deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37910
Published: 2021-11-12
Description: ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.
CVSS Score: 3.7 (LOW)
CWE: CWE-799
References: https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html; https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html
CVE: CVE-2021-42773
Published: 2021-11-12
Description: Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, could allow a user to retrieve an arbitrary file from a remote host with the GetDumpFile command. In non-secure mode, the user is unauthenticated.
CVSS Score: 7.5 (HIGH)
References: https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf; https://www.broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager; https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf
CVE: CVE-2021-42774
Published: 2021-11-12
Description: Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer overflow vulnerability in the remote firmware download feature that could allow remote unauthenticated users to perform various attacks. In non-secure mode, the user is unauthenticated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf; https://www.broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager; https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf
CVE: CVE-2021-42775
Published: 2021-11-12
Description: Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a vulnerability in the remote firmware download feature that could allow a user to place or replace an arbitrary file on the remote host. In non-secure mode, the user is unauthenticated.
CVSS Score: 9.1 (CRITICAL)
References: https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf; https://www.broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager; https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf
CVE: CVE-2021-1903
Published: 2021-11-12
Description: Possible denial of service scenario can occur due to lack of length check on Channel Switch Announcement IE in beacon or probe response frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-1912
Published: 2021-11-12
Description: Possible integer overflow can occur due to improper length check while calculating count and grace period in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-1921
Published: 2021-11-12
Description: Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-1924
Published: 2021-11-12
Description: Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-203
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-1973
Published: 2021-11-12
Description: A FTM Diag command can allow an arbitrary write into modem OS space in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-1975
Published: 2021-11-12
Description: Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-1979
Published: 2021-11-12
Description: Possible buffer overflow due to improper validation of FTM command payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-1981
Published: 2021-11-12
Description: Possible buffer over read due to improper IE size check of Bearer capability IE in MT setup request from network in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-1982
Published: 2021-11-12
Description: Possible denial of service scenario due to improper input validation of received NAS OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-30254
Published: 2021-11-12
Description: Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-30255
Published: 2021-11-12
Description: Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-30259
Published: 2021-11-12
Description: Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-30263
Published: 2021-11-12
Description: Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-30264
Published: 2021-11-12
Description: Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-30265
Published: 2021-11-12
Description: Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-30266
Published: 2021-11-12
Description: Possible use after free due to improper memory validation when initializing new interface via Interface add command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-30284
Published: 2021-11-12
Description: Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-30321
Published: 2021-11-12
Description: Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2021-bulletin
CVE: CVE-2021-21699
Published: 2021-11-12
Description: Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2021/11/12/1; https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2219; http://www.openwall.com/lists/oss-security/2021/11/12/1
CVE: CVE-2021-21700
Published: 2021-11-12
Description: Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by exploitable by attackers able to create Scriptler scripts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2021/11/12/1; https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2406; http://www.openwall.com/lists/oss-security/2021/11/12/1
CVE: CVE-2021-21701
Published: 2021-11-12
Description: Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2021/11/12/1; https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2394; https://www.zerodayinitiative.com/advisories/ZDI-21-1313/
CVE: CVE-2021-43576
Published: 2021-11-12
Description: Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2021/11/12/1; https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2415; https://www.zerodayinitiative.com/advisories/ZDI-21-1314/
CVE: CVE-2021-43577
Published: 2021-11-12
Description: Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2021/11/12/1; https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2488; http://www.openwall.com/lists/oss-security/2021/11/12/1
CVE: CVE-2021-43578
Published: 2021-11-12
Description: Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.
CVSS Score: 8.1 (HIGH)
References: http://www.openwall.com/lists/oss-security/2021/11/12/1; https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2525; http://www.openwall.com/lists/oss-security/2021/11/12/1
CVE: CVE-2021-3934
Published: 2021-11-12
Description: ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/ohmyzsh/ohmyzsh/commit/6cb41b70a6d04301fd50cd5862ecd705ba226c0e; https://huntr.dev/bounties/ad2b5c3f-a3ce-4407-94dc-354c723310ce; https://github.com/ohmyzsh/ohmyzsh/commit/6cb41b70a6d04301fd50cd5862ecd705ba226c0e
CVE: CVE-2021-43494
Published: 2021-11-12
Description: OpenCV-REST-API master branch as of commit 69be158c05d4dd5a4aff38fdc680a162dd6b9e49 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/codingforentrepreneurs/OpenCV-REST-API/issues/2; https://github.com/codingforentrepreneurs/OpenCV-REST-API/issues/2
CVE: CVE-2021-43496
Published: 2021-11-12
Description: Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/varun-suresh/Clustering/issues/12; https://github.com/varun-suresh/Clustering/issues/12
CVE: CVE-2021-43492
Published: 2021-11-12
Description: AlquistManager branch as of commit 280d99f43b[PII_REDACTED]e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system andcan significantly aid in getting remote code access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/AlquistManager/alquist/issues/42; https://github.com/AlquistManager/alquist/issues/42
CVE: CVE-2021-43493
Published: 2021-11-12
Description: ServerManagement master branch as of commit 49491cc6f94980e6be7791d17be947c27071eb56 is affected by a directory traversal vulnerability. This vulnerability can be used to extract credentials which can in turn be used to execute code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/cksgf/ServerManagement/issues/21; https://github.com/cksgf/ServerManagement/issues/21
CVE: CVE-2020-4140
Published: 2021-11-12
Description: IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174052.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174052; https://www.ibm.com/support/pages/node/6515054; https://exchange.xforce.ibmcloud.com/vulnerabilities/174052
CVE: CVE-2020-4146
Published: 2021-11-12
Description: IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 174129.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174129; https://www.ibm.com/support/pages/node/6515056; https://exchange.xforce.ibmcloud.com/vulnerabilities/174129
CVE: CVE-2021-38972
Published: 2021-11-12
Description: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212775; https://www.ibm.com/support/pages/node/6515530; https://exchange.xforce.ibmcloud.com/vulnerabilities/212775
CVE: CVE-2021-38973
Published: 2021-11-12
Description: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212778; https://www.ibm.com/support/pages/node/6515528; https://exchange.xforce.ibmcloud.com/vulnerabilities/212778
CVE: CVE-2021-38985
Published: 2021-11-12
Description: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212799; https://www.ibm.com/support/pages/node/6515526; https://exchange.xforce.ibmcloud.com/vulnerabilities/212799
CVE: CVE-2021-41254
Published: 2021-11-12
Description: kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges. In affected versions multitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected by this issue. This vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on 2021-10-08. Starting with v0.15, the kustomize-controller no longer executes shell commands on the container OS and the `kubectl` binary has been removed from the container image. To prevent the creation of Kubernetes Service Accounts with `secrets` in namespaces owned by tenants, a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno can be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/fluxcd/kustomize-controller/security/advisories/GHSA-35rf-v2jv-gfg7; https://github.com/fluxcd/kustomize-controller/security/advisories/GHSA-35rf-v2jv-gfg7
CVE: CVE-2021-41259
Published: 2021-11-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Notes: None.
CVE: CVE-2021-41264
Published: 2021-11-12
Description: OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-665
References: https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301; https://github.com/OpenZeppelin/openzeppelin-contracts/commit/024cc50df478d2e8f[PII_REDACTED]9e94d6df60592; https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5vp3-v4hc-gx76
CVE: CVE-2021-41972
Published: 2021-11-12
Description: Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://lists.apache.org/thread/xpdl2r538o695o7r9gd9qrwqb17bdd3v; https://seclists.org/oss-sec/2021/q4/106; https://lists.apache.org/thread/xpdl2r538o695o7r9gd9qrwqb17bdd3v
CVE: CVE-2021-39303
Published: 2021-11-12
Description: The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://blog.assetnote.io/2021/11/30/jamf-ssrf/; https://community.jamf.com/t5/jamf-pro/what-s-new-in-jamf-pro-10-32-release/m-p/246505; https://docs.jamf.com/10.32.0/jamf-pro/release-notes/Resolved_Issues.html