deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27025
Published: 2021-11-18
Description: A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
CVSS Score: 6.5 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/; https://puppet.com/security/cve/cve-2021-27025; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
CVE: CVE-2021-27026
Published: 2021-11-18
Description: A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://puppet.com/security/cve/cve-2021-27026; https://puppet.com/security/cve/cve-2021-27026
CVE: CVE-2021-36908
Published: 2021-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-reset/wordpress-wp-reset-pro-premium-plugin-5-98-cross-site-request-forgery-csrf-vulnerability-leading-to-database-reset?_s_id=cve; https://patchstack.com/wp-reset-pro-critical-vulnerability-fixed/; https://patchstack.com/database/vulnerability/wp-reset/wordpress-wp-reset-pro-premium-plugin-5-98-cross-site-request-forgery-csrf-vulnerability-leading-to-database-reset?_s_id=cve
CVE: CVE-2021-36909
Published: 2021-11-18
Description: Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-862
References: https://patchstack.com/database/vulnerability/wp-reset/wordpress-wp-reset-pro-premium-plugin-5-98-authenticated-database-reset-vulnerability; https://patchstack.com/wp-reset-pro-critical-vulnerability-fixed/; https://wpreset.com/changelog/
CVE: CVE-2021-43549
Published: 2021-11-18
Description: A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a malicious website. As a result, a victim may disclose sensitive information to the attacker or be provided with false information.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-313-06; https://us-cert.cisa.gov/ics/advisories/icsa-21-313-06
CVE: CVE-2021-35535
Published: 2021-11-18
Description: Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process where an older version of VxWorks is loaded prior to application firmware booting, could exploit the vulnerability in the older version of VxWorks and cause a denial-of-service on the product. This issue affects: Hitachi Energy Relion 670 Series 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.3. Hitachi Energy Relion 670/650 Series 2.2.0 all revisions; 2.2.4 all revisions. Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1188, CWE-1188
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000061&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000061&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-37938
Published: 2021-11-18
Description: It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension. Thanks to Dominic Couture for finding this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269, CWE-22
References: https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923; https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923
CVE: CVE-2021-37939
Published: 2021-11-18
Description: It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.
CVSS Score: 2.7 (LOW)
CWE: CWE-200, CWE-319
References: https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923; https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923
CVE: CVE-2021-43667
Published: 2021-11-18
Description: A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/hyperledger/fabric/pull/2844; https://jira.hyperledger.org/browse/FAB-18529; https://github.com/hyperledger/fabric/pull/2844
CVE: CVE-2021-43668
Published: 2021-11-18
Description: Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/ethereum/go-ethereum/issues/23866; https://github.com/ethereum/go-ethereum/issues/23866
CVE: CVE-2021-43669
Published: 2021-11-18
Description: A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://github.com/hyperledger/fabric/pull/2828; https://jira.hyperledger.org/browse/FAB-18528; https://github.com/hyperledger/fabric/pull/2828
CVE: CVE-2021-35534
Published: 2021-11-18
Description: Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal database tables, could allow anybody with user credentials to bypass security controls that is enforced by the product. Consequently, exploitation may lead to unauthorized modifications on data/firmware, and/or to permanently disabling the product. This issue affects: Hitachi Energy Relion 670 Series 2.0 all revisions; 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.5. Hitachi Energy Relion 670/650 Series 2.1 all revisions. 2.2.0 all revisions; 2.2.4 all revisions; Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions; 2.2.5 versions prior to 2.2.5.2. Hitachi Energy Relion 650 1.0 all revisions. 1.1 all revisions; 1.2 all revisions; 1.3 versions prior to 1.3.0.8; Hitachi Energy GMS600 1.3.0; 1.3.0.1; 1.2.0. Hitachi Energy PWC600 1.0.1 version 1.0.1.4 and prior versions; 1.1.0 version 1.1.0.1 and prior versions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-274, CWE-269
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000058&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000059&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000060&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-40733
Published: 2021-11-18
Description: Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .psd file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-40751
Published: 2021-11-18
Description: Adobe After Effects version 18.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40752
Published: 2021-11-18
Description: Adobe After Effects version 18.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40753
Published: 2021-11-18
Description: Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40754
Published: 2021-11-18
Description: Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40755
Published: 2021-11-18
Description: Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SGI file in the DoReadContinue function, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40756
Published: 2021-11-18
Description: Adobe After Effects version 18.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40757
Published: 2021-11-18
Description: Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40758
Published: 2021-11-18
Description: Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40759
Published: 2021-11-18
Description: Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40760
Published: 2021-11-18
Description: Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-40761
Published: 2021-11-18
Description: Adobe After Effects version 18.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/after_effects/apsb21-79.html; https://helpx.adobe.com/security/products/after_effects/apsb21-79.html
CVE: CVE-2021-42266
Published: 2021-11-18
Description: Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious FLA file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-42267
Published: 2021-11-18
Description: Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious FLA file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-42268
Published: 2021-11-18
Description: Adobe Animate version 21.0.9 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted FLA file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-42269
Published: 2021-11-18
Description: Adobe Animate version 21.0.9 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed FLA file that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-42270
Published: 2021-11-18
Description: Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious BMP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-42271
Published: 2021-11-18
Description: Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious BMP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-42272
Published: 2021-11-18
Description: Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious GIF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-42524
Published: 2021-11-18
Description: Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious BMP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-42525
Published: 2021-11-18
Description: Acrobat Animate versions 21.0.9 (and earlier)is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/animate/apsb21-105.html; https://helpx.adobe.com/security/products/animate/apsb21-105.html
CVE: CVE-2021-23146
Published: 2021-11-18
Description: An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions prior to 8.30.1359 (MR3); 8.20 versions prior to 8.20.1259 (MR5); 8.10 versions prior to 8.10.1284 (MR7); version 8.00 and prior versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1023, CWE-697
References: https://security.gallagher.com/Security-Advisories/CVE-2021-23146; https://security.gallagher.com/Security-Advisories/CVE-2021-23146
CVE: CVE-2021-23155
Published: 2021-11-18
Description: Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Client for Android 8.60 versions prior to 8.60.065; version 8.50 and prior versions.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-296, CWE-295
References: https://security.gallagher.com/Security-Advisories/CVE-2021-23155; https://security.gallagher.com/Security-Advisories/CVE-2021-23155
CVE: CVE-2021-23162
Published: 2021-11-18
Description: Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Connect for Android 15 versions prior to 15.04.040; version 14 and prior versions.
CVSS Score: 7.7 (HIGH)
CWE: CWE-296, CWE-295
References: https://security.gallagher.com/Security-Advisories/CVE-2021-23162; https://security.gallagher.com/Security-Advisories/CVE-2021-23162
CVE: CVE-2021-23167
Published: 2021-11-18
Description: Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Command Centre Server. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3); 8.40 versions prior to 8.40.2063 (MR4); 8.30 versions prior to 8.30.1454 (MR4) ; version 8.20 and prior versions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://security.gallagher.com/Security-Advisories/CVE-2021-23167; https://security.gallagher.com/Security-Advisories/CVE-2021-23167
CVE: CVE-2021-23193
Published: 2021-11-18
Description: Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensitive information from the Command Centre Server. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3) ; 8.40 versions prior to 8.40.2063 (MR4); 8.30 versions prior to 8.30.1454 (MR4) ; 8.20 versions prior to 8.20.1291 (MR6); version 8.10 and prior versions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200, CWE-269
References: https://security.gallagher.com/Security-Advisories/CVE-2021-23193; https://security.gallagher.com/Security-Advisories/CVE-2021-23193
CVE: CVE-2021-23197
Published: 2021-11-18
Description: Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Controller Service. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3) ;
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-428, CWE-428
References: https://security.gallagher.com/Security-Advisories/CVE-2021-23197; https://security.gallagher.com/Security-Advisories/CVE-2021-23197
CVE: CVE-2021-39920
Published: 2021-11-18
Description: NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39920.json; https://gitlab.com/wireshark/wireshark/-/issues/17705; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6AJFIYIHS3TYDD2EBYBJ5KKE52X34BJ/