deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28335
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28335; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28335
CVE: CVE-2021-28336
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28336; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28336
CVE: CVE-2021-28337
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28337; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28337
CVE: CVE-2021-28338
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28338; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28338
CVE: CVE-2021-28339
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28339; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28339
CVE: CVE-2021-28340
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28340; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28340
CVE: CVE-2021-28341
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28341; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28341
CVE: CVE-2021-28342
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28342
CVE: CVE-2021-28343
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28343; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28343
CVE: CVE-2021-28344
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28344; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28344
CVE: CVE-2021-28345
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28345; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28345
CVE: CVE-2021-28346
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28346; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28346
CVE: CVE-2021-28347
Published: 2021-04-13
Description: Windows Speech Runtime Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28347; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28347
CVE: CVE-2021-28348
Published: 2021-04-13
Description: Windows GDI+ Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28348; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28348
CVE: CVE-2021-28349
Published: 2021-04-13
Description: Windows GDI+ Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28349; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28349
CVE: CVE-2021-28350
Published: 2021-04-13
Description: Windows GDI+ Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28350; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28350
CVE: CVE-2021-28351
Published: 2021-04-13
Description: Windows Speech Runtime Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28351; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28351
CVE: CVE-2021-28352
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28352; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28352
CVE: CVE-2021-28353
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28353; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28353
CVE: CVE-2021-28354
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28354; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28354
CVE: CVE-2021-28355
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28355; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28355
CVE: CVE-2021-28356
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28356; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28356
CVE: CVE-2021-28357
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28357; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28357
CVE: CVE-2021-28358
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28358; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28358
CVE: CVE-2021-28434
Published: 2021-04-13
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28434; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28434
CVE: CVE-2021-28435
Published: 2021-04-13
Description: Windows Event Tracing Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28435; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28435
CVE: CVE-2021-28436
Published: 2021-04-13
Description: Windows Speech Runtime Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28436; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28436
CVE: CVE-2021-28437
Published: 2021-04-13
Description: Windows Installer Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28437; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28437
CVE: CVE-2021-28438
Published: 2021-04-13
Description: Windows Console Driver Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28438; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28438
CVE: CVE-2021-28439
Published: 2021-04-13
Description: Windows TCP/IP Driver Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28439; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28439
CVE: CVE-2021-28440
Published: 2021-04-13
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28440; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28440
CVE: CVE-2021-28441
Published: 2021-04-13
Description: Windows Hyper-V Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28441; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28441
CVE: CVE-2021-28442
Published: 2021-04-13
Description: Windows TCP/IP Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28442; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28442
CVE: CVE-2021-28443
Published: 2021-04-13
Description: Windows Console Driver Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28443; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28443
CVE: CVE-2021-28444
Published: 2021-04-13
Description: Windows Hyper-V Security Feature Bypass Vulnerability
CVSS Score: 5.7 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28444; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28444
CVE: CVE-2021-28445
Published: 2021-04-13
Description: Windows Network File System Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28445; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28445
CVE: CVE-2021-28446
Published: 2021-04-13
Description: Windows Portmapping Information Disclosure Vulnerability
CVSS Score: 7.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28446; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28446
CVE: CVE-2021-28447
Published: 2021-04-13
Description: Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
CVSS Score: 4.4 (MEDIUM)
References: https://bi-zone.medium.com/measured-boot-and-malware-signatures-exploring-two-vulnerabilities-found-in-the-windows-loader-5a4fcc3c4b66; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28447; https://bi-zone.medium.com/measured-boot-and-malware-signatures-exploring-two-vulnerabilities-found-in-the-windows-loader-5a4fcc3c4b66
CVE: CVE-2021-28448
Published: 2021-04-13
Description: Visual Studio Code Kubernetes Tools Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28448; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28448
CVE: CVE-2021-28449
Published: 2021-04-13
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28449; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28449
CVE: CVE-2021-28450
Published: 2021-04-13
Description: Microsoft SharePoint Denial of Service Vulnerability
CVSS Score: 5.0 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28450; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28450
CVE: CVE-2021-28451
Published: 2021-04-13
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28451; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28451
CVE: CVE-2021-28452
Published: 2021-04-13
Description: Microsoft Outlook Memory Corruption Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28452; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28452
CVE: CVE-2021-28453
Published: 2021-04-13
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28453; https://www.zerodayinitiative.com/advisories/ZDI-21-423/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28453
CVE: CVE-2021-28454
Published: 2021-04-13
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28454; https://www.zerodayinitiative.com/advisories/ZDI-21-410/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28454
CVE: CVE-2021-28456
Published: 2021-04-13
Description: Microsoft Excel Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28456; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28456
CVE: CVE-2021-28457
Published: 2021-04-13
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28457; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28457
CVE: CVE-2021-28458
Published: 2021-04-13
Description: Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28458; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28458
CVE: CVE-2021-28459
Published: 2021-04-13
Description: Azure DevOps Server Spoofing Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162190/Microsoft-Azure-DevOps-Server-2020.0.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2021/Apr/25; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28459
CVE: CVE-2021-28460
Published: 2021-04-13
Description: Azure Sphere Unsigned Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28460; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28460
CVE: CVE-2021-28464
Published: 2021-04-13
Description: VP9 Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28464; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28464
CVE: CVE-2021-28466
Published: 2021-04-13
Description: Raw Image Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28466; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28466
CVE: CVE-2021-28468
Published: 2021-04-13
Description: Raw Image Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28468; https://www.zerodayinitiative.com/advisories/ZDI-21-421/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28468
CVE: CVE-2021-28469
Published: 2021-04-13
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28469; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28469
CVE: CVE-2021-28470
Published: 2021-04-13
Description: Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28470; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28470
CVE: CVE-2021-28471
Published: 2021-04-13
Description: Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28471; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28471
CVE: CVE-2021-28472
Published: 2021-04-13
Description: Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28472; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28472
CVE: CVE-2021-28473
Published: 2021-04-13
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28473; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28473
CVE: CVE-2021-28475
Published: 2021-04-13
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28475; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28475
CVE: CVE-2021-28477
Published: 2021-04-13
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28477; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28477
CVE: CVE-2021-28480
Published: 2021-04-13
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28480; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28480
CVE: CVE-2021-28481
Published: 2021-04-13
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28481; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28481
CVE: CVE-2021-28482
Published: 2021-04-13
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28482; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28482
CVE: CVE-2021-28483
Published: 2021-04-13
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 9.0 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28483; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28483
CVE: CVE-2021-29427
Published: 2021-04-13
Description: In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies. This feature was introduced in the wake of the "A Confusing Dependency" blog post. In some cases, Gradle may ignore content filters and search all repositories for dependencies. This only occurs when repository content filtering is used from within a `pluginManagement` block in a settings file. This may change how dependencies are resolved for Gradle plugins and build scripts. For builds that are vulnerable, there are two risks: 1) Information disclosure: Gradle could make dependency requests to repositories outside your organization and leak internal package identifiers. 2) Dependency poisoning/Dependency confusion: Gradle could download a malicious binary from a repository outside your organization due to name squatting. For a full example and more details refer to the referenced GitHub Security Advisory. The problem has been patched and released with Gradle 7.0. Users relying on this feature should upgrade their build as soon as possible. As a workaround, users may use a company repository which has the right rules for fetching packages from public repositories, or use project level repository content filtering, inside `buildscript.repositories`. This option is available since Gradle 5.1 when the feature was introduced.
CVSS Score: 8.0 (HIGH)
CWE: CWE-829
References: https://docs.gradle.org/7.0/release-notes.html#security-advisories; https://github.com/gradle/gradle/security/advisories/GHSA-jvmj-rh6q-x395; https://docs.gradle.org/7.0/release-notes.html#security-advisories
CVE: CVE-2021-29428
Published: 2021-04-13
Description: In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. This vulnerability impacted builds using precompiled script plugins written in Kotlin DSL and tests for Gradle plugins written using ProjectBuilder or TestKit. If you are on Windows or modern versions of macOS, you are not vulnerable. If you are on a Unix-like operating system with the "sticky" bit set on your system temporary directory, you are not vulnerable. The problem has been patched and released with Gradle 7.0. As a workaround, on Unix-like operating systems, ensure that the "sticky" bit is set. This only allows the original user (or root) to delete a file. If you are unable to change the permissions of the system temporary directory, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only. For additional details refer to the referenced GitHub Security Advisory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-378, CWE-379
References: https://docs.gradle.org/7.0/release-notes.html#security-advisories; https://github.com/gradle/gradle/pull/15240; https://github.com/gradle/gradle/pull/15654