deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37134
Published: 2022-01-03
Description: Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invoking the interface of location-related components.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-38576
Published: 2022-01-03
Description: A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
CVSS Score: 7.5 (HIGH)
References: https://bugzilla.tianocore.org/show_bug.cgi?id=3499; https://bugzilla.tianocore.org/show_bug.cgi?id=3499; https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html
CVE: CVE-2021-39966
Published: 2022-01-03
Description: There is an Uninitialized AOD driver structure in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-909
References: https://consumer.huawei.com/en/support/bulletin/2021/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/11/
CVE: CVE-2021-39967
Published: 2022-01-03
Description: There is a Vulnerability of obtaining broadcast information improperly due to improper broadcast permission settings in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2021/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/11/
CVE: CVE-2021-39968
Published: 2022-01-03
Description: Changlian Blocklist has a Business Logic Errors vulnerability .Successful exploitation of this vulnerability may expand the attack surface of the message class.
CVSS Score: 7.5 (HIGH)
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39969
Published: 2022-01-03
Description: There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/11/
CVE: CVE-2021-39970
Published: 2022-01-03
Description: HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerability may create any file with the system app permission.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39971
Published: 2022-01-03
Description: Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39972
Published: 2022-01-03
Description: MyHuawei-App has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability could compromise confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39973
Published: 2022-01-03
Description: There is a Null pointer dereference in Smartphones.Successful exploitation of this vulnerability may cause the kernel to break down.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://consumer.huawei.com/en/support/bulletin/2021/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/11/
CVE: CVE-2021-39974
Published: 2022-01-03
Description: There is an Out-of-bounds read in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2021/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2021/11/
CVE: CVE-2021-39975
Published: 2022-01-03
Description: Hilinksvc has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause denial of service attacks.
CVSS Score: 7.5 (HIGH)
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39977
Published: 2022-01-03
Description: The HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-39978
Published: 2022-01-03
Description: Telephony application has a SQL Injection vulnerability.Successful exploitation of this vulnerability may cause privacy and security issues.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39979
Published: 2022-01-03
Description: HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39980
Published: 2022-01-03
Description: Telephony application has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability could lead to sensitive information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39981
Published: 2022-01-03
Description: Chang Lian application has a vulnerability which can be maliciously exploited to hide the calling number.Successful exploitation of this vulnerability allows you to make an anonymous call.
CVSS Score: 5.3 (MEDIUM)
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39982
Published: 2022-01-03
Description: Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by tampering with Phone Manager notifications.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-[PII_REDACTED]
CVE: CVE-2021-39983
Published: 2022-01-03
Description: The HwNearbyMain module has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause a process to restart.
CVSS Score: 7.5 (HIGH)
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-39984
Published: 2022-01-03
Description: Huawei idap module has a Out-of-bounds Read vulnerability.Successful exploitation of this vulnerability may cause Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-39985
Published: 2022-01-03
Description: The HwNearbyMain module has a Improper Validation of Array Index vulnerability.Successful exploitation of this vulnerability may cause a process to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-129, CWE-129
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-39987
Published: 2022-01-03
Description: The HwNearbyMain module has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause a process to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843, CWE-843
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-39988
Published: 2022-01-03
Description: The HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-39989
Published: 2022-01-03
Description: The HwNearbyMain module has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability may cause a process to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-704, CWE-704
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-39990
Published: 2022-01-03
Description: The screen lock module has a Stack-based Buffer Overflow vulnerability.Successful exploitation of this vulnerability may affect user experience.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-[PII_REDACTED]
CVE: CVE-2021-45829
Published: 2022-01-03
Description: HDF5 1.13.1-1 is affected by: segmentation fault, which causes a Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://github.com/HDFGroup/hdf5/issues/1317; https://github.com/HDFGroup/hdf5/issues/1317
CVE: CVE-2021-43942
Published: 2022-01-04
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-73068; https://jira.atlassian.com/browse/JRASERVER-73068
CVE: CVE-2021-20868
Published: 2022-01-04
Description: Incorrect authorization vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier, bizhub C3320i G00-B6 and earlier, bizhub 4750i/4050i G00-22 and earlier, bizhub 4700i G00-22 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, and bizhub 4752/4052 GC9-X4 and earlier) allows an attacker on the adjacent network to obtain user credentials if external server authentication is enabled via a specific SOAP message sent by an administrative user.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-863
References: https://jvn.jp/en/vu/JVNVU95192472/index.html; https://jvn.jp/vu/JVNVU95192472/index.html; https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html
CVE: CVE-2021-20869
Published: 2022-01-04
Description: Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier, bizhub C3320i G00-B6 and earlier, bizhub 4750i/4050i G00-22 and earlier, bizhub 4700i G00-22 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, and bizhub 4752/4052 GC9-X4 and earlier) allows an attacker on the adjacent network to obtain some of user credentials if LDAP server authentication is enabled via a specific SOAP message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://jvn.jp/en/vu/JVNVU95192472/index.html; https://jvn.jp/vu/JVNVU95192472/index.html; https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html
CVE: CVE-2021-20870
Published: 2022-01-04
Description: Improper handling of exceptional conditions vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier, bizhub C3320i G00-B6 and earlier, bizhub 4750i/4050i G00-22 and earlier, bizhub 4700i G00-22 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, bizhub 4752/4052 GC9-X4 and earlier, bizhub C3850/C3350/3850FS, bizhub 4750/4050, bizhub C3110, bizhub C3100P) allows a physical attacker to obtain unsent scanned image data when scanned data transmission is stopped due to the network error by ejecting a HDD before the scan job times out.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-755
References: https://jvn.jp/en/vu/JVNVU95192472/index.html; https://jvn.jp/vu/JVNVU95192472/index.html; https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html
CVE: CVE-2021-20871
Published: 2022-01-04
Description: Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C4050i/C3350i/C4000i/C3300i G00-B6 and earlier, bizhub C3320i G00-B6 and earlier, bizhub 4750i/4050i G00-22 and earlier, bizhub 4700i G00-22 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, and bizhub 4752/4052 GC9-X4 and earlier) allows an attacker on the adjacent network to obtain the credentials if the destination information including credentials are registered in the address book via a specific SOAP message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://jvn.jp/en/vu/JVNVU95192472/index.html; https://jvn.jp/vu/JVNVU95192472/index.html; https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html
CVE: CVE-2021-20872
Published: 2022-01-04
Description: Protection mechanism failure vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C360i/C300i/C250i G00-B6 and earlier, bizhub 750i/650i/550i/450i G00-37 and earlier, bizhub 360i/300i G00-33 and earlier, bizhub C287i/C257i/C227i G00-19 and earlier, bizhub 306i/266i/246i/226i G00-B6 and earlier, bizhub C759/C659 GC7-X8 and earlier, bizhub C658/C558/C458 GC7-X8 and earlier, bizhub 958/808/758 GC7-X8 and earlier, bizhub 658e/558e/458e GC7-X8 and earlier, bizhub C287/C227 GC7-X8 and earlier, bizhub 287/227 GC7-X8 and earlier, bizhub 368e/308e GC7-X8 and earlier, bizhub C368/C308/C258 GC9-X4 and earlier, bizhub 558/458/368/308 GC9-X4 and earlier, bizhub C754e/C654e GDQ-M0 and earlier, bizhub 754e/654e GDQ-M0 and earlier, bizhub C554e/C454e GDQ-M1 and earlier, bizhub C364e/C284e/C224e GDQ-M1 and earlier, bizhub 554e/454e/364e/284e/224e GDQ-M1 and earlier, bizhub C754/C654 C554/C454 GR1-M0 and earlier, bizhub C364/C284/C224 GR1-M0 and earlier, bizhub 754/654 GR1-M0 and earlier, bizhub C3851FS/C3851/C3351 GC9-X4 and earlier, bizhub 4752/4052 GC9-X4 and earlier) allows a physical attacker to bypass the firmware integrity verification and to install malicious firmware.
CVSS Score: 6.8 (MEDIUM)
References: https://jvn.jp/en/vu/JVNVU95192472/index.html; https://jvn.jp/vu/JVNVU95192472/index.html; https://www.konicaminolta.com/global/newsroom/topics/2021/1224-01-01.html
CVE: CVE-2022-0083
Published: 2022-01-04
Description: livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/livehelperchat/livehelperchat/commit/fbed8728be59040a7218610e72f6eceb5f8bc152; https://huntr.dev/bounties/4c477440-3b03-42eb-a6e2-a31b55090736; https://github.com/livehelperchat/livehelperchat/commit/fbed8728be59040a7218610e72f6eceb5f8bc152
CVE: CVE-2021-34797
Published: 2022-01-04
Description: Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://lists.apache.org/thread/nq2w9gjzm1cjx1rh6zw41ty39qw7qpx4; https://lists.apache.org/thread/p4l0g49rzzzpn8yt9q9p0xp52h3zmsmk; https://lists.apache.org/thread/nq2w9gjzm1cjx1rh6zw41ty39qw7qpx4
CVE: CVE-2021-38542
Published: 2022-01-04
Description: Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-77, CWE-327
References: http://www.openwall.com/lists/oss-security/2022/01/04/1; http://www.openwall.com/lists/oss-security/2022/09/20/1; https://www.openwall.com/lists/oss-security/2022/01/04/1
CVE: CVE-2021-40110
Published: 2022-01-04
Description: In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/01/04/2; https://www.openwall.com/lists/oss-security/2022/01/04/2; http://www.openwall.com/lists/oss-security/2022/01/04/2
CVE: CVE-2021-40111
Published: 2022-01-04
Description: In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2022/01/04/3; https://www.openwall.com/lists/oss-security/2022/01/04/3; http://www.openwall.com/lists/oss-security/2022/01/04/3