Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-20314 State: PUBLISHED Published: 2021-08-12T14:37:09.000Z Last Updated: 2025-02-13T16:27:45.177Z Vendors: n/a Products: libspf2 Problem Types: stack buffer overflow Description: Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1993070 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMSFT2NJDZ7PATRZSQPAOGSE7JD6ELOB/ - https://lists.fedoraproject.org/archives/list/package
ists.fedoraproject.org/message/CMSFT2NJDZ7PATRZSQPAOGSE7JD6ELOB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJRHPE5OSCPTNA3ZZ4ORDHT4JQH3Y4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y6T4HYXXSUQCGJB2ES6X7Q74YYF7V7XU/ - https://security.gentoo.org/glsa/202401-22
CVE ID: CVE-2021-20315 State: PUBLISHED Published: 2022-02-18T00:00:00 Last Updated: 2024-08-03T17:37:23.718Z Vendors: n/a Products: gnome-shell Problem Types: CWE-667 Description: A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are enabled. This flaw allows a physical attacker who has access to a locked system to kill existing applications and start new ones as the locked user, even if the session is still locked. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2006285
CVE ID: CVE-2021-20316 State: PUBLISHED Published: 2022-08-23T00:00:00 Last Updated: 2024-08-03T17:37:23.673Z Vendors: n/a Products: samba Problem Types: CWE-362 Description: A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.samba.org/show_bug.cgi?id=14842 - https://www.samba.org/samba/security/CVE-2021-20316.html - https://bugzilla.redhat.com/show_bug.cgi?id=2009673 - https://access.redhat.com/security/cve/CVE-2021-20316 - https://security-tracker.debian
at.com/show_bug.cgi?id=2009673 - https://access.redhat.com/security/cve/CVE-2021-20316 - https://security-tracker.debian.org/tracker/CVE-2021-20316 - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2021-20317 State: PUBLISHED Published: 2021-09-27T10:34:49 Last Updated: 2024-08-03T17:37:23.839Z Vendors: n/a Products: kernel Problem Types: CWE-665 Description: A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1 - https://bugzilla.redhat.com/show_bug.cgi
ux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1 - https://bugzilla.redhat.com/show_bug.cgi?id=2005258 - https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
CVE ID: CVE-2021-20318 State: PUBLISHED Published: 2021-12-23T19:48:41 Last Updated: 2024-08-03T17:37:23.724Z Vendors: n/a Products: Artemis in EAP 7 Problem Types: CWE-502 Description: The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2010559
CVE ID: CVE-2021-20319 State: PUBLISHED Published: 2022-03-04T17:05:50 Last Updated: 2024-08-03T17:37:23.930Z Vendors: n/a Products: coreos-installer Problem Types: CWE-347 Description: An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2011862 - https://github.com
t Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2011862 - https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593 - https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89
CVE ID: CVE-2021-20320 State: PUBLISHED Published: 2022-02-18T17:50:43 Last Updated: 2024-08-03T17:37:23.807Z Vendors: n/a Products: kernel Problem Types: CWE-200 Description: A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2010090 - https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh%40anyfinetworks.com/
CVE ID: CVE-2021-20321 State: PUBLISHED Published: 2022-02-18T17:50:44 Last Updated: 2024-08-03T17:37:23.681Z Vendors: n/a Products: kernel Problem Types: CWE-362 Description: A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2013242 - https://lore.kernel.org/all/20211011134508.748956131%40linuxfoundation.org/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096
CVE ID: CVE-2021-20322 State: PUBLISHED Published: 2022-02-18T17:50:45 Last Updated: 2024-08-03T17:37:23.666Z Vendors: n/a Products: kernel Problem Types: CWE-330 Description: A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. Additional Analyst Notes: - CVE Program Container: Refe
n UDP source port randomization are indirectly affected as well. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2014230 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.15-rc6&id=4785305c05b25a242e5314cc821f54ade4c18810 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.15-rc6&id=6457378fe796815c973f631a1904e147d6ee33b1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/ipv4/route.c?h=v5.15-rc6&id=67d6d681e15b578c1725bad8ad079e05d1c48a8e - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/ipv6/route.c?h=v5.15-rc
ad079e05d1c48a8e - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/ipv6/route.c?h=v5.15-rc6&id=a00df2caffed3883c341d5685f830434312e4a43 - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220303-0002/
CVE ID: CVE-2021-20323 State: PUBLISHED Published: 2022-03-25T18:03:00 Last Updated: 2024-08-03T17:37:23.958Z Vendors: n/a Products: keycloak-services Problem Types: CWE-79 Description: A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2013577
CVE ID: CVE-2021-20324 State: REJECTED Published: 2022-04-18T16:20:43.903Z Last Updated: 2025-02-13T15:46:15.523Z Description: No description available.
CVE ID: CVE-2021-20325 State: PUBLISHED Published: 2022-02-18T17:50:47 Last Updated: 2024-08-03T17:37:23.945Z Vendors: n/a Products: httpd Problem Types: CWE-119 Description: Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd. Addi
25 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2017321
CVE ID: CVE-2021-20326 State: PUBLISHED Published: 2021-04-30T09:10:13.589111Z Last Updated: 2024-11-19T14:57:30.781Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-20 Description: A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-53929
CVE ID: CVE-2021-20327 State: PUBLISHED Published: 2021-02-25T16:25:11.455869Z Last Updated: 2024-09-16T19:24:34.117Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: MongoDB Inc. Products: MongoDB Node.js Driver mongodb-client-encryption module Problem Types: CWE-295 Description: A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This iss
etween the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption. This issue affect MongoDB Node.js Driver mongodb-client-encryption module version 1.2.0 A
’t use Field Level Encryption. This issue affect MongoDB Node.js Driver mongodb-client-encryption module version 1.2.0 Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/browse/NODE-3125
CVE ID: CVE-2021-20328 State: PUBLISHED Published: 2021-02-25T16:30:14.536970Z Last Updated: 2024-09-16T19:10:28.653Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: MongoDB Inc. Products: mongo-java-driver, mongodb-driver, mongodb-driver-sync, mongodb-driver-legacy Problem Types: CWE-295 Description: Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Le
ctive MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption. Additional Analyst Notes: - CVE Program Container: - C
ot impact driver workloads that don’t use Field Level Encryption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/JAVA-4017
CVE ID: CVE-2021-20329 State: PUBLISHED Published: 2021-06-10T16:30:11.055753Z Last Updated: 2024-09-16T22:55:51.498Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: MongoDB Inc. Products: MongoDB Go Driver Problem Types: CWE-1287 Description: Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mongodb/mongo-go-driv
cluding 1.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1
CVE ID: CVE-2021-20330 State: PUBLISHED Published: 2021-12-15T12:30:10.405212Z Last Updated: 2024-09-16T17:23:58.888Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-20 Description: An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ongoDB Server v4.4 versions prior to 4.4.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-36263
CVE ID: CVE-2021-20331 State: PUBLISHED Published: 2021-05-13T07:40:11.801146Z Last Updated: 2024-09-16T22:25:28.232Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: MongoDB Inc. Products: MongoDB C# Driver Problem Types: CWE-200 Description: Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related informat
"updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/CSHARP-3521
CVE ID: CVE-2021-20332 State: PUBLISHED Published: 2021-08-02T12:50:09.915270Z Last Updated: 2024-09-17T01:26:08.017Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: MongoDB Inc. Products: MongoDB Rust Driver Problem Types: CWE-200 Description: Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB
ote that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB Rust Driver version 2.0.0-alpha1 and MongoDB Rust Driver version 1.0.0 through to and including 1.2.1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/RUST-591
CVE ID: CVE-2021-20333 State: PUBLISHED Published: 2021-07-23T11:25:11.191597Z Last Updated: 2024-09-17T03:08:05.394Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-117 Description: Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.10. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-50605
CVE ID: CVE-2021-20334 State: PUBLISHED Published: 2021-04-06T16:45:20.154946Z Last Updated: 2024-09-17T01:25:58.140Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: MongoDB Inc. Products: MongoDB Compass Problem Types: CWE-269 Description: A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/bro
rior to 1.25.0 on Windows. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/browse/COMPASS-4510
CVE ID: CVE-2021-20335 State: PUBLISHED Published: 2021-02-11T10:10:13.856440Z Last Updated: 2024-09-17T01:50:44.645Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: MongoDB Inc. Products: MongoDB Ops Manager Problem Types: CWE-319 Description: For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB
isable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://docs.opsmanager.mongodb.com/v4.2/release-notes/application/#onprem-server-4-2-23
CVE ID: CVE-2021-20336 State: PUBLISHED Published: 2021-03-11T15:30:27.266924Z Last Updated: 2024-09-16T23:21:44.325Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AC:L/PR:L/AV:N/UI:N/I:L/S:C/C:L/A:N/E:H/RL:O/RC:C) Vendors: IBM Products: Tivoli Netcool/OMNIbus_GUI Problem Types: Cross-Site Scripting Description: IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6427953 - https
Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6427953 - https://exchange.xforce.ibmcloud.com/vulnerabilities/194350
CVE ID: CVE-2021-20337 State: PUBLISHED Published: 2021-07-26T12:10:34.395146Z Last Updated: 2024-09-17T00:35:53.266Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/S:U/PR:N/AV:N/UI:N/C:H/AC:H/I:N/A:N/RC:C/E:U/RL:O) Vendors: IBM Products: QRadar SIEM Problem Types: Obtain Information Description: IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 194448. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6474847 - https://exchange.xforce.ibmcloud.com/vulnerabilities/194448
CVE ID: CVE-2021-20338 State: PUBLISHED Published: 2021-06-02T20:40:39.803137Z Last Updated: 2024-09-16T16:27:29.563Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/PR:L/I:L/A:N/AC:L/UI:R/S:C/C:L/RL:O/E:H/RC:C) Vendors: IBM Products: Engineering Test Management, Rational Rhapsody Model Manager, Rational Quality Manager, Engineering Lifecycle Optimization, Rational Engineering Lifecycle Manager, Rational Collaborative Lifecycle Management, Rational DOORS Next Generation Problem Types: Cross-Site Scripting Description: IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering
to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194449. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6457739 - https://exchange.xforce.ibmcloud.com/vulnerabilities/194449
CVE ID: CVE-2021-20340 State: PUBLISHED Published: 2021-03-04T19:05:43.218269Z Last Updated: 2024-09-16T19:35:33.537Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/A:N/S:C/PR:L/AC:L/AV:N/C:L/I:L/UI:R/RC:C/E:H/RL:O) Vendors: IBM Products: Rational DOORS Next Generation, Engineering Lifecycle Optimization, Engineering Test Management, Rational Quality Manager, Engineering Workflow Management, Rational Team Concert Problem Types: Cross-Site Scripting Description: IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a tru
t code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194451. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6417585 - https://exchange.xforce.ibmcloud.com/vulnerabilities/194451