rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-22868 Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server
A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.1.8 and was fixed in 3.1.8, 3.0.16, and 2.22.22. This vulnerability was reported via the GitHub Bug Bounty program. This is the result of an incomplete fix for CVE-2021-22867.
Problem types: cwe_id: CWE-77
description: CWE-77: Command Injection - Generic
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: yvvdwf
Published: 2021-09-24T17:50:16.000Z
CVE-2021-22869 Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group
An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self-hosted runner groups for access control. A repository with access to one enterprise runner group could access all of the enterprise runner groups within the organization because of improper authentication checks during the request. This could cause code to be run unintentionally by the incorrect runner group. This vulnerability affected GitHub Enterprise Server versions from 3.0.0 to 3.0.15 and 3.1.0 to 3.1.7 and was fixed in 3.0.16 and 3.1.8 releases.
Problem types: cwe_id: CWE-668
description: CWE-668
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Published: 2021-09-24T17:50:10.000Z
CVE-2021-22870 Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read access
A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.19, 3.1.11, and 3.2.3. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-23
description: CWE-23
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: yvvdwf
Published: 2021-11-10T01:55:11.000Z
CVE-2021-22871 
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2021-01-21T19:15:11.000Z
CVE-2021-22872 
Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encode parameters were still vulnerable.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2021-01-21T19:15:02.000Z
CVE-2021-22873 
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.
Problem types: cwe_id: CWE-601
description: Open Redirect (CWE-601)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2021-01-21T19:14:44.000Z
CVE-2021-22874 
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2021-01-28T16:09:23.000Z
CVE-2021-22875 
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2021-01-28T16:12:14.000Z
CVE-2021-22876 
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.
Problem types: cwe_id: CWE-359
description: Privacy Violation (CWE-359)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2021-04-01T17:45:18.000Z
CVE-2021-22877 
A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2021-03-03T17:39:15.000Z
CVE-2021-22878 
Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2021-03-03T17:39:51.000Z
CVE-2021-22879 
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
Problem types: cwe_id: CWE-99
description: Resource Injection (CWE-99)
Affected products: vendor: n/a
product: Nextcloud Desktop Client
Published: 2021-04-14T12:41:24.000Z
CVE-2021-22880 
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2021-02-11T16:11:22.000Z
CVE-2021-22881 
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Problem types: cwe_id: CWE-601
description: Open Redirect (CWE-601)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2021-02-11T16:12:34.000Z
CVE-2021-22882 
UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protect controller to crash.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: UniFi Protect
Published: 2021-02-23T18:28:45.000Z
CVE-2021-22883 
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2021-03-03T17:38:32.000Z
CVE-2021-22884 
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
Problem types: cwe_id: CWE-350
description: Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2021-03-03T17:37:46.000Z
CVE-2021-22885 
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.
Problem types: cwe_id: CWE-209
description: Information Exposure Through an Error Message (CWE-209)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2021-05-27T11:15:32.000Z
CVE-2021-22886 
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2021-03-26T18:15:54.000Z
CVE-2021-22887 
A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: n/a
product: PSA5000, PSA7000
Published: 2021-03-16T15:04:37.000Z
CVE-2021-22888 
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2021-03-25T19:40:41.000Z
CVE-2021-22889 
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: https://github.com/revive-adserver/revive-adserver
Published: 2021-03-25T19:40:55.000Z
CVE-2021-22890 
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.
Problem types: cwe_id: CWE-300
description: Man-in-the-Middle (CWE-300)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2021-04-01T17:46:17.000Z
CVE-2021-22891 
A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1 and 5.11.18 may allow unauthenticated remote compromise of the Storage Zones Controller.
Problem types: cwe_id: CWE-862
description: Missing Authorization (CWE-862)
Affected products: vendor: n/a
product: Citrix ShareFile Storage Zones Controller
Published: 2021-05-27T11:15:16.000Z
CVE-2021-22892 
An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Rocket.Chat server
Published: 2021-05-27T11:14:43.000Z
CVE-2021-22893 
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2021-04-23T16:29:43.000Z
CVE-2021-22894 
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2021-05-27T11:15:11.000Z
CVE-2021-22895 
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation (CWE-295)
Affected products: vendor: n/a
product: Nextcloud Desktop Client
Published: 2021-06-11T15:49:38.000Z
CVE-2021-22896 
Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users.
Problem types: cwe_id: CWE-862
description: Missing Authorization (CWE-862)
Affected products: vendor: n/a
product: Nextcloud Mail
Published: 2021-06-11T15:49:38.000Z
CVE-2021-22897 
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
Problem types: cwe_id: CWE-840
description: Business Logic Errors (CWE-840)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2021-06-11T15:49:38.000Z
CVE-2021-22898 
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2021-06-11T15:49:37.000Z
CVE-2021-22899 
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2021-05-27T11:15:22.000Z
CVE-2021-22900 
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: Pulse Secure Secure
Published: 2021-05-27T11:15:27.000Z
CVE-2021-22901 
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2021-06-11T15:49:38.000Z
CVE-2021-22902 
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2021-06-11T15:49:38.000Z
CVE-2021-22903 
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.
Problem types: cwe_id: CWE-601
description: Open Redirect (CWE-601)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2021-06-11T15:49:38.000Z
CVE-2021-22904 
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2021-06-11T15:49:38.000Z
CVE-2021-22905 
Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud server unless a global search has been explicitly chosen by the user.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Nextcloud Android App (com.nextcloud.client)
Published: 2021-06-11T15:49:39.000Z
CVE-2021-22906 
Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock files of other users.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: Nextcloud End-to-End Encryption
Published: 2021-06-11T15:49:39.000Z
CVE-2021-22907 
An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 1912 LTSR prior to CU4.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Citrix Workspace App for Windows
Published: 2021-05-27T11:14:17.000Z
CVE-2021-22908 
A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.
Problem types: cwe_id: CWE-120
description: Classic Buffer Overflow (CWE-120)
Affected products: vendor: n/a
product: Pulse Connect Secure
Published: 2021-05-27T11:14:24.000Z
CVE-2021-22909 
A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later.
Problem types: cwe_id: CWE-300
description: Man-in-the-Middle (CWE-300)
Affected products: vendor: n/a
product: EdgeMAX EdgeRouter
Published: 2021-05-27T11:14:32.000Z
CVE-2021-22910 
A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE.
Problem types: cwe_id: CWE-75
description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)
Affected products: vendor: n/a
product: Rocket.Chat server
Published: 2021-08-09T12:27:46.000Z