deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21040
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21041
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21042
Published: 2021-02-11
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to arbitrary disclosure of information in the memory stack. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21044
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an Out-of-bounds Write vulnerability when parsing a crafted jpeg file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21045
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an improper access control vulnerability. An unauthenticated attacker could leverage this vulnerability to elevate privileges in the context of the current user.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21046
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21057
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a null pointer dereference vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to achieve denial of service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21060
Published: 2021-02-11
Description: Adobe Acrobat Pro DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21061
Published: 2021-02-11
Description: Acrobat Pro DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Use-after-free vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2019-19004
Published: 2021-02-11
Description: A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap image.
CVSS Score: 3.3 (LOW)
CWE: CWE-190
References: https://github.com/autotrace/autotrace/commits/master; https://github.com/autotrace/autotrace/commits/master/src/input-bmp.c; https://github.com/autotrace/autotrace/pull/40
CVE: CVE-2019-19005
Published: 2021-02-11
Description: A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://github.com/autotrace/autotrace/commits/master; https://github.com/autotrace/autotrace/pull/40; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NC6MUH2RLVEA634LHBNZ2KO7MQKI2RDZ/
CVE: CVE-2020-9307
Published: 2021-02-11
Description: Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 allow a denial of service. An unauthenticated, adjacent attacker can cause an infinite loop on one of the HSR ring ports of the device. This effectively breaks the redundancy of the HSR ring. If the attacker can perform the same attack on a second device, the ring is broken into two parts (thus disrupting communication between devices in the different parts).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/12276-source/options/view; https://www.belden.com/security; https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/12276-source/options/view
CVE: CVE-2021-21014
Published: 2021-02-11
Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://helpx.adobe.com/security/products/magento/apsb21-08.html; https://helpx.adobe.com/security/products/magento/apsb21-08.html
CVE: CVE-2021-21047
Published: 2021-02-11
Description: Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb21-10.html; https://helpx.adobe.com/security/products/photoshop/apsb21-10.html
CVE: CVE-2021-21048
Published: 2021-02-11
Description: Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by a Memory Corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb21-10.html; https://helpx.adobe.com/security/products/photoshop/apsb21-10.html
CVE: CVE-2021-21049
Published: 2021-02-11
Description: Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb21-10.html; https://helpx.adobe.com/security/products/photoshop/apsb21-10.html
CVE: CVE-2021-21050
Published: 2021-02-11
Description: Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb21-10.html; https://helpx.adobe.com/security/products/photoshop/apsb21-10.html
CVE: CVE-2021-21051
Published: 2021-02-11
Description: Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted javascript file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/photoshop/apsb21-10.html; https://helpx.adobe.com/security/products/photoshop/apsb21-10.html
CVE: CVE-2021-21052
Published: 2021-02-11
Description: Adobe Animate version 21.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb21-11.html; https://helpx.adobe.com/security/products/animate/apsb21-11.html
CVE: CVE-2021-21053
Published: 2021-02-11
Description: Adobe Illustrator version 25.1 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb21-12.html; https://helpx.adobe.com/security/products/illustrator/apsb21-12.html
CVE: CVE-2021-21054
Published: 2021-02-11
Description: Adobe Illustrator version 25.1 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb21-12.html; https://helpx.adobe.com/security/products/illustrator/apsb21-12.html
CVE: CVE-2021-21055
Published: 2021-02-11
Description: Adobe Dreamweaver versions 21.0 (and earlier) and 20.2 (and earlier) is affected by an untrusted search path vulnerability that could result in information disclosure. An attacker with physical access to the system could replace certain configuration files and dynamic libraries that Dreamweaver references, potentially resulting in information disclosure.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-426
References: https://helpx.adobe.com/security/products/dreamweaver/apsb21-13.html; https://helpx.adobe.com/security/products/dreamweaver/apsb21-13.html
CVE: CVE-2021-21058
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Memory corruption vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21059
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Memory corruption vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21062
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Memory corruption vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21063
Published: 2021-02-11
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by a Memory corruption vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-21311
Published: 2021-02-11
Description: Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://github.com/vrana/adminer/commit/ccd2374b0b12bd547417bf0dacdf153826c83351; https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf; https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6
CVE: CVE-2021-21976
Published: 2021-02-11
Description: vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authentication command injection vulnerability which may allow an authenticated admin user to perform a remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.vmware.com/security/advisories/VMSA-2021-0001.html; https://www.vmware.com/security/advisories/VMSA-2021-0001.html
CVE: CVE-2021-21310
Published: 2021-02-11
Description: NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the Email provider with the default database adapter are not impacted. Implementations using the Prisma database adapter but not using the Email provider are not impacted. The Prisma database adapter was checking the verification token, but was not verifying the email address associated with that token. This made it possible to use a valid token to sign in as another user when using the Prima adapter in conjunction with the Email provider. This issue is specific to the community supported Prisma adapter. This issue is fixed in version 3.3.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-290
References: https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0; https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q; https://www.npmjs.com/package/next-auth
CVE: CVE-2020-27860
Published: 2021-02-12
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA templates. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11727.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1415/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-27861
Published: 2021-02-12
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems; https://www.zerodayinitiative.com/advisories/ZDI-20-1430/; https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems
CVE: CVE-2020-27862
Published: 2021-02-12
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. When parsing the path parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-10911.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10196; https://www.zerodayinitiative.com/advisories/ZDI-20-1426/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10196
CVE: CVE-2020-27863
Published: 2021-02-12
Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10912.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-288, CWE-287
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10196; https://www.zerodayinitiative.com/advisories/ZDI-20-1427/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10196
CVE: CVE-2020-27864
Published: 2021-02-12
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the Authorization request header, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10880.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10197; https://www.zerodayinitiative.com/advisories/ZDI-20-1428/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10197
CVE: CVE-2020-27865
Published: 2021-02-12
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the uhttpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the device. Was ZDI-CAN-10894.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288, CWE-287
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10197; https://www.zerodayinitiative.com/advisories/ZDI-20-1429/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10197