rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-1996 
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).
Problem types: description: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle WebLogic Server accessible data.
Affected products: vendor: Oracle Corporation
product: WebLogic Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.4
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-01-20T14:49:59.000Z
CVE-2021-1997 
Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Report). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as  unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data.
Affected products: vendor: Oracle Corporation
product: Hospitality Reporting and Analytics
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2021-01-20T14:49:59.000Z
CVE-2021-1998 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L).
Problem types: description: Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.
Affected products: vendor: Oracle Corporation
product: MySQL Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Published: 2021-01-20T14:49:59.000Z
CVE-2021-1999 
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: RAS subsystems). The supported version that is affected is 8.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to compromise Oracle ZFS Storage Appliance Kit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle ZFS Storage Appliance Kit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 5.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N).
Problem types: description: Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle ZFS Storage Appliance Kit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle ZFS Storage Appliance Kit accessible data.
Affected products: vendor: Oracle Corporation
product: Sun ZFS Storage Appliance Kit (AK) Software
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Published: 2021-01-20T14:50:00.000Z
CVE-2021-20001 
It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the user web shares (~/public_html), which could result in privilege escalation.
Problem types: description: insecure permissions
Affected products: vendor: Debian
product: debian-edu-config
Published: 2022-02-11T19:50:09.720Z
CVE-2021-20016 
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-02-03T20:35:14.000Z
CVE-2021-20017 
A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobody' user. This vulnerability impacts SMA100 version 10.2.0.5 and earlier.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: SonicWall
product: SMA100
Published: 2021-03-13T02:10:14.000Z
CVE-2021-20018 
A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability impacts SMA100 version 10.2.0.5 and earlier.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: SonicWall
product: SMA100
Published: 2021-03-13T02:10:15.000Z
CVE-2021-20019 
A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: SonicWall
product: SonicOS
Published: 2021-06-23T21:45:11.000Z
CVE-2021-20020 
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: SonicWall
product: Global Management System (GMS)
Published: 2021-04-10T06:50:12.000Z
CVE-2021-20021 
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: SonicWall
product: Email Security
Published: 2021-04-09T17:50:14.000Z
CVE-2021-20022 
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: SonicWall
product: Email Security
Published: 2021-04-09T17:50:15.000Z
CVE-2021-20023 
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: SonicWall
product: Email Security
Published: 2021-04-20T11:55:13.000Z
CVE-2021-20024 
Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or potentially read sensitive information from the memory locations.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: SonicWall
product: SonicWall Switch
Published: 2021-07-09T21:25:09.000Z
CVE-2021-20025 
SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this transitional/temporary user account from the trusted domain to access the Virtual Appliance remotely only when the device is freshly installed and not connected to Mysonicwall.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: SonicWall
product: Email Security Virtual Appliance
Published: 2021-05-13T14:45:12.000Z
CVE-2021-20026 
A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP request. This vulnerability affects NSM On-Prem 2.2.0-R10 and earlier versions.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: SonicWall
product: SonicWall NSM On-Prem
Published: 2021-05-27T19:10:10.000Z
CVE-2021-20027 
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input
Affected products: vendor: SonicWall
product: SonicOS
Published: 2021-06-14T22:30:11.000Z
CVE-2021-20028 
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SonicWall
product: SonicWall SRA/SMA100
Published: 2021-08-04T19:10:09.000Z
CVE-2021-20030 
SonicWall GMS is vulnerable to file path manipulation resulting that an unauthenticated attacker can gain access to web directory containing application's binaries and configuration files.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Affected products: vendor: SonicWall
product: SonicWall GMS
Published: 2022-10-13T00:00:00.000Z
CVE-2021-20031 
A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: SonicWall
product: SonicOS
Published: 2021-10-12T22:55:09.000Z
CVE-2021-20032 
SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which potentially leads to Remote Code Execution. This vulnerability impacts Analytics On-Prem 2.5.2518 and earlier.
Problem types: cwe_id: CWE-16
description: CWE-16: Configuration
Affected products: vendor: SonicWall
product: SonicWall Analytics On-Prem
Published: 2021-08-10T23:05:11.000Z
CVE-2021-20034 
An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: SonicWall
product: SMA100
Published: 2021-09-27T17:20:10.000Z
CVE-2021-20035 
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: SonicWall
product: SMA100
Published: 2021-09-27T17:20:12.000Z
CVE-2021-20037 
SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalation which potentially allows command execution in the host operating system. This vulnerability impacts GVC 4.10.5 installer and earlier.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: SonicWall
product: SonicWall Global VPN Client
Published: 2021-09-21T08:50:11.000Z
CVE-2021-20038 
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-08T09:55:20.000Z
CVE-2021-20039 
Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-08T09:55:21.000Z
CVE-2021-20040 
A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-08T09:55:23.000Z
CVE-2021-20041 
An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles resulting in a loop with unreachable exit condition. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
Problem types: cwe_id: CWE-835
description: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-08T09:55:24.000Z
CVE-2021-20042 
An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
Problem types: cwe_id: CWE-441
description: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-08T09:55:25.000Z
CVE-2021-20043 
A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the nobody user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-08T09:55:27.000Z
CVE-2021-20044 
A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-08T09:55:28.000Z
CVE-2021-20045 
A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potentially execute code as the 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-08T09:55:29.000Z
CVE-2021-20046 
A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: SonicWall
product: SonicOS
Published: 2022-01-07T03:00:11.000Z
CVE-2021-20047 
SonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search Order Hijacking vulnerability. Successful exploitation via a local attacker could result in remote code execution in the target system.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: SonicWall
product: SonicWall Global VPN Client
Published: 2021-12-08T09:55:31.000Z
CVE-2021-20048 
A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: SonicWall
product: SonicOS
Published: 2022-01-07T03:00:12.000Z
CVE-2021-20049 
A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.
Problem types: cwe_id: CWE-204
description: CWE-204: Observable Response Discrepancy
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-23T01:20:09.000Z
CVE-2021-20050 
An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: SonicWall
product: SonicWall SMA100
Published: 2021-12-23T01:20:11.000Z
CVE-2021-20051 
SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability in one of the installer components. Successful exploitation via a local attacker could result in command execution in the target system.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: SonicWall
product: SonicWall Global VPN Client
Published: 2022-05-04T15:20:09.000Z
CVE-2021-20066 
JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: JSDom
Published: 2021-02-16T19:48:08.000Z
CVE-2021-20067 
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication.
Problem types: description: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: Racom MIDGE Firmware
Published: 2021-02-16T19:40:25.000Z
CVE-2021-20068 
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the error handling functionality of web pages.
Problem types: description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Racom MIDGE Firmware
Published: 2021-02-16T19:41:02.000Z
CVE-2021-20069 
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the regionalSettings.php dialogs.
Problem types: description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Racom MIDGE Firmware
Published: 2021-02-16T19:41:25.000Z
CVE-2021-20070 
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the virtualization.php dialogs.
Problem types: description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Racom MIDGE Firmware
Published: 2021-02-16T19:45:29.000Z
CVE-2021-20071 
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs.
Problem types: description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Racom MIDGE Firmware
Published: 2021-02-16T19:45:45.000Z
CVE-2021-20072 
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an authenticated directory traveral.
Problem types: description: Relative Path Traversal
Affected products: vendor: n/a
product: Racom MIDGE Firmware
Published: 2021-02-16T19:46:06.000Z