rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-25675 
A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). An attacker with local access to the system could cause a Denial-of-Service condition in the application when it is used to open a specially crafted file. As a consequence, a divide by zero operation could occur and cause the application to terminate unexpectedly and must be restarted to restore the service.
Problem types: cwe_id: CWE-369
description: CWE-369: Divide By Zero
Affected products: vendor: Siemens
product: SIMATIC S7-PLCSIM V5.4
Published: 2021-03-15T17:03:31.000Z
CVE-2021-25676 
A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3). Multiple failed SSH authentication attempts could trigger a temporary Denial-of-Service under certain conditions. When triggered, the device will reboot automatically.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Siemens
product: RUGGEDCOM RM1224
vendor: Siemens
product: SCALANCE M-800
vendor: Siemens
product: SCALANCE S615
vendor: Siemens
product: SCALANCE SC-600
Published: 2021-03-15T17:03:31.000Z
CVE-2021-25677 
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions >= V0.5.0.0 < V1.0.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS client does not properly randomize DNS transaction IDs. That could allow an attacker to poison the DNS cache or spoof DNS resolving.
Problem types: cwe_id: CWE-330
description: CWE-330: Use of Insufficiently Random Values
Affected products: vendor: Siemens
product: APOGEE PXC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: Nucleus NET
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V3
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V3
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V4
default_status: unknown
vendor: Siemens
product: Nucleus Source Code
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
vendor: Siemens
product: TALON TC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: TALON TC Modular (BACnet)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2021-04-22T20:42:21.000Z
CVE-2021-25678 
A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions < SE2020MP14), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12529)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Solid Edge SE2020
vendor: Siemens
product: Solid Edge SE2020
vendor: Siemens
product: Solid Edge SE2021
Published: 2021-04-22T20:42:21.000Z
CVE-2021-25679 
The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version 10.8.1 was able to be confirmed during primary research. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-20T11:17:27.000Z
CVE-2021-25680 
The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version 10.8.1 was able to be confirmed during primary research. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-20T11:17:34.000Z
CVE-2021-25681 
AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-20T11:17:40.000Z
CVE-2021-25682 apport improperly parses /proc/pid/status
It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Canonical
product: apport
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Itai Greenhut
Published: 2021-06-11T02:20:19.233Z
CVE-2021-25683 apport improperly parses /proc/pid/stat
It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Canonical
product: apport
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Itai Greenhut
Published: 2021-06-11T02:20:19.881Z
CVE-2021-25684 apport can be stalled by reading a FIFO
It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Canonical
product: apport
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Itai Greenhut
Published: 2021-06-11T02:20:20.510Z
CVE-2021-25688 
Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21.01.0 may log parts of a user's password in the application logs.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: - PCoIP Standard Agent for Windows - PCoIP Standard Agent for Linux - PCoIP Graphics Agent for Windows - PCoIP Graphics Agent for Linux
Published: 2021-02-11T15:24:19.000Z
CVE-2021-25689 
An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remotely execute code.
Problem types: description: Out-Of-Bounds Write
Affected products: vendor: n/a
product: - PCoIP Soft Client for Windows - PCoIP Soft Client for Linux - PCoIP Soft Client for OSX
Published: 2021-02-11T15:22:29.000Z
CVE-2021-25690 
A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the software.
Problem types: description: Null Pointer Dereference
Affected products: vendor: n/a
product: - PCoIP Soft Client for Windows - PCoIP Soft Client for Linux - PCoIP Soft Client for OSX
Published: 2021-02-11T15:19:57.000Z
CVE-2021-25692 
Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.3.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Teradici PCoIP Connection Manager and Security Gateway
Published: 2021-04-06T19:21:50.000Z
CVE-2021-25693 
An attacker may cause a Denial of Service (DoS) in multiple versions of Teradici PCoIP Agent via a null pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-13T13:20:52.000Z
CVE-2021-25694 
Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. An attacker could replace the .dll and redirect pixels elsewhere.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-13T12:49:17.000Z
CVE-2021-25695 
The USB vHub in the Teradici PCOIP Software Agent prior to version 21.07.0 would accept commands from any program, which may allow an attacker to elevate privileges by changing the flow of program execution within the vHub driver.
Problem types: cwe_id: CWE-782
description: Exposed IOCTL with Insufficient Access Control (CWE-782)
Affected products: vendor: n/a
product: - PCoIP Agent for Windows
Published: 2021-07-21T12:33:10.000Z
CVE-2021-25698 
The OpenSSL component of the Teradici PCoIP Standard Agent prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attacker to elevate to the privileges of the running process via placing a specially crafted dll in a build configuration directory.
Problem types: cwe_id: CWE-426
description: Untrusted Search Path (CWE-426)
Affected products: vendor: n/a
product: - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client
Published: 2021-07-21T12:26:55.000Z
CVE-2021-25699 
The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attacker to elevate to the privileges of the running process via placing a specially crafted dll in a build configuration directory.
Problem types: cwe_id: CWE-426
description: Untrusted Search Path (CWE-426)
Affected products: vendor: n/a
product: - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client
Published: 2021-07-21T12:26:47.000Z
CVE-2021-25701 
The fUSBHub driver in the PCoIP Software Client prior to version 21.07.0 had an error in object management during the handling of a variety of IOCTLs, which allowed an attacker to cause a denial of service.
Problem types: cwe_id: CWE-400
description: Uncontrolled Resource Consumption (CWE-400)
Affected products: vendor: n/a
product: - PCoIP Software Client
Published: 2021-07-21T12:37:39.000Z
CVE-2021-25735 Validating Admission Webhook does not observe some previous fields
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
Problem types: cwe_id: CWE-372
description: CWE-372 Incomplete Internal State Distinction
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Rogerio Bastos & Ari Lima
Published: 2021-09-06T11:32:00.853Z
CVE-2021-25736 Windows kube-proxy LoadBalancer contention
Kube-proxy
 on Windows can unintentionally forward traffic to local processes 
listening on the same port (“spec.ports[*].port”) as a LoadBalancer 
Service when the LoadBalancer controller
 does not set the “status.loadBalancer.ingress[].ip” field. Clusters 
where the LoadBalancer controller sets the 
“status.loadBalancer.ingress[].ip” field are unaffected.
Affected products: vendor: Kubernetes
product: Kubernetes
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Eric Paris
lang: en
value: Christian Hernandez
Published: 2023-10-30T02:19:48.916Z
CVE-2021-25737 Holes in EndpointSlice Validation Enable Host Network Hijack
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
Problem types: cwe_id: CWE-184
description: CWE-184 Incomplete Blacklist
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: John Howard
Published: 2021-09-06T11:32:01.989Z
CVE-2021-25738 Code exec via yaml parsing
Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Kubernetes
product: Kubernetes Java Client
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jordy Versmissen
Published: 2021-10-11T18:55:10.100Z
CVE-2021-25740 Holes in EndpointSlice Validation Enable Host Network Hijack
A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.
Problem types: cwe_id: CWE-441
description: CWE-441 Unintended Proxy or Intermediary
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Rob Scott
Published: 2021-09-20T17:05:18.065Z
CVE-2021-25741 Symlink Exchange Can Allow Host Filesystem Access
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Fabricio Voznika & Mark Wolters
Published: 2021-09-20T17:05:21.097Z
CVE-2021-25742 Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Kubernetes
product: Kubernetes ingress-nginx
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Mitch Hulscher
Published: 2021-10-29T04:05:10.713Z
CVE-2021-25743 ANSI escape characters in kubectl output are not being filtered
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
Problem types: cwe_id: CWE-150
description: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Eviatar Gerzi
Published: 2022-01-07T00:00:12.399Z
CVE-2021-25745 Ingress-nginx path can be pointed to service account token file
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Kubernetes
product: Kubernetes ingress-nginx
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Gafnit Amiga
Published: 2022-05-06T00:50:14.042Z
CVE-2021-25746 Ingress-nginx directive injection via annotations
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Kubernetes
product: Kubernetes ingress-nginx
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Anthony Weems
lang: en
value: jeffrey&oliver
Published: 2022-05-06T00:50:15.541Z
CVE-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Kubernetes
product: Kubernetes ingress-nginx
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
Credits: lang: en
value: Gafnit Amiga
Published: 2023-05-24T00:00:00.000Z
CVE-2021-25749 runAsNonRoot logic bypass for Windows containers
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Mark Rosetti (@marosset) of Microsoft
Published: 2023-05-24T00:00:00.000Z
CVE-2021-25755 
In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:13:49.000Z
CVE-2021-25756 
In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:14:55.000Z
CVE-2021-25757 
In JetBrains Hub before 2020.1.12629, an open redirect was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:17:03.000Z
CVE-2021-25758 
In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:16:13.000Z
CVE-2021-25759 
In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:17:43.000Z
CVE-2021-25760 
In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:18:26.000Z
CVE-2021-25761 
In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:21:13.000Z
CVE-2021-25762 
In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:24:26.000Z
CVE-2021-25763 
In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:22:06.000Z
CVE-2021-25764 
In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T19:20:02.000Z