deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-43781
Published: 2021-12-06
Description: Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862, CWE-863
References: https://github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626; https://github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jv; https://github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626
CVE: CVE-2021-43784
Published: 2021-12-06
Description: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-190
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=2241; https://github.com/opencontainers/runc/commit/9c444070ec7bb83995dbc0185da68284da71c554; https://github.com/opencontainers/runc/commit/d72d057ba794164c3cce9451a00b72a78b25e1ae
CVE: CVE-2021-43931
Published: 2021-12-06
Description: The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03
CVE: CVE-2021-43936
Published: 2021-12-06
Description: The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html; https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03; http://packetstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html
CVE: CVE-2021-43800
Published: 2021-12-06
Description: Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible on a Wiki.js server running on Windows, when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit number 414033de9dff66a327e3f[PII_REDACTED]f468a9d85 fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any windows directory traversal sequences from the path. As a workaround, disable any storage module with local asset caching capabilities (Local File System, Git).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/Requarks/wiki/commit/414033de9dff66a327e3f[PII_REDACTED]f468a9d85; https://github.com/Requarks/wiki/releases/tag/2.5.254; https://github.com/Requarks/wiki/security/advisories/GHSA-r363-73gj-6j25
CVE: CVE-2021-36564
Published: 2021-12-06
Description: ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/top-think/framework/issues/2559; https://github.com/top-think/framework/issues/2559
CVE: CVE-2021-36567
Published: 2021-12-06
Description: ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/top-think/framework/issues/2561; https://github.com/top-think/framework/issues/2561
CVE: CVE-2021-37298
Published: 2021-12-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-40091
Published: 2021-12-06
Description: An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://support.squaredup.com; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]129-CVE-2021-40091-SSRF-issue; https://support.squaredup.com
CVE: CVE-2021-40313
Published: 2021-12-06
Description: Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/issues/1469; https://github.com/Piwigo/Piwigo/issues/1469
CVE: CVE-2021-4075
Published: 2021-12-06
Description: snipe-it is vulnerable to Server-Side Request Forgery (SSRF)
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://github.com/snipe/snipe-it/commit/4612b9e711b3ff5d2bcddbec5b18866d25f8e34e; https://huntr.dev/bounties/4386fd8b-8c80-42bb-87b8-b506c46597de; https://github.com/snipe/snipe-it/commit/4612b9e711b3ff5d2bcddbec5b18866d25f8e34e
CVE: CVE-2021-31631
Published: 2021-12-06
Description: b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulnerability allows attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/stacksmasher007/76514ab2b782fb4383f1121e6fc19241; https://gist.github.com/stacksmasher007/76514ab2b782fb4383f1121e6fc19241
CVE: CVE-2021-31632
Published: 2021-12-06
Description: b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Stacksmashers101/c6b9ea92f42c23473170bb3acc8fc5fe; https://gist.github.com/Stacksmashers101/c6b9ea92f42c23473170bb3acc8fc5fe
CVE: CVE-2021-44677
Published: 2021-12-06
Description: An issue (1 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen on random .NET Remoting TCP ports for possible commands from client applications. These TCP services can be exploited due to deserialization behavior that is inherent to the .NET Remoting service. A malicious attacker can exploit both TCP remoting services and local IPC services on the Enterprise Vault Server. This vulnerability is mitigated by properly configuring the servers and firewall as described in the vendor's security alert for this vulnerability (VTS21-003, ZDI-CAN-14078).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS21-003; https://www.zerodayinitiative.com/advisories/ZDI-21-1592/; https://www.veritas.com/content/support/en_US/security/VTS21-003
CVE: CVE-2021-44678
Published: 2021-12-06
Description: An issue (2 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen on random .NET Remoting TCP ports for possible commands from client applications. These TCP services can be exploited due to deserialization behavior that is inherent to the .NET Remoting service. A malicious attacker can exploit both TCP remoting services and local IPC services on the Enterprise Vault Server. This vulnerability is mitigated by properly configuring the servers and firewall as described in the vendor's security alert for this vulnerability (VTS21-003, ZDI-CAN-14076).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS21-003; https://www.zerodayinitiative.com/advisories/ZDI-21-1591/; https://www.veritas.com/content/support/en_US/security/VTS21-003
CVE: CVE-2021-44679
Published: 2021-12-06
Description: An issue (3 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen on random .NET Remoting TCP ports for possible commands from client applications. These TCP services can be exploited due to deserialization behavior that is inherent to the .NET Remoting service. A malicious attacker can exploit both TCP remoting services and local IPC services on the Enterprise Vault Server. This vulnerability is mitigated by properly configuring the servers and firewall as described in the vendor's security alert for this vulnerability (VTS21-003, ZDI-CAN-14074).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS21-003; https://www.zerodayinitiative.com/advisories/ZDI-21-1589/; https://www.veritas.com/content/support/en_US/security/VTS21-003
CVE: CVE-2021-44680
Published: 2021-12-06
Description: An issue (4 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen on random .NET Remoting TCP ports for possible commands from client applications. These TCP services can be exploited due to deserialization behavior that is inherent to the .NET Remoting service. A malicious attacker can exploit both TCP remoting services and local IPC services on the Enterprise Vault Server. This vulnerability is mitigated by properly configuring the servers and firewall as described in the vendor's security alert for this vulnerability (VTS21-003, ZDI-CAN-14075).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS21-003; https://www.zerodayinitiative.com/advisories/ZDI-21-1590/; https://www.veritas.com/content/support/en_US/security/VTS21-003
CVE: CVE-2021-44681
Published: 2021-12-06
Description: An issue (5 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen on random .NET Remoting TCP ports for possible commands from client applications. These TCP services can be exploited due to deserialization behavior that is inherent to the .NET Remoting service. A malicious attacker can exploit both TCP remoting services and local IPC services on the Enterprise Vault Server. This vulnerability is mitigated by properly configuring the servers and firewall as described in the vendor's security alert for this vulnerability (VTS21-003, ZDI-CAN-14080).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS21-003; https://www.zerodayinitiative.com/advisories/ZDI-21-1594/; https://www.veritas.com/content/support/en_US/security/VTS21-003
CVE: CVE-2021-44682
Published: 2021-12-06
Description: An issue (6 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen on random .NET Remoting TCP ports for possible commands from client applications. These TCP services can be exploited due to deserialization behavior that is inherent to the .NET Remoting service. A malicious attacker can exploit both TCP remoting services and local IPC services on the Enterprise Vault Server. This vulnerability is mitigated by properly configuring the servers and firewall as described in the vendor's security alert for this vulnerability (VTS21-003, ZDI-CAN-14079).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS21-003; https://www.zerodayinitiative.com/advisories/ZDI-21-1593/; https://www.veritas.com/content/support/en_US/security/VTS21-003
CVE: CVE-2021-44684
Published: 2021-12-07
Description: naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/dwisiswant0/advisory/issues/5; https://github.com/naholyr/github-todos/issues/34; https://github.com/dwisiswant0/advisory/issues/5
CVE: CVE-2021-44685
Published: 2021-12-07
Description: Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/dwisiswant0/advisory/issues/3; https://github.com/jlord/git-it-electron/releases; https://github.com/dwisiswant0/advisory/issues/3
CVE: CVE-2021-44686
Published: 2021-12-07
Description: calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bugs.launchpad.net/calibre/+bug/1951979; https://github.com/dwisiswant0/advisory/issues/18; https://github.com/kovidgoyal/calibre/compare/v5.31.1...v5.32.0
CVE: CVE-2021-44512
Published: 2021-12-07
Description: World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732
References: https://github.com/tmate-io/tmate-ssh-server/commit/1c020d1f5ca462f5b150b46a027aaa1bbe3c9596; https://www.openwall.com/lists/oss-security/2021/12/06/2; https://github.com/tmate-io/tmate-ssh-server/commit/1c020d1f5ca462f5b150b46a027aaa1bbe3c9596
CVE: CVE-2021-44513
Published: 2021-12-07
Description: Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://github.com/tmate-io/tmate-ssh-server/commit/1c020d1f5ca462f5b150b46a027aaa1bbe3c9596; https://www.openwall.com/lists/oss-security/2021/12/06/2; https://github.com/tmate-io/tmate-ssh-server/commit/1c020d1f5ca462f5b150b46a027aaa1bbe3c9596
CVE: CVE-2021-29113
Published: 2021-12-07
Description: A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-98, CWE-829
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available
CVE: CVE-2021-29114
Published: 2021-12-07
Description: A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available
CVE: CVE-2021-29115
Published: 2021-12-07
Description: An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available
CVE: CVE-2021-29116
Published: 2021-12-07
Description: A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available
CVE: CVE-2021-4049
Published: 2021-12-07
Description: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/livehelperchat/livehelperchat/commit/e7fe1aa6a087d4d21b2e8a0dadd2e08f42acbb57; https://huntr.dev/bounties/62408fa4-2c16-4fcd-8b34-41fcdccb779e; https://github.com/livehelperchat/livehelperchat/commit/e7fe1aa6a087d4d21b2e8a0dadd2e08f42acbb57
CVE: CVE-2021-28703
Published: 2021-12-07
Description: grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes. This bug was fortuitously fixed by code cleanup in Xen 4.14, and backported to security-supported Xen branches as a prerequisite of the fix for XSA-378.
CVSS Score: 7.0 (HIGH)
References: https://security.gentoo.org/glsa/202402-07; https://xenbits.xenproject.org/xsa/advisory-387.txt; https://security.gentoo.org/glsa/202402-07
CVE: CVE-2021-40092
Published: 2021-12-07
Description: A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an SVG file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.squaredup.com; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]233-CVE-2021-40092-Stored-cross-site-scripting-Image-tile-; https://support.squaredup.com
CVE: CVE-2021-40093
Published: 2021-12-07
Description: A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via dashboard actions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.squaredup.com; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]257-CVE-2021-40093-Stored-cross-site-scripting-Action-Buttons-; https://support.squaredup.com
CVE: CVE-2021-40094
Published: 2021-12-07
Description: A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.squaredup.com; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]537-CVE-2021-40094-DOM-based-stored-cross-site-scripting; https://support.squaredup.com
CVE: CVE-2021-40095
Published: 2021-12-07
Description: An issue was discovered in SquaredUp for SCOM 5.2.1.6654. The Download Log feature in System / Maintenance was susceptible to a local file inclusion vulnerability (when processing remote input in the log files downloaded by an authenticated administrator user), leading to the ability to read arbitrary files on the server filesystems.
CVSS Score: 4.9 (MEDIUM)
References: https://support.squaredup.com; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]153-CVE-2021-40095-Reading-arbitrary-files; https://support.squaredup.com
CVE: CVE-2021-40096
Published: 2021-12-07
Description: A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via modification of the authorisationUrl in some integration configurations.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.squaredup.com; https://support.squaredup.com/hc/en-us/articles/[PII_REDACTED]817-CVE-2021-40096-Stored-cross-site-scripting-provider-configuration-; https://support.squaredup.com
CVE: CVE-2020-27413
Published: 2021-12-07
Description: An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password while the user is logged into the application.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-522
References: http://maharashtra.com; http://mahavitaran.com; https://cvewalkthrough.com/cve-2020-27413-mahavitaran-android-application-clear-text-password-storage/
CVE: CVE-2021-22955
Published: 2021-12-07
Description: A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtual server could allow an attacker to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://support.citrix.com/article/CTX330728; https://support.citrix.com/article/CTX330728
CVE: CVE-2021-22956
Published: 2021-12-07
Description: An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with management interface access to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://support.citrix.com/article/CTX330728; https://support.citrix.com/article/CTX330728