deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-34580
Published: 2021-10-27
Description: In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-204, CWE-203
References: https://cert.vde.com/en/advisories/VDE-2021-037/; https://cert.vde.com/en/advisories/VDE-2021-037/
CVE: CVE-2021-41872
Published: 2021-10-27
Description: Skyworth Digital Technology Penguin Aurora Box 41502 has a denial of service vulnerability, which can be exploited by attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://www.cnvd.org.cn/flaw/show/2928136; https://www.cnvd.org.cn/flaw/show/2928136
CVE: CVE-2020-24932
Published: 2021-10-27
Description: An SQL Injection vulnerability exists in Sourcecodester Complaint Management System 1.0 via the cid parameter in complaint-details.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/48758; https://www.exploit-db.com/exploits/48758
CVE: CVE-2021-41589
Published: 2021-10-27
Description: In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymous write access to the build cache. If access control to the build cache is not changed from the default open configuration, a malicious actor with network access can populate the cache with manipulated entries that may execute malicious code as part of a build process. This applies to the build cache provided with Gradle Enterprise and the separate build cache node service if used. If access control to the user interface is not changed from the default open configuration, a malicious actor can undo build cache access control in order to populate the cache with manipulated entries that may execute malicious code as part of a build process. This does not apply to the build cache provided with Gradle Enterprise, but does apply to the separate build cache node service if used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://security.gradle.com; https://security.gradle.com/advisory/2021-06; https://security.gradle.com
CVE: CVE-2021-41590
Published: 2021-10-27
Description: In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installation configuration user interface available to administrators allows testing the configured SMTP server settings. This test function can be used to identify the listening TCP ports available to the server, revealing information about the internal network environment.
CVSS Score: 5.3 (MEDIUM)
References: https://security.gradle.com; https://security.gradle.com/advisory/2021-07; https://security.gradle.com
CVE: CVE-2021-41619
Published: 2021-10-27
Description: An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installation configuration user interface (available to administrators) allows specifying arbitrary Java Virtual Machine startup options. Some of these options, such as -XX:OnOutOfMemoryError, allow specifying a command to be run on the host. This can be abused to run arbitrary commands on the host, should an attacker gain administrative access to the application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://security.gradle.com; https://security.gradle.com/advisory/2021-08; https://security.gradle.com
CVE: CVE-2021-22101
Published: 2021-10-27
Description: Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://www.cloudfoundry.org/blog/cve-2021-22101-cloud-controller-is-vulnerable-to-unauthenticated-denial-of-service/; https://www.cloudfoundry.org/blog/cve-2021-22101-cloud-controller-is-vulnerable-to-unauthenticated-denial-of-service/
CVE: CVE-2021-36756
Published: 2021-10-27
Description: CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://cfengine.com/blog/2021/cve-2021-38379-and-cve-2021-36756/; https://cfengine.com/downloads/cfengine-enterprise/; https://cfengine.com/blog/2021/cve-2021-38379-and-cve-2021-36756/
CVE: CVE-2021-37221
Published: 2021-10-27
Description: A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer create option, which could let a remote malicious user upload an arbitrary php file. .
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/50046; https://www.exploit-db.com/exploits/50046
CVE: CVE-2021-38379
Published: 2021-10-27
Description: The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://cfengine.com/blog/2021/cve-2021-38379-and-cve-2021-36756/; https://docs.cfengine.com/docs/3.18/enterprise-cfengine-guide.html; https://cfengine.com/blog/2021/cve-2021-38379-and-cve-2021-36756/
CVE: CVE-2021-20526
Published: 2021-10-27
Description: IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 198755.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198755; https://www.ibm.com/support/pages/node/6507095; https://exchange.xforce.ibmcloud.com/vulnerabilities/198755
CVE: CVE-2021-29673
Published: 2021-10-27
Description: IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199482.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199482; https://www.ibm.com/support/pages/node/6508583; https://exchange.xforce.ibmcloud.com/vulnerabilities/199482
CVE: CVE-2021-29713
Published: 2021-10-27
Description: IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200967; https://www.ibm.com/support/pages/node/6508583; https://exchange.xforce.ibmcloud.com/vulnerabilities/200967
CVE: CVE-2021-29774
Published: 2021-10-27
Description: IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under certain configurations. IBM X-Force ID: 203025.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203025; https://www.ibm.com/support/pages/node/6508583; https://exchange.xforce.ibmcloud.com/vulnerabilities/203025
CVE: CVE-2021-29786
Published: 2021-10-27
Description: IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM X-Force ID: 203172.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203172; https://www.ibm.com/support/pages/node/6508583; https://exchange.xforce.ibmcloud.com/vulnerabilities/203172
CVE: CVE-2021-29844
Published: 2021-10-27
Description: IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/205205; https://www.ibm.com/support/pages/node/6508583; https://exchange.xforce.ibmcloud.com/vulnerabilities/205205
CVE: CVE-2021-29868
Published: 2021-10-27
Description: IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 206213.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/206213; https://www.ibm.com/support/pages/node/6508776; https://exchange.xforce.ibmcloud.com/vulnerabilities/206213
CVE: CVE-2021-37803
Published: 2021-10-27
Description: An SQL Injection vulnerability exists in Sourcecodester Online Covid Vaccination Scheduler System 1.0 via the username in lognin.php .
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://packetstormsecurity.com/files/163415/Online-Covid-Vaccination-Scheduler-System-1.0-SQL-Injection.html; https://packetstormsecurity.com/files/163415/Online-Covid-Vaccination-Scheduler-System-1.0-SQL-Injection.html
CVE: CVE-2021-37805
Published: 2021-10-27
Description: A Stored Cross Site Scripting (XSS) vunerability exists in Sourcecodeste Vehicle Parking Management System affected version 1.0 is via the add-vehicle.php endpoint.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/163625/Vehicle-Parking-Management-System-1.0-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/163625/Vehicle-Parking-Management-System-1.0-Cross-Site-Scripting.html
CVE: CVE-2021-37806
Published: 2021-10-27
Description: An SQL Injection vulnerability exists in https://phpgurukul.com Vehicle Parking Management System affected version 1.0. The system is vulnerable to time-based SQL injection on multiple endpoints. Based on the SLEEP(N) function payload that will sleep for a number of seconds used on the (1) editid , (2) viewid, and (3) catename parameters, the server response is about (N) seconds delay respectively which mean it is vulnerable to MySQL Blind (Time Based). An attacker can use sqlmap to further the exploitation for extracting sensitive information from the database.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-37806; https://packetstormsecurity.com/files/163626/Vehicle-Parking-Management-System-1.0-SQL-Injection.html; https://streamable.com/rfcchi
CVE: CVE-2021-37807
Published: 2021-10-27
Description: An SQL Injection vulneraility exists in https://phpgurukul.com Online Shopping Portal 3.1 via the email parameter on the /check_availability.php endpoint that serves as a checker whether a new user's email is already exist within the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://packetstormsecurity.com/files/163574/Online-Shopping-Portal-3.1-SQL-Injection.html; https://packetstormsecurity.com/files/163574/Online-Shopping-Portal-3.1-SQL-Injection.html
CVE: CVE-2021-37808
Published: 2021-10-27
Description: SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, and (4) username parameters, the server response is about (N) seconds delay respectively which mean it is vulnerable to MySQL Blind (Time Based). An attacker can use sqlmap to further the exploitation for extracting sensitive information from the database.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-37808; https://packetstormsecurity.com/files/163575/News-Portal-Project-3.1-SQL-Injection.html; https://www.nu11secur1ty.com/2021/12/cve-2021-37808.html
CVE: CVE-2021-3900
Published: 2021-10-27
Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/firefly-iii/firefly-iii/commit/c2c8c42ef3194d1aeba8c48240fe2e9063f77635; https://huntr.dev/bounties/909e55b6-ef02-4143-92e4-bc3e8397db76; https://github.com/firefly-iii/firefly-iii/commit/c2c8c42ef3194d1aeba8c48240fe2e9063f77635
CVE: CVE-2021-34754
Published: 2021-10-27
Description: Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. These vulnerabilities are due to incomplete processing during deep packet inspection for ENIP packets. An attacker could exploit these vulnerabilities by sending a crafted ENIP packet to the targeted interface. A successful exploit could allow the attacker to bypass configured access control and intrusion policies that should be activated for the ENIP packet.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-enip-bypass-eFsxd8KP; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-enip-bypass-eFsxd8KP
CVE: CVE-2021-34755
Published: 2021-10-27
Description: Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmdinject-FmzsLN8; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmdinject-FmzsLN8
CVE: CVE-2021-34756
Published: 2021-10-27
Description: Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmdinject-FmzsLN8; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmdinject-FmzsLN8
CVE: CVE-2021-34761
Published: 2021-10-27
Description: A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have administrative credentials on the device. This vulnerability is due to incomplete validation of user input for a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device with administrative privileges and issuing a CLI command with crafted user parameters. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-73, CWE-668
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-file-write-SHVcmQVc; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-file-write-SHVcmQVc
CVE: CVE-2021-34762
Published: 2021-10-27
Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.
CVSS Score: 8.1 (HIGH)
CWE: CWE-26, CWE-22
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-dir-traversal-95UyW5tk; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-dir-traversal-95UyW5tk
CVE: CVE-2021-34763
Published: 2021-10-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-601, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-openredir-TVPMWJyg; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-openredir-TVPMWJyg
CVE: CVE-2021-34764
Published: 2021-10-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-601, CWE-79, CWE-601
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-openredir-TVPMWJyg; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-openredir-TVPMWJyg
CVE: CVE-2021-34781
Published: 2021-10-27
Description: A vulnerability in the processing of SSH connections for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. This vulnerability is due to a lack of proper error handling when an SSH session fails to be established. An attacker could exploit this vulnerability by sending a high rate of crafted SSH connections to the instance. A successful exploit could allow the attacker to cause resource exhaustion, which causes a DoS condition on the affected device. The device must be manually reloaded to recover.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-755
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-dos-rUDseW3r; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-dos-rUDseW3r
CVE: CVE-2021-34783
Published: 2021-10-27
Description: A vulnerability in the software-based SSL/TLS message handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient validation of SSL/TLS messages when the device performs software-based SSL/TLS decryption. An attacker could exploit this vulnerability by sending a crafted SSL/TLS message to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Note: Datagram TLS (DTLS) messages cannot be used to exploit this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tls-decrypt-dos-BMxYjm8M; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tls-decrypt-dos-BMxYjm8M
CVE: CVE-2021-34787
Published: 2021-10-27
Description: A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper handling of network requests by affected devices configured to use object group search. An attacker could exploit this vulnerability by sending a specially crafted network request to an affected device. A successful exploit could allow the attacker to bypass access control list (ACL) rules on the device, bypass security protections, and send network traffic to unauthorized hosts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-183, CWE-755
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rule-bypass-ejjOgQEY; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rule-bypass-ejjOgQEY
CVE: CVE-2021-34790
Published: 2021-10-27
Description: Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host located behind the ALG. For more information about these vulnerabilities, see the Details section of this advisory. Note: These vulnerabilities have been publicly discussed as NAT Slipstreaming.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-358, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng
CVE: CVE-2021-34791
Published: 2021-10-27
Description: Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host located behind the ALG. For more information about these vulnerabilities, see the Details section of this advisory. Note: These vulnerabilities have been publicly discussed as NAT Slipstreaming.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-358, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng
CVE: CVE-2021-34792
Published: 2021-10-27
Description: A vulnerability in the memory management of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper resource management when connection rates are high. An attacker could exploit this vulnerability by opening a significant number of connections on an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-401
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-Unk689XY; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-Unk689XY
CVE: CVE-2021-34793
Published: 2021-10-27
Description: A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. This vulnerability is due to incorrect handling of certain TCP segments when the affected device is operating in transparent mode. An attacker could exploit this vulnerability by sending a crafted TCP segment through an affected device. A successful exploit could allow the attacker to poison the MAC address tables in adjacent devices, resulting in network disruption.
CVSS Score: 8.6 (HIGH)
CWE: CWE-924, CWE-924
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-JxYWMJyL; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-JxYWMJyL