overly-permissive SELinux policy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-188554048
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0692
Published: 2021-10-06
Description: In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-179289753
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0693
Published: 2021-10-06
Description: In openFile of HeapDumpProvider.java, there is a possible way to retrieve generated heap dumps from debuggable apps due to an unprotected provider. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-184046948
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-0695
Published: 2021-10-06
Description: In get_sock_stat of xt_qtaguid.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-184018316References: Upstream kernel
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-09-01; https://source.android.com/security/bulletin/2021-09-01
CVE: CVE-2021-20264
Published: 2021-10-06
Description: An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the container to modify the /etc/passwd and escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=1932283; https://bugzilla.redhat.com/show_bug.cgi?id=1932283
CVE: CVE-2021-39350
Published: 2021-10-06
Description: The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2580834/fv-wordpress-flowplayer/trunk/view/stats.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39350; https://plugins.trac.wordpress.org/changeset/2580834/fv-wordpress-flowplayer/trunk/view/stats.php
CVE: CVE-2021-39351
Published: 2021-10-06
Description: The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351; https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681
CVE: CVE-2021-29758
Published: 2021-10-06
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to perform actions that they should not be able to access due to improper access controls. IBM X-Force ID: 202169.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202169; https://www.ibm.com/support/pages/node/6495969; https://exchange.xforce.ibmcloud.com/vulnerabilities/202169
CVE: CVE-2021-29760
Published: 2021-10-06
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard user interface. IBM X-Force ID: 202213.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202213; https://www.ibm.com/support/pages/node/6495969; https://exchange.xforce.ibmcloud.com/vulnerabilities/202213
CVE: CVE-2021-29761
Published: 2021-10-06
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information from the dashboard that they should not have access to. IBM X-Force ID: 202265.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202265; https://www.ibm.com/support/pages/node/6495969; https://exchange.xforce.ibmcloud.com/vulnerabilities/202265
CVE: CVE-2021-29764
Published: 2021-10-06
Description: IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 202268.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202268; https://exchange.xforce.ibmcloud.com/vulnerabilities/202268; https://www.ibm.com/support/pages/node/6495967
CVE: CVE-2021-29798
Published: 2021-10-06
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 203734.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203734; https://www.ibm.com/support/pages/node/6495925; https://exchange.xforce.ibmcloud.com/vulnerabilities/203734
CVE: CVE-2021-29836
Published: 2021-10-06
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0. through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204912.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204912; https://www.ibm.com/support/pages/node/6495921; https://exchange.xforce.ibmcloud.com/vulnerabilities/204912
CVE: CVE-2021-29837
Published: 2021-10-06
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204913.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204913; https://www.ibm.com/support/pages/node/6495907; https://exchange.xforce.ibmcloud.com/vulnerabilities/204913
CVE: CVE-2021-29855
Published: 2021-10-06
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205684.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/205684; https://www.ibm.com/support/pages/node/6495965; https://exchange.xforce.ibmcloud.com/vulnerabilities/205684
CVE: CVE-2021-29903
Published: 2021-10-06
Description: IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 207506.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/207506; https://www.ibm.com/support/pages/node/6495919; https://exchange.xforce.ibmcloud.com/vulnerabilities/207506
CVE: CVE-2021-38925
Published: 2021-10-06
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0. 0 through 6.1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 210171.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210171; https://www.ibm.com/support/pages/node/6495905; https://exchange.xforce.ibmcloud.com/vulnerabilities/210171
CVE: CVE-2021-25467
Published: 2021-10-06
Description: Assuming system privilege is gained, possible buffer overflow vulnerabilities in the Vision DSP kernel driver prior to SMR Oct-2021 Release 1 allows privilege escalation to Root by hijacking loaded library.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10
CVE: CVE-2021-25468
Published: 2021-10-06
Description: A possible guessing and confirming a byte memory vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows attackers to read arbitrary memory address.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10
CVE: CVE-2021-25469
Published: 2021-10-06
Description: A possible stack-based buffer overflow vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows arbitrary code execution.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10
CVE: CVE-2021-25470
Published: 2021-10-06
Description: An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE.
CVSS Score: 7.9 (HIGH)
CWE: CWE-94
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10