rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-41565 Tad TadTools - Reflected XSS
TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Tad
product: TadTools
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-10-08T15:15:35.097Z
CVE-2021-41566 Tad TadTools - Arbitrary File Upload
The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Tad
product: TadTools
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-08T15:15:36.568Z
CVE-2021-41567 Tad Uploader - Stored XSS
The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Tad
product: Uploader
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2021-10-08T15:15:38.115Z
CVE-2021-41568 Tad Web - Improper Authorization
Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Tad
product: Tad Web
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-10-08T15:15:39.583Z
CVE-2021-41569 
SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro. Users can escape the context of the configured user-controllable variable and append additional functions native to the macro but not included as variables within the library. This includes a function that retrieves files from the host OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-19T17:14:10.000Z
CVE-2021-41570 
Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field during a Settings/Configuration Add operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-19T12:38:27.000Z
CVE-2021-41571 Pulsar Admin API allows access to data from other tenants using getMessageById API
In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Apache Software Foundation
product: Apache Pulsar
Published: 2022-02-01T12:40:53.000Z
CVE-2021-41573 
Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure. If authenticated user creates a link to a file or folder while the system was running version 4.3.x or earlier and then shares the link and then later deletes the file or folder without deleting the link and before the link expires. If the system has been upgraded to version 4.4.5 or 4.5.0 a malicious user with the link could browse and download all files of the authenticated user that created the link .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2021-09-29T17:50:13.000Z
CVE-2021-41578 
mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T17:38:23.000Z
CVE-2021-41579 
LCDS LAquis SCADA through 4.3.1.1085 is vulnerable to a control bypass and path traversal. If an attacker can get a victim to load a malicious els project file and use the play feature, then the attacker can bypass a consent popup and write arbitrary files to OS locations where the user has permission, leading to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T17:32:16.000Z
CVE-2021-41580 
The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T06:11:20.000Z
CVE-2021-41581 
x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-24T02:12:33.000Z
CVE-2021-41583 
vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS filesystem access, because of the interaction of QR codes with an exec that uses the -r option. This can be leveraged to obtain additional VPN access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-24T02:22:03.000Z
CVE-2021-41584 
Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-24T02:57:12.000Z
CVE-2021-41585 ATS stops accepting connections on FreeBSD
Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections. This issue affects Apache Traffic Server 5.0.0 to 9.1.0.
Problem types: description: cwe
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Credits: lang: en
value: Apache Traffic Server would like to thank Asbjorn Bjornstad for finding this issue.
Published: 2021-11-03T15:20:25.000Z
CVE-2021-41586 
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-24T14:18:53.000Z
CVE-2021-41587 
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-24T14:18:43.000Z
CVE-2021-41588 
In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-24T14:18:31.000Z
CVE-2021-41589 
In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymous write access to the build cache. If access control to the build cache is not changed from the default open configuration, a malicious actor with network access can populate the cache with manipulated entries that may execute malicious code as part of a build process. This applies to the build cache provided with Gradle Enterprise and the separate build cache node service if used. If access control to the user interface is not changed from the default open configuration, a malicious actor can undo build cache access control in order to populate the cache with manipulated entries that may execute malicious code as part of a build process. This does not apply to the build cache provided with Gradle Enterprise, but does apply to the separate build cache node service if used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T13:31:01.000Z
CVE-2021-41590 
In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installation configuration user interface available to administrators allows testing the configured SMTP server settings. This test function can be used to identify the listening TCP ports available to the server, revealing information about the internal network environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T13:20:17.000Z
CVE-2021-41591 
ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T16:47:56.000Z
CVE-2021-41592 
Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T16:58:55.000Z
CVE-2021-41593 
Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T16:54:36.000Z
CVE-2021-41594 
In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieves access to the precluded functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T23:33:34.000Z
CVE-2021-41595 
SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T16:46:08.000Z
CVE-2021-41596 
SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T16:48:19.000Z
CVE-2021-41597 
SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-12T19:17:05.000Z
CVE-2021-41598 UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. All permissions being granted would properly be shown during the first authorization, but if the user later updated the set of repositories the app was installed on after the GitHub App had configured additional user-level permissions, those additional permissions would not be displayed, leading to more permissions being granted than the user potentially intended. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.2.5, 3.1.13, 3.0.21. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-451
description: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: Vaibhav Singh (vaib25vicky)
Published: 2022-01-25T19:45:12.000Z
CVE-2021-41599 Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.21, 3.1.13, 3.2.5. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-77
description: CWE-77, CWE-691, CWE-459
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: yvvdwf
Published: 2022-02-17T23:35:12.000Z
CVE-2021-41608 
A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve survey user submitted data by modifying the value of the ID parameter in sequential order beginning from 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T18:02:53.000Z
CVE-2021-41609 
SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve data from the application's backend database via boolean-based blind and UNION injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T18:02:50.000Z
CVE-2021-41611 
An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T08:56:16.000Z
CVE-2021-41612 
An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract instruction, which results in an incorrect value of the carry flag. Any software that relies on this flag may experience corruption in execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-18T00:00:00.000Z
CVE-2021-41613 
An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EEAR) is not implemented correctly. User programs from authorized privilege levels will be unable to write to EEAR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-18T00:00:00.000Z
CVE-2021-41614 
An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program Counter Register (EPCR) are not implemented correctly. User programs from an unauthorized privilege level can make read/write accesses to EPCR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-18T00:00:00.000Z
CVE-2021-41615 
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-08T18:26:11.000Z
CVE-2021-41616 Apache ddlutils 1.0 readobject vulnerability
Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used ObjectInputStream.readObject without validating that the input data was safe to deserialize. Please note that DdlUtils is no longer being actively developed. To address the insecurity of the BinaryObjectHelper class, the following changes to DdlUtils have been made: (1) BinaryObjectsHelper.java has been deleted from the DdlUtils source repository and the DdlUtils feature of propagating data of SQL binary types is therefore no longer present in DdlUtils; (2) The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure; (3) The DdlUtils web site has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache DB ddlutils
Published: 2021-09-30T07:55:11.000Z
CVE-2021-41617 
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-26T00:00:00.000Z
CVE-2021-41619 
An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installation configuration user interface (available to administrators) allows specifying arbitrary Java Virtual Machine startup options. Some of these options, such as -XX:OnOutOfMemoryError, allow specifying a command to be run on the host. This can be abused to run arbitrary commands on the host, should an attacker gain administrative access to the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T13:24:37.000Z
CVE-2021-41634 
A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T11:46:52.000Z
CVE-2021-41635 
When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities with administrative access over the entire host system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T11:46:04.000Z
CVE-2021-41636 
MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T11:45:10.000Z
CVE-2021-41637 
Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T11:44:42.000Z
CVE-2021-41638 
The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T11:44:02.000Z
CVE-2021-41639 
MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T11:43:34.000Z
CVE-2021-41641 
Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-12T12:12:08.000Z
CVE-2021-41643 
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-29T16:50:45.000Z
CVE-2021-41644 
Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image upload filters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-29T16:55:52.000Z
CVE-2021-41645 
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a remote malicious user to inject arbitrary code via the image upload field. .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-29T16:59:32.000Z