deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20602
Published: 2021-10-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-20603
Published: 2021-10-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-20604
Published: 2021-10-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-20605
Published: 2021-10-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-22930
Published: 2021-10-07
Description: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://hackerone.com/reports/1238162; https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
CVE: CVE-2021-22958
Published: 2021-10-07
Description: A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://documentation.concretecms.org/developers/introduction/version-history/855-release-notes; https://hackerone.com/reports/863221; https://documentation.concretecms.org/developers/introduction/version-history/855-release-notes
CVE: CVE-2021-36150
Published: 2021-10-07
Description: SilverStripe Framework through 4.8.1 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/silverstripe/silverstripe-framework/releases; https://www.silverstripe.org/download/security-releases/CVE-2021-36150; https://github.com/silverstripe/silverstripe-framework/releases
CVE: CVE-2021-3832
Published: 2021-10-07
Description: Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpload() function in order to exploit the vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://integriaims.com/en/services/updates/; https://www.incibe-cert.es/en/early-warning/security-advisories/integria-ims-remote-code-execution; https://integriaims.com/en/services/updates/
CVE: CVE-2021-40978
Published: 2021-10-07
Description: The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/mkdocs/mkdocs; https://github.com/mkdocs/mkdocs/issues/2601; https://github.com/nisdn/CVE-2021-40978
CVE: CVE-2021-41865
Published: 2021-10-07
Description: HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of service by submitting incomplete job specifications with a Consul mesh gateway and host networking mode. Fixed in 1.1.6.
CVSS Score: 6.5 (MEDIUM)
References: https://discuss.hashicorp.com/t/hcsec-2021-26-nomad-denial-of-service-via-submission-of-incomplete-job-specification-using-consul-mesh-gateway-host-network/30311; https://discuss.hashicorp.com/t/hcsec-2021-26-nomad-denial-of-service-via-submission-of-incomplete-job-specification-using-consul-mesh-gateway-host-network/30311
CVE: CVE-2021-28661
Published: 2021-10-07
Description: Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/silverstripe/silverstripe-graphql/releases; https://www.silverstripe.org/download/security-releases/CVE-2021-28661; https://github.com/silverstripe/silverstripe-graphql/releases
CVE: CVE-2021-33903
Published: 2021-10-07
Description: In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. (However, changing the password of the root user via LANconfig does change the password of the root user for SNMPv3 access.)
CVSS Score: 8.8 (HIGH)
References: https://www.nmedv.de/wp-content/uploads/2021/10/NME-2021-001.txt; https://www.nmedv.de/wp-content/uploads/2021/10/NME-2021-001.txt
CVE: CVE-2021-35067
Published: 2021-10-07
Description: Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data (e.g., an attacker who sniffs a Close message can transmit an acceptable Open message).
CVSS Score: 8.1 (HIGH)
CWE: CWE-294
References: https://infosec.rm-it.de/2021/06/18/meross-smart-wi-fi-garage-door-opener-analysis/; https://infosec.rm-it.de/?p=878&preview=1&_ppp=219bc85c2f; https://infosec.rm-it.de/2021/06/18/meross-smart-wi-fi-garage-door-opener-analysis/
CVE: CVE-2021-41794
Published: 2021-10-07
Description: ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow. The attacker can send a PFCP Session Establishment Request with "internet" as the PDI Network Instance. The first character is interpreted as a length value to be used in a memcpy call. The destination buffer is only 100 bytes long on the stack. Then, 'i' gets interpreted as 105 bytes to copy from the source buffer to the destination buffer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://research.nccgroup.com/2021/10/06/technical-advisory-open5gs-stack-buffer-overflow-during-pfcp-session-establishment-on-upf-cve-2021-41794; https://research.nccgroup.com/2021/10/06/technical-advisory-open5gs-stack-buffer-overflow-during-pfcp-session-establishment-on-upf-cve-2021-41794
CVE: CVE-2021-28129
Published: 2021-10-07
Description: While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist. Users who installed the Apache OpenOffice 4.1.8 DEB packaging should upgrade to the latest version of Apache OpenOffice.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2021/10/07/5; https://lists.apache.org/thread.html/r9e72234dd662280fa1a3cca6164d3470a1dbc0d8e53e48ba27f787ce%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/rc9090ab48b4699494b63b35cd6d7414c52d665ecae12add3cdc56c9b%40%3Cusers.openoffice.apache.org%3E
CVE: CVE-2021-37762
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37918
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37919
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37920
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37921
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37922
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to another.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37923
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37924
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37926
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37928
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37929
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37930
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37931
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-3833
Published: 2021-10-07
Description: Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-697, CWE-697
References: https://integriaims.com/en/services/updates/; https://www.incibe.es/en/incibe-cert/notices/aviso/integria-ims-incorrect-authorization; https://integriaims.com/en/services/updates/
CVE: CVE-2021-3834
Published: 2021-10-07
Description: Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://integriaims.com/en/services/updates/; https://www.incibe.es/en/incibe-cert/notices/aviso/integria-ims-vulnerable-cross-site-scripting-xss; https://integriaims.com/en/services/updates/
CVE: CVE-2021-40439
Published: 2021-10-07
Description: Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: http://www.openwall.com/lists/oss-security/2021/10/07/4; https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E
CVE: CVE-2021-40725
Published: 2021-10-07
Description: Acrobat Reader DC versions 2[PII_REDACTED]0 (and earlier), 2[PII_REDACTED]6 (and earlier) and 2[PII_REDACTED]9 (and earlier) are affected by a use-after-free vulnerability when processing AcroForm listbox that could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-55.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1250/; https://helpx.adobe.com/security/products/acrobat/apsb21-55.html
CVE: CVE-2021-40726
Published: 2021-10-07
Description: Acrobat Reader DC versions 2[PII_REDACTED]0 (and earlier), 2[PII_REDACTED]6 (and earlier) and 2[PII_REDACTED]9 (and earlier) are affected by a use-after-free vulnerability when processing AcroForm field that could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-55.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1249/; https://helpx.adobe.com/security/products/acrobat/apsb21-55.html
CVE: CVE-2021-42013
Published: 2021-10-07
Description: It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://jvn.jp/en/jp/JVN51106450/index.html; http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html; http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html
CVE: CVE-2021-23447
Published: 2021-10-07
Description: This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-843
References: https://github.com/rooseveltframework/teddy/pull/518; https://github.com/rooseveltframework/teddy/releases/tag/0.5.9; https://snyk.io/vuln/SNYK-JS-TEDDY-1579557
CVE: CVE-2021-42071
Published: 2021-10-07
Description: In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://visual-tools.com/; https://www.exploit-db.com/exploits/50098; https://www.swascan.com/security-advisory-visual-tools-dvr-cve-2021-42071/
CVE: CVE-2021-20372
Published: 2021-10-07
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another user's service due to insufficient permission checking. IBM X-Force ID: 195518.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195518; https://www.ibm.com/support/pages/node/6496805; https://exchange.xforce.ibmcloud.com/vulnerabilities/195518
CVE: CVE-2021-20375
Published: 2021-10-07
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195567; https://www.ibm.com/support/pages/node/6496803; https://exchange.xforce.ibmcloud.com/vulnerabilities/195567
CVE: CVE-2021-20376
Published: 2021-10-07
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observable discrepancy in returned messages. IBM X-Force ID: 195568.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195568; https://www.ibm.com/support/pages/node/6496789; https://exchange.xforce.ibmcloud.com/vulnerabilities/195568
CVE: CVE-2021-20473
Published: 2021-10-07
Description: IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 196944.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196944; https://www.ibm.com/support/pages/node/6496785; https://exchange.xforce.ibmcloud.com/vulnerabilities/196944
CVE: CVE-2021-20481
Published: 2021-10-07
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197503.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197503; https://www.ibm.com/support/pages/node/6496781; https://exchange.xforce.ibmcloud.com/vulnerabilities/197503
CVE: CVE-2021-20489
Published: 2021-10-07
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 197790.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197790; https://www.ibm.com/support/pages/node/6496777; https://exchange.xforce.ibmcloud.com/vulnerabilities/197790
CVE: CVE-2021-20552
Published: 2021-10-07
Description: IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199170.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199170; https://www.ibm.com/support/pages/node/6496771; https://exchange.xforce.ibmcloud.com/vulnerabilities/199170
CVE: CVE-2021-20561
Published: 2021-10-07
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199230.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199230; https://www.ibm.com/support/pages/node/6496759; https://exchange.xforce.ibmcloud.com/vulnerabilities/199230
CVE: CVE-2021-20571
Published: 2021-10-07
Description: IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199246.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199246; https://www.ibm.com/support/pages/node/6496753; https://exchange.xforce.ibmcloud.com/vulnerabilities/199246
CVE: CVE-2021-20584
Published: 2021-10-07
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 199397.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199397; https://www.ibm.com/support/pages/node/6496751; https://exchange.xforce.ibmcloud.com/vulnerabilities/199397
CVE: CVE-2021-29700
Published: 2021-10-07
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain sensitive information from configuration files that could aid in further attacks against the system. IBM X-Force ID: 200656.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200656; https://www.ibm.com/support/pages/node/6496749; https://exchange.xforce.ibmcloud.com/vulnerabilities/200656