rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-3725 OS Command Injection in ohmyzsh/ohmyzsh
Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: ohmyzsh
product: ohmyzsh/ohmyzsh
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-30T09:30:14.000Z
CVE-2021-3726 OS Command Injection in ohmyzsh/ohmyzsh
# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. **Fixed in**: [a263cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: ohmyzsh
product: ohmyzsh/ohmyzsh
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-30T09:30:15.000Z
CVE-2021-3727 OS Command Injection in ohmyzsh/ohmyzsh
# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: ohmyzsh
product: ohmyzsh/ohmyzsh
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-30T09:30:17.000Z
CVE-2021-3728 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: firefly-iii
product: firefly-iii/firefly-iii
Published: 2021-08-23T12:41:58.000Z
CVE-2021-3729 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: firefly-iii
product: firefly-iii/firefly-iii
Published: 2021-08-23T12:41:59.000Z
CVE-2021-3730 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: firefly-iii
product: firefly-iii/firefly-iii
Published: 2021-08-23T12:42:00.000Z
CVE-2021-3731 Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: ledgersmb
product: ledgersmb/ledgersmb
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Published: 2021-08-23T12:42:01.000Z
CVE-2021-3732 
A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible.
Problem types: cwe_id: CWE-200
description: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: kernel
Published: 2022-03-07T13:56:56.000Z
CVE-2021-3733 
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Problem types: cwe_id: CWE-400
description: CWE-400 - Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: python
Published: 2022-03-07T00:00:00.000Z
CVE-2021-3734 Improper Restriction of Rendered UI Layers or Frames in yourls/yourls
yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: yourls
product: yourls/yourls
Published: 2021-08-26T12:48:50.000Z
CVE-2021-3735 
A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-667
description: CWE-667 - Improper Locking -> CWE-400 - Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: QEMU
Published: 2022-08-26T15:25:40.000Z
CVE-2021-3736 
A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information.
Problem types: cwe_id: CWE-200
description: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: kernel
Published: 2022-08-23T15:51:30.000Z
CVE-2021-3737 
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-835
description: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop'), CWE-400 - Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: python
Published: 2022-03-04T00:00:00.000Z
CVE-2021-3738 
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
Problem types: cwe_id: CWE-416
description: CWE-416 - Use After Free
Affected products: vendor: n/a
product: samba
Published: 2022-03-02T00:00:00.000Z
CVE-2021-3739 
A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-476
description: CWE-476 - NULL Pointer Dereference
Affected products: vendor: n/a
product: kernel
Published: 2022-03-07T15:19:47.000Z
CVE-2021-3740 Session Fixation in chatwoot/chatwoot
A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token.
Problem types: cwe_id: CWE-384
description: CWE-384 Session Fixation
Affected products: vendor: chatwoot
product: chatwoot/chatwoot
Published: 2024-11-15T10:57:09.236Z
CVE-2021-3741 Stored Cross-site Scripting (XSS) in chatwoot/chatwoot
A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed, leading to potential security risks.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: chatwoot
product: chatwoot/chatwoot
Published: 2024-11-15T10:51:22.667Z
CVE-2021-3742 Server-Side Request Forgery (SSRF) in chatwoot/chatwoot
A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentially leading to host redirection.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: chatwoot
product: chatwoot/chatwoot
Published: 2024-11-15T10:51:25.968Z
CVE-2021-3743 
An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-125
description: CWE-125 - Out-of-bounds Read
Affected products: vendor: n/a
product: Kernel
Published: 2022-03-04T15:52:55.000Z
CVE-2021-3744 
A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: kernel
Published: 2022-03-04T15:55:17.000Z
CVE-2021-3745 Unrestricted Upload of File with Dangerous Type in flatcore/flatcore-cms
flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: flatcore
product: flatcore/flatcore-cms
Published: 2021-10-28T17:05:12.000Z
CVE-2021-3746 
A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: libtpms
Published: 2021-10-19T14:07:43.000Z
CVE-2021-3747 MacOS version of Multipass incorrect owner for application directory
The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Canonical
product: Multipass
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Matthew Conway
Published: 2021-10-01T02:35:24.611Z
CVE-2021-3748 
A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.
Problem types: cwe_id: CWE-416
description: CWE-416 - Use After Free
Affected products: vendor: n/a
product: QEMU (virtio-net)
Published: 2022-03-23T19:46:40.000Z
CVE-2021-3749 Inefficient Regular Expression Complexity in axios/axios
axios is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: axios
product: axios/axios
Published: 2021-08-31T10:36:43.000Z
CVE-2021-3750 
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: QEMU
Published: 2022-05-02T18:48:12.000Z
CVE-2021-3751 Out-of-bounds Write in bfabiszewski/libmobi
libmobi is vulnerable to Out-of-bounds Write
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: bfabiszewski
product: bfabiszewski/libmobi
Published: 2021-09-15T06:40:10.000Z
CVE-2021-3752 
A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2022-02-16T18:35:34.000Z
CVE-2021-3753 
A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: kernel
Published: 2022-02-16T00:00:00.000Z
CVE-2021-3754 
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
Problem types: cwe_id: CWE-20
description: CWE-20 - Improper Input Validation
Affected products: vendor: n/a
product: keycloak
Published: 2022-08-26T15:25:40.000Z
CVE-2021-3756 Heap-based Buffer Overflow in hoene/libmysofa
libmysofa is vulnerable to Heap-based Buffer Overflow
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: hoene
product: hoene/libmysofa
Published: 2021-10-29T15:55:10.000Z
CVE-2021-3757 Prototype Pollution in immerjs/immer
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Problem types: cwe_id: CWE-1321
description: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: immerjs
product: immerjs/immer
Published: 2021-09-02T12:06:26.000Z
CVE-2021-3758 Server-Side Request Forgery (SSRF) in bookstackapp/bookstack
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: bookstackapp
product: bookstackapp/bookstack
Published: 2021-09-02T12:06:27.000Z
CVE-2021-3759 
A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-400
description: CWE-400 - Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: kernel
Published: 2022-08-23T00:00:00.000Z
CVE-2021-3760 
A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2022-02-16T18:35:29.000Z
CVE-2021-3761 OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
Problem types: description: Missing out of bounds check
Affected products: vendor: Cloudflare
product: octorpki
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Job Snijders
Published: 2021-09-09T14:05:09.349Z
CVE-2021-3762 
A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.
Problem types: cwe_id: CWE-22
description: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: n/a
product: quay/claircore
Published: 2022-03-03T21:41:19.000Z
CVE-2021-3763 
A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the role the user is assigned to should not be allow access to the management console. The main impact is to confidentiality as this flaw means some role bindings are incorrectly checked, some privileged meta information such as queue names and configuration details are disclosed but the impact is limited as not all information is accessible and there is no affect to integrity.
Problem types: cwe_id: CWE-863
description: CWE-863 - Incorrect Authorization
Affected products: vendor: n/a
product: AMQ Broker
Published: 2022-08-23T15:51:59.000Z
CVE-2021-3764 
A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.
Problem types: cwe_id: CWE-400
description: CWE-400 - Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: Linux Kernel
Published: 2022-08-23T15:52:14.000Z
CVE-2021-3765 Inefficient Regular Expression Complexity in validatorjs/validator.js
validator.js is vulnerable to Inefficient Regular Expression Complexity
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: validatorjs
product: validatorjs/validator.js
Published: 2021-11-02T07:05:10.000Z
CVE-2021-3766 Prototype Pollution in vincit/objection.js
objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Problem types: cwe_id: CWE-1321
description: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: vincit
product: vincit/objection.js
Published: 2021-09-06T11:17:16.000Z
CVE-2021-3767 Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: bookstackapp
product: bookstackapp/bookstack
Published: 2021-09-06T11:17:17.000Z
CVE-2021-3768 Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: bookstackapp
product: bookstackapp/bookstack
Published: 2021-09-06T11:17:18.000Z
CVE-2021-3769 OS Command Injection in ohmyzsh/ohmyzsh
# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability can be exploited. **Fixed in**: [b3ba9978](https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978). **Impacted areas**: - `pygmalion` theme. - `pygmalion-virtualenv` theme. - `refined` theme.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: ohmyzsh
product: ohmyzsh/ohmyzsh
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-30T09:30:18.000Z