rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-39080 
Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used. IBM X-Force ID: 215593.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics Mobile
Published: 2022-02-14T17:30:14.400Z
CVE-2021-39081 IBM Cognos Analytics Mobile information disclosure
IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: IBM
product: Cognos Analytics Mobile for Android
cpes: cpe:2.3:a:ibm:cognos_analytics_mobile:1.1.14:*:*:*:*:android:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-12-19T00:22:15.460Z
CVE-2021-39082 
IBM UrbanCode Deploy (UCD) 7.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2022-04-29T16:00:16.386Z
CVE-2021-39085 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 215888.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2022-08-16T18:45:33.266Z
CVE-2021-39086 
IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 215889.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling File Gateway
Published: 2022-08-16T18:45:48.196Z
CVE-2021-39087 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow an authenticated user to obtain sensitive information due to improper permission controls. IBM X-Force ID: 216109.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2022-08-16T18:46:04.273Z
CVE-2021-39088 
IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unknown vulnerabilities then privilege escalation could be performed. IBM X-Force ID: 216111.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2022-07-28T22:15:13.524Z
CVE-2021-39089 IBM Cloud Pak for Security information disclosure
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request.  IBM X-Force ID:  216387.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: IBM
product: Cloud Pak for Security
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-01-20T18:14:59.231Z
CVE-2021-39090 IBM Cloud Pak for Security information disclosure
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  216388.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: IBM
product: Cloud Pak for Security
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-02-29T02:35:40.645Z
CVE-2021-39109 
The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.
Problem types: description: Path Traversal
Affected products: vendor: Atlassian
product: Atlasboard
Published: 2021-09-01T05:20:10.119Z
CVE-2021-39111 
The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such as from a PDF when pasted into a field such as the description field.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-08-30T06:30:15.787Z
CVE-2021-39112 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1.
Problem types: cwe_id: CWE-1022
description: CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-08-25T02:30:10.338Z
CVE-2021-39113 
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0.
Problem types: description: Broken Access Control
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-08-30T06:30:17.310Z
CVE-2021-39114 
Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
Problem types: description: Remote Code Execution
Affected products: vendor: Atlassian
product: Confluence Server
vendor: Atlassian
product: Confluence Data Center
Published: 2022-04-05T04:00:18.966Z
CVE-2021-39115 
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.
Problem types: cwe_id: CWE-96
description: CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Affected products: vendor: Atlassian
product: Jira Service Desk Server
vendor: Atlassian
product: Jira Service Desk Data Center
Published: 2021-09-01T23:00:09.591Z
CVE-2021-39116 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF Image Reader component. The affected versions are before version 8.13.14, and from version 8.14.0 before 8.19.0.
Problem types: description: Denial of Service
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-09-08T00:05:10.122Z
CVE-2021-39117 
The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-08-30T06:30:18.840Z
CVE-2021-39118 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the /rest/api/1.0/render endpoint. The affected versions are before version 8.19.0.
Problem types: description: User Enumeration
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-09-14T04:55:09.602Z
CVE-2021-39119 
Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is revoked, via a Broken Access Control vulnerability in the issue notification feature. The affected versions are before version 8.19.0.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-09-01T22:50:08.590Z
CVE-2021-39121 
Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from version 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-09-08T01:45:10.564Z
CVE-2021-39122 
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-09-08T02:05:10.176Z
CVE-2021-39123 
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the /rest/gadget/1.0/createdVsResolved/generate endpoint. The affected versions are before version 8.16.0.
Problem types: description: Denial of Service
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-09-14T04:30:10.955Z
CVE-2021-39124 
The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able to trick a user into retrying a request to bypass CSRF protection and replay a crafted request.
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-09-14T04:20:09.865Z
CVE-2021-39125 
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumeration vulnerability in the password reset page. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-09-14T06:15:09.714Z
CVE-2021-39126 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.
Problem types: description: Cross-Site Request Forgery (CSRF)
description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-10-21T02:45:15.829Z
CVE-2021-39127 
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-10-21T02:35:10.353Z
CVE-2021-39128 
Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira Server or Data Center are before version 8.13.12, and from version 8.14.0 before 8.19.1.
Problem types: cwe_id: CWE-1336
description: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: Atlassian
product: Jira Server
vendor: Atlassian
product: Jira Data Center
Published: 2021-09-16T05:20:10.512Z
CVE-2021-39131 Improper Handling of Unexpected Data Type in ced
ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a `Buffer` using `Buffer.isBuffer(obj)`.
Problem types: cwe_id: CWE-241
description: CWE-241: Improper Handling of Unexpected Data Type
Affected products: vendor: sonicdoe
product: ced
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-08-17T19:55:09.000Z
CVE-2021-39132 YAML deserialization can run untrusted code
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: rundeck
product: rundeck
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-08-30T19:35:10.000Z
CVE-2021-39133 Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: rundeck
product: rundeck
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-08-30T19:50:10.000Z
CVE-2021-39134 UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in their `package.json` file such as `"foo": "file:/some/path"`. Another package, `pwn-b` could define a dependency such as `FOO: "file:foo.tgz"`. On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above.
Problem types: cwe_id: CWE-61
description: CWE-61: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: npm
product: arborist
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2021-08-31T16:55:11.000Z
CVE-2021-39135 UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.
Problem types: cwe_id: CWE-61
description: CWE-61: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: npm
product: arborist
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2021-08-31T17:10:10.000Z
CVE-2021-39136 Cross-site scripting vulnerability in file upload
baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: baserproject
product: basercms
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2021-08-25T18:05:13.000Z
CVE-2021-39137 Consensus flaw during block processing in go-ethereum
go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming `v1.10.8` release. No workaround are available.
Problem types: cwe_id: CWE-436
description: CWE-436: Interpretation Conflict
Affected products: vendor: ethereum
product: go-ethereum
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-08-24T16:05:10.000Z