deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33683
Published: 2021-07-14
Description: SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://launchpad.support.sap.com/#/notes/3000663; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3000663
CVE: CVE-2021-33684
Published: 2021-07-14
Description: SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84, allows an attacker to send overlong content in the RFC request type thereby crashing the corresponding work process because of memory corruption vulnerability. The work process will attempt to restart itself after the crash and hence the impact on the availability is low.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3032624; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3032624
CVE: CVE-2021-33687
Published: 2021-07-14
Description: SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in conjunction with other attacks such as XSS to steal this information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/164600/SAP-Enterprise-Portal-Sensitive-Data-Disclosure.html; http://seclists.org/fulldisclosure/2021/Oct/32; https://launchpad.support.sap.com/#/notes/3059764
CVE: CVE-2021-33689
Published: 2021-07-14
Description: When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-778
References: https://launchpad.support.sap.com/#/notes/3038594; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3038594
CVE: CVE-2021-35469
Published: 2021-07-14
Description: The Lexmark Printer Software G2, G3 and G4 Installation Packages have a local escalation of privilege vulnerability due to a registry entry that has an unquoted service path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: http://support.lexmark.com/alerts/; http://support.lexmark.com/index?id=TE952&page=content&locale=en&userlocale=EN_US; http://support.lexmark.com/alerts/
CVE: CVE-2021-24116
Published: 2021-07-14
Description: In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-203
References: https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md; https://github.com/wolfSSL/wolfssl/releases; https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md
CVE: CVE-2021-24119
Published: 2021-07-14
Description: In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-203
References: https://github.com/ARMmbed/mbedtls/releases; https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md; https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html
CVE: CVE-2019-11098
Published: 2021-07-14
Description: Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://edk2-docs.gitbook.io/security-advisory/bootguard-toctou-vulnerability; https://edk2-docs.gitbook.io/security-advisory/bootguard-toctou-vulnerability
CVE: CVE-2020-0417
Published: 2021-07-14
Description: In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.1 Android-9Android ID: A-154319182
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2020-20231
Published: 2021-07-14
Description: Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-787
References: https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2020-20231/README.md; https://mikrotik.com/; https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2020-20231/README.md
CVE: CVE-2021-0144
Published: 2021-07-14
Description: Insecure default variable initialization for the Intel BSSA DFT feature may allow a privileged user to potentially enable an escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1188
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00525.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00527.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00525.html
CVE: CVE-2021-0441
Published: 2021-07-14
Description: In onCreate of PermissionActivity.java, there is a possible permission bypass due to Confusing UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174495520
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0486
Published: 2021-07-14
Description: In onPackageAddedInternal of PermissionManagerService.java, there is possible access to external storage due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-171430330
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0514
Published: 2021-07-14
Description: In several functions of the V8 library, there is a possible use after free due to a race condition. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-9 Android-11 Android-8.1Android ID: A-162604069
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0515
Published: 2021-07-14
Description: In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-167389063
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0518
Published: 2021-07-14
Description: In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-176541017
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2021-0577
Published: 2021-07-14
Description: In flv extractor, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187161771
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0585
Published: 2021-07-14
Description: In beginWrite and beginRead of MessageQueueBase.h, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-184963385
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0586
Published: 2021-07-14
Description: In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-182584940
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0587
Published: 2021-07-14
Description: In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-185259758
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0588
Published: 2021-07-14
Description: In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-177238342
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0589
Published: 2021-07-14
Description: In BTM_TryAllocateSCN of btm_scn.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-180939982
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0590
Published: 2021-07-14
Description: In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID without location permissions due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-175213041
CVSS Score: 4.4 (MEDIUM)
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0592
Published: 2021-07-14
Description: In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-188061006
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0594
Published: 2021-07-14
Description: In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote (proximal, NFC) escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-176445224
CVSS Score: 8.0 (HIGH)
CWE: CWE-74
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0596
Published: 2021-07-14
Description: In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-181346550
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0597
Published: 2021-07-14
Description: In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176496502
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0599
Published: 2021-07-14
Description: In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-175614289
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-610
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0600
Published: 2021-07-14
Description: In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-179042963
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0601
Published: 2021-07-14
Description: In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out of bounds write due to a double free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-180643802
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415, CWE-787
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0602
Published: 2021-07-14
Description: In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-177573895
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0603
Published: 2021-07-14
Description: In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-182809425
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0604
Published: 2021-07-14
Description: In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-179910660
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2021-07-01; https://source.android.com/security/bulletin/2021-07-01
CVE: CVE-2021-0654
Published: 2021-07-14
Description: In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. This could lead to local information disclosure from locked profiles with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168802517References: N/A
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-07-01; https://source.android.com/security/bulletin/pixel/2021-07-01
CVE: CVE-2021-24117
Published: 2021-07-14
Description: In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-203
References: https://docs.rs/crate/sgx_tstd/1.1.1; https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md; https://github.com/dingelish/rust-base64/commit/a554b7ae880553db6dde8a387101a093911d5b2a
CVE: CVE-2021-33211
Published: 2021-07-14
Description: A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-021.txt; https://www.syss.de/pentest-blog/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-021.txt
CVE: CVE-2021-33212
Published: 2021-07-14
Description: A Cross-site scripting (XSS) vulnerability in the "View in Browser" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SVG image.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-020.txt; https://www.syss.de/pentest-blog/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-020.txt
CVE: CVE-2021-33213
Published: 2021-07-14
Description: An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-027.txt; https://www.syss.de/pentest-blog/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-027.txt
CVE: CVE-2021-35527
Published: 2021-07-14
Description: Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials that are stored by the browser. This issue affects: Hitachi ABB Power Grids eSOMS version 6.3 and prior versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-522
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A0957&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A0957&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2020-25444
Published: 2021-07-14
Description: Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section under the “My Profile” page, " (2) “Hotel Policy” field under the “Hotel Details” page, (3) “Pricing code” and “name” fields under the “Manage Tour” page, and (4) all the labels under the “Menu” section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e; https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e
CVE: CVE-2020-25445
Published: 2021-07-14
Description: The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e; https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e