deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27330
Published: 2021-02-25
Description: Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/161570/Triconsole-3.75-Cross-Site-Scripting.html; http://www.triconsole.com/; http://www.triconsole.com/php/calendar_datepicker.php
CVE: CVE-2020-27543
Published: 2021-02-25
Description: The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://github.com/paulvarache/restify-paginate/; https://github.com/secoats/cve/tree/master/CVE-2020-27543_dos_restify-paginate; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-20327
Published: 2021-02-25
Description: A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption. This issue affect MongoDB Node.js Driver mongodb-client-encryption module version 1.2.0
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://jira.mongodb.org/browse/NODE-3125; https://jira.mongodb.org/browse/NODE-3125
CVE: CVE-2021-20328
Published: 2021-02-25
Description: Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://jira.mongodb.org/browse/JAVA-4017; https://jira.mongodb.org/browse/JAVA-4017
CVE: CVE-2021-20203
Published: 2021-02-25
Description: An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
CVSS Score: 3.2 (LOW)
CWE: CWE-190, CWE-190
References: https://bugs.launchpad.net/qemu/+bug/1913873; https://bugzilla.redhat.com/show_bug.cgi?id=1922441; https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html
CVE: CVE-2021-3406
Published: 2021-02-25
Description: A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347, CWE-295
References: https://bugzilla.redhat.com/show_bug.cgi?id=1932469; https://github.com/keylime/keylime/security/advisories/GHSA-78f8-6c68-375m; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YAWKEF2LVXUME266T6RNRVBGAD375QAT/
CVE: CVE-2018-3633
Published: 2021-02-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-17162
Published: 2021-02-25
Description: Microsoft Windows Security Feature Bypass Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17162; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17162
CVE: CVE-2021-1639
Published: 2021-02-25
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1639; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1639
CVE: CVE-2021-1698
Published: 2021-02-25
Description: Windows Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1698; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1698
CVE: CVE-2021-1721
Published: 2021-02-25
Description: .NET Core and Visual Studio Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1721; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1721
CVE: CVE-2021-1722
Published: 2021-02-25
Description: Windows Fax Service Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1722; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1722
CVE: CVE-2021-1724
Published: 2021-02-25
Description: Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1724; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1724
CVE: CVE-2021-1726
Published: 2021-02-25
Description: Microsoft SharePoint Server Spoofing Vulnerability
CVSS Score: 8.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1726; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1726
CVE: CVE-2021-1727
Published: 2021-02-25
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1727; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1727
CVE: CVE-2021-1728
Published: 2021-02-25
Description: System Center Operations Manager Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1728; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1728
CVE: CVE-2021-1730
Published: 2021-02-25
Description: <p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p>
<p>This update addresses this vulnerability.</p>
<p>To prevent these types of attacks, Microsoft recommends customers to download inline images from different DNSdomains than the rest of OWA. Please see further instructions in the FAQ to put in place this mitigations.</p>
CVSS Score: 5.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1730; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1730
CVE: CVE-2021-1731
Published: 2021-02-25
Description: PFX Encryption Security Feature Bypass Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1731; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1731
CVE: CVE-2021-1732
Published: 2021-02-25
Description: Windows Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/161880/Win32k-ConsoleControl-Offset-Confusion.html; http://packetstormsecurity.com/files/166169/Win32k-ConsoleControl-Offset-Confusion-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1732
CVE: CVE-2021-1733
Published: 2021-02-25
Description: Sysinternals PsExec Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1733; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1733
CVE: CVE-2021-1734
Published: 2021-02-25
Description: Windows Remote Procedure Call Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1734; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1734
CVE: CVE-2021-24066
Published: 2021-02-25
Description: Microsoft SharePoint Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24066; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24066
CVE: CVE-2021-24067
Published: 2021-02-25
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24067; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24067
CVE: CVE-2021-24068
Published: 2021-02-25
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24068; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24068
CVE: CVE-2021-24069
Published: 2021-02-25
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24069; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24069
CVE: CVE-2021-24070
Published: 2021-02-25
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24070; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24070
CVE: CVE-2021-24071
Published: 2021-02-25
Description: Microsoft SharePoint Information Disclosure Vulnerability
CVSS Score: 5.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24071; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24071
CVE: CVE-2021-24072
Published: 2021-02-25
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24072; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24072
CVE: CVE-2021-24073
Published: 2021-02-25
Description: Skype for Business and Lync Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24073; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24073
CVE: CVE-2021-24074
Published: 2021-02-25
Description: Windows TCP/IP Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24074; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24074
CVE: CVE-2021-24075
Published: 2021-02-25
Description: Microsoft Windows VMSwitch Denial of Service Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24075; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24075
CVE: CVE-2021-24076
Published: 2021-02-25
Description: Microsoft Windows VMSwitch Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24076; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24076
CVE: CVE-2021-24077
Published: 2021-02-25
Description: Windows Fax Service Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24077; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24077
CVE: CVE-2021-24078
Published: 2021-02-25
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24078; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24078
CVE: CVE-2021-24079
Published: 2021-02-25
Description: Windows Backup Engine Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24079; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24079
CVE: CVE-2021-24080
Published: 2021-02-25
Description: Windows Trust Verification API Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24080; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24080
CVE: CVE-2021-24081
Published: 2021-02-25
Description: Microsoft Windows Codecs Library Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24081; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24081
CVE: CVE-2021-24082
Published: 2021-02-25
Description: Microsoft.PowerShell.Utility Module WDAC Security Feature Bypass Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24082; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24082
CVE: CVE-2021-24083
Published: 2021-02-25
Description: Windows Address Book Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24083; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24083
CVE: CVE-2021-24084
Published: 2021-02-25
Description: Windows Mobile Device Management Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24084; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24084
CVE: CVE-2021-24085
Published: 2021-02-25
Description: Microsoft Exchange Server Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24085; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24085
CVE: CVE-2021-24086
Published: 2021-02-25
Description: Windows TCP/IP Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/163499/Windows-TCP-IP-Denial-Of-Service.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24086; http://packetstormsecurity.com/files/163499/Windows-TCP-IP-Denial-Of-Service.html
CVE: CVE-2021-24087
Published: 2021-02-25
Description: Azure IoT CLI extension Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24087; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24087
CVE: CVE-2021-24088
Published: 2021-02-25
Description: Windows Local Spooler Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24088; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24088
CVE: CVE-2021-24091
Published: 2021-02-25
Description: Windows Camera Codec Pack Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/161713/Microsoft-Windows-WindowsCodecsRaw-COlympusE300LoadRaw-Out-Of-Bounds-Write.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24091; http://packetstormsecurity.com/files/161713/Microsoft-Windows-WindowsCodecsRaw-COlympusE300LoadRaw-Out-Of-Bounds-Write.html
CVE: CVE-2021-24092
Published: 2021-02-25
Description: Microsoft Defender Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24092; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24092
CVE: CVE-2021-24093
Published: 2021-02-25
Description: Windows Graphics Component Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/161582/Microsoft-DirectWrite-fsg_ExecuteGlyph-Buffer-Overflow.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24093; http://packetstormsecurity.com/files/161582/Microsoft-DirectWrite-fsg_ExecuteGlyph-Buffer-Overflow.html
CVE: CVE-2021-24094
Published: 2021-02-25
Description: Windows TCP/IP Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24094; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24094
CVE: CVE-2021-24096
Published: 2021-02-25
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24096; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24096
CVE: CVE-2021-24098
Published: 2021-02-25
Description: Windows Console Driver Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24098; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24098
CVE: CVE-2021-24099
Published: 2021-02-25
Description: Skype for Business and Lync Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24099; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24099
CVE: CVE-2021-24100
Published: 2021-02-25
Description: Microsoft Edge for Android Information Disclosure Vulnerability
CVSS Score: 5.0 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24100; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24100
CVE: CVE-2021-24101
Published: 2021-02-25
Description: Microsoft Dataverse Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24101; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24101
CVE: CVE-2021-24102
Published: 2021-02-25
Description: Windows Event Tracing Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24102; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24102
CVE: CVE-2021-24103
Published: 2021-02-25
Description: Windows Event Tracing Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24103; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24103
CVE: CVE-2021-24105
Published: 2021-02-25
Description: <p>Depending on configuration of various package managers it is possible for an attacker to insert a malicious package into a package manager's repository which can be retrieved and used during development, build, and release processes. This insertion could lead to remote code execution. We believe this vulnerability affects multiple package managers across multiple languages, including but not limited to: Python/pip, .NET/NuGet, Java/Maven, JavaScript/npm.</p>
<p><strong>Attack scenarios</strong></p>
<p>An attacker could take advantage of this ecosystem-wide issue to cause harm in a variety of ways. The original attack scenarios were discovered by Alex Birsan and are detailed in their whitepaper, <a href="https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610">Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies</a>.</p>
<ul>
<li><p>With basic knowledge of the target ecosystems, an attacker could create an empty shell for a package and insert malicious code in the install scripts, give it a high version, and publish it to the public repository. Vulnerable victim machines will download the higher version of the package between the public and private repositories and attempt to install it. Due to code incompatibility it will probably error out upon import or upon compilation, making it easier to detect; however the attacker would have gained code execution by that point.</p>
</li>
<li><p>An advanced attacker with some inside knowledge of the target could take a copy of a working package, insert the malicious code (in the package itself or in the install), and then publish it to a public repository. The package will likely install and import correctly, granting the attacker an initial foothold and persistence.</p>
</li>
</ul>
<p>These two methods could affect target organizations at any of these various levels:</p>
<ul>
<li>Developer machines</li>
<li>An entire team if the configuration to import the malicious package is uploaded to a code repository</li>
<li>Continuous integration pipelines if they pull the malicious packages during the build, test, and/or deploy stages</li>
<li>Customers, download servers, production services if the malicious code has not been detected</li>
</ul>
<p>This remote code execution vulnerability can only be addressed by reconfiguring installation tools and workflows, and not by correcting anything in the package repositories themselves. See the <strong>FAQ</strong> section of this CVE for configuration guidance.</p>
CVSS Score: 8.4 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24105; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24105
CVE: CVE-2021-24106
Published: 2021-02-25
Description: Windows DirectX Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24106; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24106
CVE: CVE-2021-24109
Published: 2021-02-25
Description: Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24109; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24109