alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-28098 (published 2021-04-14)
An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged location such as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this case, the Everyone group). The log file in System32 can be replaced and renamed with a malicious DLL for DLL hijacking.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-59
Affected vendors: forescout
Affected products: counteract
CVE-2021-28099 (published 2021-03-23)
In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-330
Affected vendors: netflix
Affected products: hollow
CVE-2021-28100 (published 2021-03-23)
Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: netflix
Affected products: priam
CVE-2021-28109 (published 2021-03-19)
TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: compassplus
Affected products: tranzware_fimi
CVE-2021-28110 (published 2021-03-19)
/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-611
Affected vendors: compassplus
Affected products: tranzware_e-commerce_payment_gateway
CVE-2021-28111 (published 2021-05-20)
Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: draeger
Affected products: x-dock_5300, x-dock_6300, x-dock_6600, x-dock_firmware
CVE-2021-28112 (published 2021-05-20)
Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an authenticated attacker.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: draeger
Affected products: x-dock_5300, x-dock_6300, x-dock_6600, x-dock_firmware
CVE-2021-28113 (published 2021-04-02)
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L)
Weakness: CWE-78
Affected vendors: okta
Affected products: access_gateway
CVE-2021-28114 (published 2021-07-16)
Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: froala
Affected products: froala_editor
CVE-2021-28115 (published 2021-03-09)
The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ougc_feedback_project
Affected products: ougc_feedback
CVE-2021-28116 (published 2021-03-09)
Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-125
Affected vendors: debian, fedoraproject, squid-cache
Affected products: debian_linux, fedora, squid
CVE-2021-28117 (published 2021-03-20)
libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: kde
Affected products: discover
CVE-2021-28119 (published 2021-03-09)
Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal API.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: twinkletray
Affected products: twinkle_tray
CVE-2021-28121 (published 2021-08-12)
Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: virtual_robots.txt_project
Affected products: virtual_robots.txt
CVE-2021-28122 (published 2021-03-10)
A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: open5gs
Affected products: open5gs
CVE-2021-28123 (published 2021-04-02)
Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. The ssh key can provide an attacker access to the linux system in the affected version.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1188
Affected vendors: cohesity
Affected products: cohesity_dataplatform
CVE-2021-28124 (published 2021-04-02)
A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. Missing server authentication in impacted versions can allow an attacker to Man-in-the-middle (MITM) support channel UI session to Cohesity DataPlatform cluster.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: cohesity
Affected products: cohesity_dataplatform
CVE-2021-28125 (published 2021-04-27)
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: apache
Affected products: superset
CVE-2021-28126 (published 2021-03-19)
index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: compassplus
Affected products: tranzware_e-commerce_payment_gateway
CVE-2021-28127 (published 2021-07-01)
An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-307
Affected vendors: stormshield
Affected products: stormshield_network_security
CVE-2021-28128 (published 2021-05-06)
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-640
Affected vendors: strapi
Affected products: strapi
CVE-2021-28129 (published 2021-10-07)
While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist. Users who installed the Apache OpenOffice 4.1.8 DEB packaging should upgrade to the latest version of Apache OpenOffice.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: apache
Affected products: openoffice
CVE-2021-28130 (published 2021-09-24)
Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate binary (e.g., frwl_svc.exe) bypasses firewall filters.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: drweb, microsoft
Affected products: security_space, windows
CVE-2021-28131 (published 2021-07-22)
Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the attacker is able to execute statements for which they don't have the necessary privileges otherwise. Impala deployments with Apache Sentry or Apache Ranger authorization enabled may be vulnerable to privilege escalation if an authenticated attacker is able to hijack a session or query from another authenticated user with privileges not assigned to the attacker. Impala deployments with audit logging enabled may be vulnerable to incorrect audit logging as a user could undertake actions that were logged under the name of a different authenticated user. Constructing an attack requires a high degree of technical sophistication and access to the Impala system as an authenticated user. Mitigation: If an Impala deployment uses Apache Sentry, Apache Ranger or audit logging, then users should upgrade to a version of Impala with the fix for IMPALA-10600. The Impala 4.0 release includes this fix. This hides session secrets from the logs to eliminate the risk of any attack using this mechanism. In lieu of an upgrade, restricting access to logs that expose secrets will reduce the risk of an attack. Restricting access to the Impala deployment to trusted users will also reduce the risk of an attack. Log redaction techniques can be used to redact secrets from the logs.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-288
Affected vendors: apache
Affected products: impala
CVE-2021-28132 (published 2021-03-11)
LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: lucysecurity
Affected products: security_awareness
CVE-2021-28133 (published 2021-03-18)
Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: zoom
Affected products: zoom
CVE-2021-28134 (published 2021-03-11)
Clipper before 1.0.5 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal API.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: clipper_project
Affected products: clipper
CVE-2021-28135 (published 2021-09-07)
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: espressif
Affected products: esp-idf
CVE-2021-28136 (published 2021-09-07)
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: espressif
Affected products: esp-idf, esp32
CVE-2021-28139 (published 2021-09-07)
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: espressif
Affected products: esp-idf, esp32
CVE-2021-28141 (published 2021-03-11)
An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This may allow the attacker to gain unauthorized access to the server and execute code. To exploit, one must use the parameter _TSM_HiddenField_ and inject a command at the end of the URI. NOTE: the vendor states that this is not a vulnerability. The request's output does not indicate that a "true" command was executed on the server, and the request's output does not leak any private source code or data from the server
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: progress
Affected products: telerik_ui_for_asp.net_ajax
CVE-2021-28142 (published 2021-04-06)
CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: citsmart
Affected products: citsmart
CVE-2021-28143 (published 2021-03-11)
/jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dlink
Affected products: dir-841, dir-841_firmware
CVE-2021-28144 (published 2021-03-11)
prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dlink
Affected products: dir-3060, dir-3060_firmware
CVE-2021-28145 (published 2021-03-18)
Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: concretecms
Affected products: concrete_cms
CVE-2021-28146 (published 2021-03-22)
The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team permissions that the user isn't supposed to have.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-863
Affected vendors: grafana
Affected products: grafana
CVE-2021-28147 (published 2021-03-22)
The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: grafana
Affected products: grafana
CVE-2021-28148 (published 2021-03-22)
One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-306
Affected vendors: grafana
Affected products: grafana
CVE-2021-28149 (published 2021-05-06)
Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: hongdian
Affected products: h8922, h8922_firmware
CVE-2021-28150 (published 2021-05-06)
Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via /backup2.cgi.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-425
Affected vendors: hongdian
Affected products: h8922, h8922_firmware
CVE-2021-28151 (published 2021-05-06)
Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the username guest and password guest.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: hongdian
Affected products: h8922, h8922_firmware
CVE-2021-28152 (published 2021-05-06)
Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is used on port 5188 with the default credentials of root:superzxmn.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: hongdian
Affected products: h8922, h8922_firmware
CVE-2021-28153 (published 2021-03-11)
An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-59
Affected vendors: broadcom, debian, fedoraproject, gnome
Affected products: brocade_fabric_operating_system_firmware, debian_linux, fedora, glib
CVE-2021-28154 (published 2021-03-11)
Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which manipulates the readFile and writeFile APIs. NOTE: the vendor states "The way we secured the app is that it does not allow any remote scripts to be opened, no unsafe scripts to be evaluated, no remote sites to be browsed.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-862
Affected vendors: camunda
Affected products: modeler
CVE-2021-28155 (published 2021-09-07)
The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown a device by flooding the target device with LMP Feature Response data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: jbl
Affected products: tune500bt, tune500bt_firmware
CVE-2021-28156 (published 2021-04-20)
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: hashicorp
Affected products: consul
CVE-2021-28157 (published 2021-04-14)
An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL commands via a username in api/security/userinfo/delete.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: devolutions
Affected products: devolutions_server
CVE-2021-28160 (published 2021-03-18)
Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /repeater.html page ("Repeater Wizard" homepage section).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: acexy_wireless-n_wifi_repeater_project
Affected products: acexy_wireless-n_wifi_repeater, acexy_wireless-n_wifi_repeater_firmware
CVE-2021-28161 (published 2021-03-12)
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eclipse
Affected products: theia
CVE-2021-28162 (published 2021-03-12)
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-830
Affected vendors: eclipse
Affected products: theia
CVE-2021-28163 (published 2021-04-01)
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: apache, eclipse, fedoraproject, netapp, oracle
Affected products: autovue_for_agile_product_lifecycle_management, banking_apis, banking_digital_experience, cloud_manager, communications_element_manager, communications_services_gatekeeper, communications_session_report_manager, communications_session_route_manager, e-series_performance_analyzer, e-series_santricity_os_controller, e-series_santricity_web_services, element_plug-in_for_vcenter_server, fedora, ignite, jetty, santricity_cloud_connector, siebel_core_-_automation, snapcenter, snapcenter_plug-in, solr, storage_replication_adapter_for_clustered_data_ontap, vasa_provider_for_clustered_data_ontap, virtual_storage_console
CVE-2021-28164 (published 2021-04-01)
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: eclipse, netapp, oracle
Affected products: autovue_for_agile_product_lifecycle_management, banking_apis, banking_digital_experience, cloud_manager, communications_session_route_manager, e-series_performance_analyzer, e-series_santricity_os_controller, e-series_santricity_web_services, element_plug-in_for_vcenter_server, jetty, santricity_cloud_connector, siebel_core_-_automation, snapcenter, snapcenter_plug-in, storage_replication_adapter_for_clustered_data_ontap, vasa_provider_for_clustered_data_ontap, virtual_storage_console
CVE-2021-28165 (published 2021-04-01)
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: eclipse, jenkins, netapp, oracle
Affected products: autovue_for_agile_product_lifecycle_management, cloud_manager, communications_cloud_native_core_policy, communications_element_manager, communications_services_gatekeeper, communications_session_report_manager, communications_session_route_manager, e-series_performance_analyzer, e-series_santricity_os_controller, e-series_santricity_storage, e-series_santricity_web_services, jenkins, jetty, ontap_tools, rest_data_services, santricity_cloud_connector, santricity_web_services_proxy, siebel_core_-_automation, snapcenter, storage_replication_adapter_for_clustered_data_ontap, vasa_provider_for_clustered_data_ontap
CVE-2021-28166 (published 2021-04-07)
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: eclipse
Affected products: mosquitto
CVE-2021-28167 (published 2021-04-21)
In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a user to call static methods or access static members without running the class initialization method, and may allow a user to observe uninitialized values.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-909
Affected vendors: eclipse
Affected products: openj9
CVE-2021-28168 (published 2021-04-22)
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-378
Affected vendors: eclipse, oracle
Affected products: communications_cloud_native_core_policy, communications_cloud_native_core_unified_data_repository, jersey
CVE-2021-28169 (published 2021-06-09)
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: debian, eclipse, netapp, oracle
Affected products: active_iq_unified_manager, communications_cloud_native_core_policy, debian_linux, hci, jetty, management_services_for_element_software, rest_data_services, snap_creator_framework
CVE-2021-28170 (published 2021-05-26)
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: eclipse, oracle, quarkus
Affected products: communications_cloud_native_core_policy, jakarta_expression_language, quarkus, weblogic_server
CVE-2021-28171 (published 2021-04-06)
The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data in the Cookie.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: deltaflow_project
Affected products: deltaflow
CVE-2021-28172 (published 2021-04-06)
There is a Path Traversal vulnerability in the file download function of Vangene deltaFlow E-platform. Remote attackers can access credential data with this leakage.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: deltaflow_project
Affected products: deltaflow
CVE-2021-28173 (published 2021-04-06)
The file upload function of Vangene deltaFlow E-platform does not perform access controlled properly. Remote attackers can upload and execute arbitrary files without login.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: deltaflow_project
Affected products: deltaflow
CVE-2021-28174 (published 2021-04-08)
Mitake smart stock selection system contains a broken authentication vulnerability. By manipulating the parameters in the URL, remote attackers can gain the privileged permissions to access transaction record, and fraudulent trading without login.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-287
Affected vendors: mitake
Affected products: smart_stock_selection
CVE-2021-28175 (published 2021-04-06)
The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28176 (published 2021-04-06)
The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28177 (published 2021-04-06)
The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28178 (published 2021-04-06)
The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28179 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28180 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28181 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28182 (published 2021-04-06)
The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28183 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Web License configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28184 (published 2021-04-06)
The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28185 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28186 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28187 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28188 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28189 (published 2021-04-06)
The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb8-ikvm, asmb8-ikvm_firmware, z10pe-d16_ws, z10pe-d16_ws_firmware, z10pr-d16, z10pr-d16_firmware
CVE-2021-28190 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Generate new certificate function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb9-ikvm, asmb9-ikvm_firmware, e700_g4, e700_g4_firmware, esc4000_dhd_g4, esc4000_dhd_g4_firmware, esc4000_g4, esc4000_g4_firmware, esc4000_g4x, esc4000_g4x_firmware, esc8000_g4, esc8000_g4\/10g, esc8000_g4\/10g_firmware, esc8000_g4_firmware, knpa-u16, knpa-u16_firmware, pro_e800_g4, pro_e800_g4_firmware, rs100-e10-pi2, rs100-e10-pi2_firmware, rs300-e10-ps4, rs300-e10-ps4_firmware, rs300-e10-rs4, rs300-e10-rs4_firmware, rs500-e9-ps4
CVE-2021-28191 (published 2021-04-06)
The Firmware update function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb9-ikvm, asmb9-ikvm_firmware, e700_g4, e700_g4_firmware, esc4000_dhd_g4, esc4000_dhd_g4_firmware, esc4000_g4, esc4000_g4_firmware, esc4000_g4x, esc4000_g4x_firmware, esc8000_g4, esc8000_g4\/10g, esc8000_g4\/10g_firmware, esc8000_g4_firmware, knpa-u16, knpa-u16_firmware, pro_e800_g4, pro_e800_g4_firmware, rs100-e10-pi2, rs100-e10-pi2_firmware, rs300-e10-ps4, rs300-e10-ps4_firmware, rs300-e10-rs4, rs300-e10-rs4_firmware, rs500-e9-ps4
CVE-2021-28192 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb9-ikvm, asmb9-ikvm_firmware, e700_g4, e700_g4_firmware, esc4000_dhd_g4, esc4000_dhd_g4_firmware, esc4000_g4, esc4000_g4_firmware, esc4000_g4x, esc4000_g4x_firmware, esc8000_g4, esc8000_g4\/10g, esc8000_g4\/10g_firmware, esc8000_g4_firmware, knpa-u16, knpa-u16_firmware, pro_e800_g4, pro_e800_g4_firmware, rs100-e10-pi2, rs100-e10-pi2_firmware, rs300-e10-ps4, rs300-e10-ps4_firmware, rs300-e10-rs4, rs300-e10-rs4_firmware, rs500-e9-ps4
CVE-2021-28193 (published 2021-04-06)
The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb9-ikvm, asmb9-ikvm_firmware, e700_g4, e700_g4_firmware, esc4000_dhd_g4, esc4000_dhd_g4_firmware, esc4000_g4, esc4000_g4_firmware, esc4000_g4x, esc4000_g4x_firmware, esc8000_g4, esc8000_g4\/10g, esc8000_g4\/10g_firmware, esc8000_g4_firmware, knpa-u16, knpa-u16_firmware, pro_e800_g4, pro_e800_g4_firmware, rs100-e10-pi2, rs100-e10-pi2_firmware, rs300-e10-ps4, rs300-e10-ps4_firmware, rs300-e10-rs4, rs300-e10-rs4_firmware, rs500-e9-ps4
CVE-2021-28194 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Remote image configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb9-ikvm, asmb9-ikvm_firmware, e700_g4, e700_g4_firmware, esc4000_dhd_g4, esc4000_dhd_g4_firmware, esc4000_g4, esc4000_g4_firmware, esc4000_g4x, esc4000_g4x_firmware, esc8000_g4, esc8000_g4\/10g, esc8000_g4\/10g_firmware, esc8000_g4_firmware, knpa-u16, knpa-u16_firmware, pro_e800_g4, pro_e800_g4_firmware, rs100-e10-pi2, rs100-e10-pi2_firmware, rs300-e10-ps4, rs300-e10-ps4_firmware, rs300-e10-rs4, rs300-e10-rs4_firmware, rs500-e9-ps4
CVE-2021-28195 (published 2021-04-06)
The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb9-ikvm, asmb9-ikvm_firmware, e700_g4, e700_g4_firmware, esc4000_dhd_g4, esc4000_dhd_g4_firmware, esc4000_g4, esc4000_g4_firmware, esc4000_g4x, esc4000_g4x_firmware, esc8000_g4, esc8000_g4\/10g, esc8000_g4\/10g_firmware, esc8000_g4_firmware, knpa-u16, knpa-u16_firmware, pro_e800_g4, pro_e800_g4_firmware, rs100-e10-pi2, rs100-e10-pi2_firmware, rs300-e10-ps4, rs300-e10-ps4_firmware, rs300-e10-rs4, rs300-e10-rs4_firmware, rs500-e9-ps4
CVE-2021-28196 (published 2021-04-06)
The specific function in ASUS BMC’s firmware Web management page (Generate SSL certificate function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb9-ikvm, asmb9-ikvm_firmware, e700_g4, e700_g4_firmware, esc4000_dhd_g4, esc4000_dhd_g4_firmware, esc4000_g4, esc4000_g4_firmware, esc4000_g4x, esc4000_g4x_firmware, esc8000_g4, esc8000_g4\/10g, esc8000_g4\/10g_firmware, esc8000_g4_firmware, knpa-u16, knpa-u16_firmware, pro_e800_g4, pro_e800_g4_firmware, rs100-e10-pi2, rs100-e10-pi2_firmware, rs300-e10-ps4, rs300-e10-ps4_firmware, rs300-e10-rs4, rs300-e10-rs4_firmware, rs500-e9-ps4
CVE-2021-28197 (published 2021-04-06)
The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb9-ikvm, asmb9-ikvm_firmware, e700_g4, e700_g4_firmware, esc4000_dhd_g4, esc4000_dhd_g4_firmware, esc4000_g4, esc4000_g4_firmware, esc4000_g4x, esc4000_g4x_firmware, esc8000_g4, esc8000_g4\/10g, esc8000_g4\/10g_firmware, esc8000_g4_firmware, knpa-u16, knpa-u16_firmware, pro_e800_g4, pro_e800_g4_firmware, rs100-e10-pi2, rs100-e10-pi2_firmware, rs300-e10-ps4, rs300-e10-ps4_firmware, rs300-e10-rs4, rs300-e10-rs4_firmware, rs500-e9-ps4
CVE-2021-28198 (published 2021-04-06)
The Firmware protocol configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: asus
Affected products: asmb9-ikvm, asmb9-ikvm_firmware, e700_g4, e700_g4_firmware, esc4000_dhd_g4, esc4000_dhd_g4_firmware, esc4000_g4, esc4000_g4_firmware, esc4000_g4x, esc4000_g4x_firmware, esc8000_g4, esc8000_g4\/10g, esc8000_g4\/10g_firmware, esc8000_g4_firmware, knpa-u16, knpa-u16_firmware, pro_e800_g4, pro_e800_g4_firmware, rs100-e10-pi2, rs100-e10-pi2_firmware, rs300-e10-ps4, rs300-e10-ps4_firmware, rs300-e10-rs4, rs300-e10-rs4_firmware, rs500-e9-ps4