deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-25445
Published: 2021-08-05
Description: Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsung Internet.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8
CVE: CVE-2021-25446
Published: 2021-08-05
Description: Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8
CVE: CVE-2021-25447
Published: 2021-08-05
Description: Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8
CVE: CVE-2021-25448
Published: 2021-08-05
Description: Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8
CVE: CVE-2021-29969
Published: 2021-08-05
Description: If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-552
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1682370; https://security.gentoo.org/glsa/202208-14; https://www.mozilla.org/security/advisories/mfsa2021-30/
CVE: CVE-2021-29970
Published: 2021-08-05
Description: A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1709976; https://security.gentoo.org/glsa/202202-03; https://security.gentoo.org/glsa/202208-14
CVE: CVE-2021-29971
Published: 2021-08-05
Description: If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted that permission. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 90.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1713638; https://www.mozilla.org/security/advisories/mfsa2021-28/; https://bugzilla.mozilla.org/show_bug.cgi?id=1713638
CVE: CVE-2021-29972
Published: 2021-08-05
Description: A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, and may have remediated other, unknown security vulnerabilities as well. This vulnerability affects Firefox < 90.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1696816; https://security.gentoo.org/glsa/202202-03; https://www.mozilla.org/security/advisories/mfsa2021-28/
CVE: CVE-2021-29973
Published: 2021-08-05
Description: Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be entered by the browser's autofill functionality *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 90.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1701932; https://www.mozilla.org/security/advisories/mfsa2021-28/; https://bugzilla.mozilla.org/show_bug.cgi?id=1701932
CVE: CVE-2021-29974
Published: 2021-08-05
Description: When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically. This vulnerability affects Firefox < 90.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1704843; https://security.gentoo.org/glsa/202202-03; https://www.mozilla.org/security/advisories/mfsa2021-28/
CVE: CVE-2021-29975
Published: 2021-08-05
Description: Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlaid on top of another domain (with the new domain correctly shown in the address bar) resulting in possible user confusion. This vulnerability affects Firefox < 90.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1713259; https://security.gentoo.org/glsa/202202-03; https://www.mozilla.org/security/advisories/mfsa2021-28/
CVE: CVE-2021-29976
Published: 2021-08-05
Description: Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1700895%2C1703334%2C1706910%2C1711576%2C1714391; https://security.gentoo.org/glsa/202202-03; https://security.gentoo.org/glsa/202208-14
CVE: CVE-2021-29977
Published: 2021-08-05
Description: Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 90.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1665836%2C1686138%2C1704316%2C1706314%2C1709931%2C1712084%2C1712357%2C1714066; https://security.gentoo.org/glsa/202202-03; https://www.mozilla.org/security/advisories/mfsa2021-28/
CVE: CVE-2021-29978
Published: 2021-08-05
Description: Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability affects Mozilla VPN < 2.3.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/mozilla-mobile/mozilla-vpn-client/issues/797; https://github.com/mozilla-mobile/mozilla-vpn-client/issues/798; https://github.com/mozilla-mobile/mozilla-vpn-client/issues/799
CVE: CVE-2021-32576
Published: 2021-08-05
Description: Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2).
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://kb.acronis.com/content/68419; https://kb.acronis.com/content/68419
CVE: CVE-2021-32577
Published: 2021-08-05
Description: Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://kb.acronis.com/content/68413; https://kb.acronis.com/content/68413
CVE: CVE-2021-32578
Published: 2021-08-05
Description: Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2).
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://kb.acronis.com/content/68419; https://kb.acronis.com/content/68419
CVE: CVE-2021-32579
Published: 2021-08-05
Description: Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated attacker (who has a local code execution ability) to tamper with the micro-service API.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://kb.acronis.com/content/68413; https://kb.acronis.com/content/68419; https://kb.acronis.com/content/68413
CVE: CVE-2021-32580
Published: 2021-08-05
Description: Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://kb.acronis.com/content/68419; https://kb.acronis.com/content/68419
CVE: CVE-2021-32581
Published: 2021-08-05
Description: Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not implement SSL certificate validation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://kb.acronis.com/content/68413; https://kb.acronis.com/content/68419; https://kb.acronis.com/content/68648
CVE: CVE-2021-33596
Published: 2021-08-05
Description: Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded malicious redirect while using F-Secure Safe Browser for iOS.
CVSS Score: 3.5 (LOW)
CWE: CWE-1021
References: https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame; https://www.f-secure.com/en/business/support-and-downloads/security-advisories; https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-33596
CVE: CVE-2021-33597
Published: 2021-08-05
Description: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
CVSS Score: 3.5 (LOW)
References: https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame; https://www.f-secure.com/en/business/support-and-downloads/security-advisories; https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
CVE: CVE-2021-34371
Published: 2021-08-05
Description: Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.exploit-db.com/exploits/50170; https://www.exploit-db.com/exploits/50170
CVE: CVE-2021-34631
Published: 2021-08-05
Description: The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34631; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34631
CVE: CVE-2021-35306
Published: 2021-08-05
Description: An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::WriteFields located in Ap4StszAtom.cpp. It allows an attacker to cause a denial of service (DOS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/615; https://github.com/axiomatic-systems/Bento4/issues/615
CVE: CVE-2021-35307
Published: 2021-08-05
Description: An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Test component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/616; https://github.com/axiomatic-systems/Bento4/issues/616
CVE: CVE-2021-36584
Published: 2021-08-05
Description: An issue was discovered in GPAC 1.0.1. There is a heap-based buffer overflow in the function gp_rtp_builder_do_tx3g function in ietf/rtp_pck_3gpp.c, as demonstrated by MP4Box. This can cause a denial of service (DOS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1842; https://github.com/gpac/gpac/issues/1842
CVE: CVE-2021-37614
Published: 2021-08-05
Description: In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow an authenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fixed versions are 2019.0.7 (11.0.7), 2019.1.6 (11.1.6), 2019.2.3 (11.2.3), 2020.0.6 (12.0.6), 2020.1.5 (12.1.5), and 2021.0.3 (13.0.3).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-2021; https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm; https://docs.ipswitch.com/MOVEit/Transfer2020/ReleaseNotes/en/index.htm#50951.htm
CVE: CVE-2021-37859
Published: 2021-08-05
Description: Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2021-3679
Published: 2021-08-05
Description: A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=1989165; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=67f0d6d9883c13174669f88adac4f0ee656cc16a; https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
CVE: CVE-2021-3682
Published: 2021-08-05
Description: A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.
CVSS Score: 8.5 (HIGH)
CWE: CWE-763, CWE-763
References: https://bugzilla.redhat.com/show_bug.cgi?id=1989651; https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2020-7863
Published: 2021-08-05
Description: A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could exploit this vulnerability by setting the parameter to the command they want to execute. A successful exploit could allow the attacker to execute arbitrary commands on a target system as the user. However, the victim must run the Internet Explorer browser with administrator privileges because of the cross-domain policy.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.raonk.com/page/customs/modify.aspx?pSeq=20&pageno=1; https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36166; http://www.raonk.com/page/customs/modify.aspx?pSeq=20&pageno=1
CVE: CVE-2021-1630
Published: 2021-08-05
Description: XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://help.salesforce.com/articleView?id=000362693&type=1&mode=1; https://help.salesforce.com/articleView?id=000362693&type=1&mode=1
CVE: CVE-2021-20115
Published: 2021-08-05
Description: A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tce_filemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-32; https://www.tenable.com/security/research/tra-2021-32
CVE: CVE-2021-20116
Published: 2021-08-05
Description: A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir parameters in tce_select_mediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-32; https://www.tenable.com/security/research/tra-2021-32
CVE: CVE-2021-20592
Published: 2021-08-05
Description: Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model communication driver versions 01.19.000 through 01.39.010 and GT23 model communication driver versions 01.19.000 through 01.39.010 and GT SoftGOT2000 versions 1.170C through 1.256S allows a remote unauthenticated attacker to cause DoS condition on the MODBUS/TCP slave communication function of the products by rapidly and repeatedly connecting and disconnecting to and from the MODBUS/TCP communication port on a target. Restart or reset is required to recover.
CVSS Score: 7.5 (HIGH)
CWE: CWE-662
References: https://jvn.jp/vu/JVNVU92414172/index.html; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-007_en.pdf; https://jvn.jp/vu/JVNVU92414172/index.html
CVE: CVE-2021-21785
Published: 2021-08-05
Description: An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead to a disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-782
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1252; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1252
CVE: CVE-2021-21790
Published: 2021-08-05
Description: An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver which can result in sensitive information disclosure from the kernel. The IN instruction can read two bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-782
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255
CVE: CVE-2021-21791
Published: 2021-08-05
Description: An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver which can result in sensitive information disclosure from the kernel. The IN instruction can read two bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-782
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255
CVE: CVE-2021-21792
Published: 2021-08-05
Description: An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver which can result in sensitive information disclosure from the kernel. The IN instruction can read four bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-782
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255
CVE: CVE-2021-21805
Published: 2021-08-05
Description: An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1274; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1274
CVE: CVE-2021-21831
Published: 2021-08-05
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1294; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1294
CVE: CVE-2021-21870
Published: 2021-08-05
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.4.37651. A specially crafted PDF document can trigger the reuse of previously free memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening a malicious file or site to trigger this vulnerability if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1307; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1307