rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-25230 
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the contents of a scan connection exception file.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
Published: 2021-02-04T19:36:39.000Z
CVE-2021-25231 
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about a specific hotfix history file.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:40.000Z
CVE-2021-25232 
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the SQL database.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
Published: 2021-02-04T19:36:41.000Z
CVE-2021-25233 
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about a specific configuration download file.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:41.000Z
CVE-2021-25234 
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about a specific notification configuration file.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:42.000Z
CVE-2021-25235 
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about a content inspection configuration file.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
Published: 2021-02-04T19:36:43.000Z
CVE-2021-25236 
A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a specific sweep.
Problem types: description: SSRF Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:43.000Z
CVE-2021-25237 
An improper access control vulnerability in Trend Micro Apex One (on-prem) could allow an unauthenticated user to obtain information about the managing port used by agents.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
Published: 2021-02-04T19:36:44.000Z
CVE-2021-25238 
An improper access control information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about an agent's managing port.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:45.000Z
CVE-2021-25239 
An improper access control vulnerability in Trend Micro Apex One (on-prem), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about x86 agent hotfixes.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:45.000Z
CVE-2021-25240 
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain x64 agent hofitx information.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:46.000Z
CVE-2021-25241 
A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep.
Problem types: description: SSRF Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:47.000Z
CVE-2021-25242 
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain version and build information.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:47.000Z
CVE-2021-25243 
An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain patch level information.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:48.000Z
CVE-2021-25244 
An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of configuration informaiton.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:49.000Z
CVE-2021-25245 
An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of settings informaiton.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:49.000Z
CVE-2021-25246 
An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security could allow an unauthenticated user to create a bogus agent on an affected server that could be used then make valid configuration queries.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:50.000Z
CVE-2021-25247 
A DLL hijacking vulnerability Trend Micro HouseCall for Home Networks version 5.3.1063 and below could allow an attacker to use a malicious DLL to escalate privileges and perform arbitrary code execution. An attacker must already have user privileges on the machine to exploit this vulnerability.
Problem types: description: DLL Hijacking
Affected products: vendor: Trend Micro
product: Trend Micro HouseCall for Home Networks
Published: 2021-01-27T19:10:26.000Z
CVE-2021-25248 
An out-of-bounds read information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10.0 SP1 and Services) could allow an attacker to disclose sensitive information about a named pipe. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Out-of-Bounds Read Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:51.000Z
CVE-2021-25249 
An out-of-bounds write information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10.0 SP1 and Services) could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Out-of-Bounds Write Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2021-02-04T19:36:52.000Z
CVE-2021-25250 
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Improper Access Control
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
Published: 2021-04-13T12:35:04.000Z
CVE-2021-25251 
The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit this vulnerability.
Problem types: description: Code Injection
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2021-02-10T22:00:15.000Z
CVE-2021-25252 
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.
Problem types: description: Memory Exhaustion
Affected products: vendor: Trend Micro
product: Trend Micro Virus Scan API (VSAPI) Engine
Published: 2021-03-03T15:43:40.000Z
CVE-2021-25253 
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Improper Access Control
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro OfficeScan
Published: 2021-04-13T12:53:59.000Z
CVE-2021-25254 Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
Problem types: cwe_id: CWE-116
description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Yandex
product: Browser Lite
default_status: unaffected
Credits: lang: en
value: Kirtikumar Anandrao  Ramchandani
Published: 2025-05-21T06:58:00.753Z
CVE-2021-25255 Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Yandex
product: Browser Lite
default_status: unaffected
Credits: lang: en
value: Kirtikumar Anandrao  Ramchandani
Published: 2025-05-21T07:04:02.436Z
CVE-2021-25261 
Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex Browser update process.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: Yandex Browser (Desktop)
Published: 2022-06-15T19:05:54.000Z
CVE-2021-25262 Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.
Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.
Problem types: cwe_id: CWE-116
description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Yandex
product: Browser
default_status: unaffected
Credits: lang: en
value: Kirtikumar Anandrao  Ramchandani
Published: 2025-05-21T07:07:29.310Z
CVE-2021-25263 
Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating files in directory with insecure permissions during Yandex Browser update process.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: Yandex Browser (Desktop)
Published: 2021-08-17T18:34:04.000Z
CVE-2021-25264 
In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Intercept X for MacOS
vendor: Sophos
product: Intercept X for MacOS (OPM)
vendor: Sophos
product: Sophos Home for MacOS
Credits: lang: en
value: Csaba Fitzl
Published: 2021-05-17T17:02:09.000Z
CVE-2021-25265 
A malicious website could execute code remotely in Sophos Connect Client before version 2.1.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Sophos Connect Client
Credits: lang: en
value: Kim Karlsson
Published: 2021-03-22T17:24:28.000Z
CVE-2021-25266 
An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Intercept X for Mobile (Android)
vendor: Sophos
product: Sophos Authenticator (Android)
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Can Özkan
Published: 2022-04-27T16:45:13.000Z
CVE-2021-25267 
Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Sophos Firewall
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Gaetano Sapia
Published: 2022-05-05T18:05:12.000Z
CVE-2021-25268 
Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Sophos Firewall
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Gaetano Sapia
Published: 2022-05-05T18:05:13.000Z
CVE-2021-25269 
A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before version 3.8.3.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Intercept X Advanced
vendor: Sophos
product: Intercept X Advanced for Server
vendor: Sophos
product: Sophos Exploit Prevention
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Andrea Intilangelo
lang: en
value: Florian Hansemann
Published: 2021-11-26T14:12:47.000Z
CVE-2021-25270 
A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901.
Problem types: description: n/a
Affected products: vendor: Sophos
product: HitmanPro.Alert
Credits: lang: en
value: Michael Bourque (@downwithupsec)
Published: 2021-10-07T23:11:53.000Z
CVE-2021-25271 
A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318.
Problem types: description: n/a
Affected products: vendor: Sophos
product: HitmanPro
Credits: lang: en
value: Michael Bourque (@downwithupsec)
Published: 2021-10-07T23:11:54.000Z
CVE-2021-25273 
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Sophos UTM
Credits: lang: en
value: Daniel Hoffmann, usd AG
Published: 2021-07-29T19:17:34.000Z
CVE-2021-25274 
The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon processing of such messages, the service deserializes them in insecure manner, allowing remote arbitrary code execution as LocalSystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T16:49:26.000Z
CVE-2021-25275 
SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable by unprivileged users. As a result, any user having access to the filesystem can read database login details from that file, including the login name and its associated password. Then, the credentials can be used to get database owner access to the SWNetPerfMon.DB database. This gives access to the data collected by SolarWinds applications, and leads to admin access to the applications by inserting or changing authentication data stored in the Accounts table of the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T16:49:08.000Z
CVE-2021-25276 
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an FTP user by copying a valid profile file to this directory. For example, if this profile sets up a user with a C:\ home directory, then the attacker obtains access to read or replace arbitrary files with LocalSystem privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T16:59:55.000Z
CVE-2021-25277 
FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T16:39:35.000Z
CVE-2021-25278 
FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T16:42:07.000Z
CVE-2021-25281 
An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-27T00:00:00.000Z
CVE-2021-25282 
An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-27T00:00:00.000Z
CVE-2021-25283 
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-27T00:00:00.000Z
CVE-2021-25284 
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-27T00:00:00.000Z
CVE-2021-25287 
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T15:13:14.000Z
CVE-2021-25288 
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T15:13:28.000Z
CVE-2021-25289 
An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T03:29:48.000Z
CVE-2021-25290 
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T03:29:57.000Z
CVE-2021-25291 
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-19T03:30:09.000Z