deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1342
Published: 2021-02-04
Description: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj
CVE: CVE-2021-1343
Published: 2021-02-04
Description: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj
CVE: CVE-2021-1344
Published: 2021-02-04
Description: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj
CVE: CVE-2021-1345
Published: 2021-02-04
Description: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj
CVE: CVE-2021-1346
Published: 2021-02-04
Description: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj
CVE: CVE-2021-1347
Published: 2021-02-04
Description: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj
CVE: CVE-2021-1348
Published: 2021-02-04
Description: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj
CVE: CVE-2021-1354
Published: 2021-02-04
Description: A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacker to register a rogue Cisco Unified Computing System Manager (UCSM). This vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to the registration API. A successful exploit could allow the attacker to register a rogue Cisco UCSM and gain access to Cisco UCS Central Software data and Cisco UCSM inventory data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-invcert-eOpRvCKH; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-invcert-eOpRvCKH
CVE: CVE-2021-1370
Published: 2021-02-04
Description: A vulnerability in a CLI command of Cisco IOS XR Software for the Cisco 8000 Series Routers and Network Convergence System 540 Series Routers running NCS540L software images could allow an authenticated, local attacker to elevate their privilege to root. To exploit this vulnerability, an attacker would need to have a valid account on an affected device. The vulnerability is due to insufficient validation of command line arguments. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the prompt. A successful exploit could allow an attacker with low-level privileges to escalate their privilege level to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pe-QpzCAePe; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pe-QpzCAePe
CVE: CVE-2021-1389
Published: 2021-02-04
Description: A vulnerability in the IPv6 traffic processing of Cisco IOS XR Software and Cisco NX-OS Software for certain Cisco devices could allow an unauthenticated, remote attacker to bypass an IPv6 access control list (ACL) that is configured for an interface of an affected device. The vulnerability is due to improper processing of IPv6 traffic that is sent through an affected device. An attacker could exploit this vulnerability by sending crafted IPv6 packets that traverse the affected device. A successful exploit could allow the attacker to access resources that would typically be protected by the interface ACL.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv6-acl-CHgdYk8j; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv6-acl-CHgdYk8j
CVE: CVE-2021-0343
Published: 2021-02-04
Description: In kisd, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05449962.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0344
Published: 2021-02-04
Description: In mtkpower, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05437558.
CVSS Score: 6.7 (MEDIUM)
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0345
Published: 2021-02-04
Description: In mobile_log_d, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05432974.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0346
Published: 2021-02-04
Description: In vpu, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05371580.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0347
Published: 2021-02-04
Description: In ccu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11; Patch ID: ALPS05377188.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0348
Published: 2021-02-04
Description: In vpu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-9, Android-10, Android-11; Patch ID: ALPS05349201.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0349
Published: 2021-02-04
Description: In display driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-9, Android-10, Android-11; Patch ID: ALPS05362646.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0350
Published: 2021-02-04
Description: In ged, there is a possible system crash due to an improper input validation. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11; Patch ID: ALPS05342338.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0351
Published: 2021-02-04
Description: In wlan driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11; Patch ID: ALPS05412917.
CVSS Score: 7.5 (HIGH)
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-25227
Published: 2021-02-04
Description: Trend Micro Antivirus for Mac 2021 (Consumer) is vulnerable to a memory exhaustion vulnerability that could lead to disabling all the scanning functionality within the application. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability - i.e. the attacker must already have access to the target system (either legitimately or via another exploit).
CVSS Score: 3.3 (LOW)
CWE: CWE-400
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10191; https://www.zerodayinitiative.com/advisories/ZDI-21-102/; https://helpcenter.trendmicro.com/en-us/article/TMKA-10191
CVE: CVE-2021-25228
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about hotfix history.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25229
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the database server.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://www.zerodayinitiative.com/advisories/ZDI-21-104/
CVE: CVE-2021-25230
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the contents of a scan connection exception file.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://www.zerodayinitiative.com/advisories/ZDI-21-105/
CVE: CVE-2021-25231
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about a specific hotfix history file.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25232
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the SQL database.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://www.zerodayinitiative.com/advisories/ZDI-21-107/
CVE: CVE-2021-25233
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about a specific configuration download file.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25234
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about a specific notification configuration file.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25235
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about a content inspection configuration file.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://www.zerodayinitiative.com/advisories/ZDI-21-110/
CVE: CVE-2021-25236
Published: 2021-02-04
Description: A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a specific sweep.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206; https://www.zerodayinitiative.com/advisories/ZDI-21-120/
CVE: CVE-2021-25237
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem) could allow an unauthenticated user to obtain information about the managing port used by agents.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://www.zerodayinitiative.com/advisories/ZDI-21-111/; https://success.trendmicro.com/solution/000284202
CVE: CVE-2021-25238
Published: 2021-02-04
Description: An improper access control information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about an agent's managing port.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206; https://www.zerodayinitiative.com/advisories/ZDI-21-121/
CVE: CVE-2021-25239
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about x86 agent hotfixes.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25240
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain x64 agent hofitx information.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25241
Published: 2021-02-04
Description: A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284206; https://www.zerodayinitiative.com/advisories/ZDI-21-114/
CVE: CVE-2021-25242
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain version and build information.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25243
Published: 2021-02-04
Description: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain patch level information.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25244
Published: 2021-02-04
Description: An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of configuration informaiton.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284206; https://www.zerodayinitiative.com/advisories/ZDI-21-123/; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25245
Published: 2021-02-04
Description: An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of settings informaiton.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000284206; https://www.zerodayinitiative.com/advisories/ZDI-21-122/; https://success.trendmicro.com/solution/000284206