deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-42057
Published: 2021-11-04
Description: Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://github.com/blacksmithgu/obsidian-dataview/issues/615; https://github.com/blacksmithgu/obsidian-dataview/issues/615
CVE: CVE-2021-43398
Published: 2021-11-04
Description: Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. NOTE: this report is disputed by the vendor and multiple third parties. The execution-time differences are intentional. A user may make a choice of a longer key as a tradeoff between strength and performance. In making this choice, the amount of information leaked to an adversary is of infinitesimal value
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://cryptopp.com; https://github.com/weidai11/cryptopp/issues/1080; https://github.com/weidai11/cryptopp/issues/1080#issuecomment-996492222
CVE: CVE-2021-39902
Published: 2021-11-04
Description: Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39902.json; https://gitlab.com/gitlab-org/gitlab/-/issues/341479; https://hackerone.com/reports/1341674
CVE: CVE-2021-39903
Published: 2021-11-04
Description: In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings.
CVSS Score: 6.5 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39903.json; https://gitlab.com/gitlab-org/gitlab/-/issues/300017; https://hackerone.com/reports/1086781
CVE: CVE-2021-39914
Published: 2021-11-04
Description: A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user
CVSS Score: 3.1 (LOW)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39914.json; https://gitlab.com/gitlab-org/gitlab/-/issues/289948; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39914.json
CVE: CVE-2021-43400
Published: 2021-11-04
Description: An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-416
References: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=838c0dc7641e1c991c0f3027bf94bee4606012f8; https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html; https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=838c0dc7641e1c991c0f3027bf94bee4606012f8
CVE: CVE-2021-22260
Published: 2021-11-05
Description: A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf
CVSS Score: 7.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22260.json; https://gitlab.com/gitlab-org/gitlab/-/issues/336614; https://hackerone.com/reports/1257383
CVE: CVE-2021-39895
Published: 2021-11-05
Description: In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.
CVSS Score: 6.0 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39895.json; https://gitlab.com/gitlab-org/gitlab/-/issues/337824; https://hackerone.com/reports/1272535
CVE: CVE-2021-39897
Published: 2021-11-05
Description: Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred
CVSS Score: 2.6 (LOW)
CWE: CWE-281
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39897.json; https://gitlab.com/gitlab-org/gitlab/-/issues/341017; https://hackerone.com/reports/1330806
CVE: CVE-2021-39898
Published: 2021-11-05
Description: In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39898.json; https://gitlab.com/gitlab-org/gitlab/-/issues/33734; https://hackerone.com/reports/698068
CVE: CVE-2021-39901
Published: 2021-11-05
Description: In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint.
CVSS Score: 2.7 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39901.json; https://gitlab.com/gitlab-org/gitlab/-/issues/11640; https://hackerone.com/reports/565884
CVE: CVE-2021-39904
Published: 2021-11-05
Description: An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39904.json; https://gitlab.com/gitlab-org/gitlab/-/issues/295298; https://hackerone.com/reports/1063420
CVE: CVE-2021-39905
Published: 2021-11-05
Description: An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39905.json; https://gitlab.com/gitlab-org/gitlab/-/issues/28226; https://hackerone.com/reports/538029
CVE: CVE-2021-39906
Published: 2021-11-05
Description: Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39906.json; https://gitlab.com/gitlab-org/gitlab/-/issues/341566; https://hackerone.com/reports/1347600
CVE: CVE-2021-39907
Published: 2021-11-05
Description: A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU usage.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39907.json; https://gitlab.com/gitlab-org/gitlab/-/issues/299869; https://hackerone.com/reports/1083182
CVE: CVE-2021-39909
Published: 2021-11-05
Description: Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39909.json; https://gitlab.com/gitlab-org/gitlab/-/issues/335191; https://hackerone.com/reports/1237750
CVE: CVE-2021-39911
Published: 2021-11-05
Description: An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers
CVSS Score: 1.7 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39911.json; https://gitlab.com/gitlab-org/gitlab/-/issues/297470; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39911.json
CVE: CVE-2021-39912
Published: 2021-11-05
Description: A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustion.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39912.json; https://gitlab.com/gitlab-org/gitlab/-/issues/341363; https://hackerone.com/reports/1330882
CVE: CVE-2021-39913
Published: 2021-11-05
Description: Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker with local file system access to obtain system root-level privileges
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39913.json; https://gitlab.com/gitlab-org/gitlab/-/issues/28074; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39913.json
CVE: CVE-2021-25500
Published: 2021-11-05
Description: A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=11
CVE: CVE-2021-25501
Published: 2021-11-05
Description: An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted application to call some protected providers.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=11
CVE: CVE-2021-25502
Published: 2021-11-05
Description: A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without priviledge.
CVSS Score: 7.9 (HIGH)
CWE: CWE-269, CWE-312
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=11
CVE: CVE-2021-25503
Published: 2021-11-05
Description: Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=11; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=11
CVE: CVE-2021-25504
Published: 2021-11-05
Description: Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11
CVE: CVE-2021-25505
Published: 2021-11-05
Description: Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked.
CVSS Score: 3.3 (LOW)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11
CVE: CVE-2021-25506
Published: 2021-11-05
Description: Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287, CWE-863
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11
CVE: CVE-2021-25507
Published: 2021-11-05
Description: Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to access part of notification data in Secure Folder without authorization.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11
CVE: CVE-2021-25508
Published: 2021-11-05
Description: Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11
CVE: CVE-2021-25509
Published: 2021-11-05
Description: A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Windows known folders.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=11
CVE: CVE-2021-42237
Published: 2021-11-05
Description: Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html; http://sitecore.com; https://blog.assetnote.io/2021/11/02/sitecore-rce/
CVE: CVE-2021-26844
Published: 2021-11-05
Description: A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script or HTML via Console.exe.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://pastebin.com/mrzVTPeV; https://www.poweradmin.com/products/server-monitoring/support/release-notes/; https://pastebin.com/mrzVTPeV
CVE: CVE-2021-42662
Published: 2021-11-05
Description: A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the Holiday reason parameter. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to cookie stealing and more.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164615/Online-Event-Booking-And-Reservation-System-1.0-Cross-Site-Scripting.html; https://github.com/TheHackingRabbi/CVE-2021-42662; https://www.exploit-db.com/exploits/50450
CVE: CVE-2021-42663
Published: 2021-11-05
Description: An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a given link he will display the content of the HTML code of the attacker's choice.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/TheHackingRabbi/CVE-2021-42663; https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html; https://github.com/TheHackingRabbi/CVE-2021-42663
CVE: CVE-2021-42664
Published: 2021-11-05
Description: A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) quiz description parameters to add_quiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to cookie stealing and more.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164618/Engineers-Online-Portal-1.0-SQL-Injection.html; https://github.com/TheHackingRabbi/CVE-2021-42664; https://www.exploit-db.com/exploits/50451
CVE: CVE-2021-42665
Published: 2021-11-05
Description: An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/TheHackingRabbi/CVE-2021-42665; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42665; https://www.exploit-db.com/exploits/50452
CVE: CVE-2021-42666
Published: 2021-11-05
Description: A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_question.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/TheHackingRabbi/CVE-2021-42666; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/CVE-nu11-101321; https://www.exploit-db.com/exploits/50453
CVE: CVE-2021-42667
Published: 2021-11-05
Description: A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in some cases he can use this vulnerability in order to get a remote code execution on the remote web server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/TheHackingRabbi/CVE-2021-42667; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42667; https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html
CVE: CVE-2021-42668
Published: 2021-11-05
Description: A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code execution on the remote web server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/TheHackingRabbi/CVE-2021-42668; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42668; https://www.nu11secur1ty.com/2021/12/cve-2021-42668.html
CVE: CVE-2021-42669
Published: 2021-11-05
Description: A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By uploading a php webshell containing "<?php system($_GET["cmd"]); ?>" the attacker can execute commands on the web server with - /admin/uploads/php-webshell?cmd=id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/TheHackingRabbi/CVE-2021-42669; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42671; https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html
CVE: CVE-2021-42670
Published: 2021-11-05
Description: A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/TheHackingRabbi/CVE-2021-42670; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/CVE-nu11-101321; https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html
CVE: CVE-2021-42671
Published: 2021-11-05
Description: An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of authentication or authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://github.com/TheHackingRabbi/CVE-2021-42671; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42671; https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html
CVE: CVE-2021-39411
Published: 2021-11-05
Description: Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php, and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sisl.lab.uic.edu/projects/chess/hmsp/; https://sisl.lab.uic.edu/projects/chess/hmsp/
CVE: CVE-2021-39412
Published: 2021-11-05
Description: Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter in (a) server_side/scripts/id_jsonp.php, (b) server_side/scripts/jsonp.php, and (c) scripts/objects_jsonp.php, the (2) value parameter in examples_support/editable_ajax.php, and the (3) PHP_SELF parameter in captcha/index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sisl.lab.uic.edu/projects/chess/php-gurukul-shopping/; https://sisl.lab.uic.edu/projects/chess/php-gurukul-shopping/
CVE: CVE-2021-3916
Published: 2021-11-05
Description: bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/bookstackapp/bookstack/commit/43830a372fc51a8793199d04a34c3f4ebdfccc7b; https://huntr.dev/bounties/0be32e6b-7c48-43f0-9cec-433000ad8f64; https://github.com/bookstackapp/bookstack/commit/43830a372fc51a8793199d04a34c3f4ebdfccc7b
CVE: CVE-2021-3924
Published: 2021-11-05
Description: grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/getgrav/grav/commit/8f9c417c04b89dc8d2de60b95e7696821b2826ce; https://huntr.dev/bounties/7ca13522-d0c9-4eff-a7dd-6fd1a7f205a2; https://github.com/getgrav/grav/commit/8f9c417c04b89dc8d2de60b95e7696821b2826ce
CVE: CVE-2021-3927
Published: 2021-11-05
Description: vim is vulnerable to Heap-based Buffer Overflow
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.openwall.com/lists/oss-security/2022/01/15/1; https://github.com/vim/vim/commit/0b5b06cb4777d1401fdf83e7d48d287662236e7e; https://huntr.dev/bounties/9c2b2c82-48bb-4be9-ab8f-a48ea252d1b0
CVE: CVE-2021-3928
Published: 2021-11-05
Description: vim is vulnerable to Use of Uninitialized Variable
CVSS Score: 7.8 (HIGH)
CWE: CWE-457, CWE-908
References: http://www.openwall.com/lists/oss-security/2022/01/15/1; https://github.com/vim/vim/commit/15d9890eee53afc61eb0a03b878a19cb5672f732; https://huntr.dev/bounties/29c3ebd2-d601-481c-bf96-76975369d0cd