deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-42563
Published: 2021-11-12
Description: There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://www.ni.com/en-us/support/documentation/supplemental/21/unquoted-service-path-in-ni-service-locator.html; https://www.ni.com/en-us/support/documentation/supplemental/21/unquoted-service-path-in-ni-service-locator.html
CVE: CVE-2021-43331
Published: 2021-11-12
Description: In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.launchpad.net/mailman/+bug/1949401; https://lists.debian.org/debian-lts-announce/2022/06/msg00011.html; https://mail.python.org/archives/list/mailman-announce%40python.org/message/I2X7PSFXIEPLM3UMKZMGOEO3UFYETGRL/
CVE: CVE-2021-43332
Published: 2021-11-12
Description: In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://bugs.launchpad.net/mailman/+bug/1949403; https://lists.debian.org/debian-lts-announce/2022/06/msg00011.html; https://mail.python.org/archives/list/mailman-announce%40python.org/message/I2X7PSFXIEPLM3UMKZMGOEO3UFYETGRL/
CVE: CVE-2020-21141
Published: 2021-11-12
Description: iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/hxcc/just_for_fun/blob/master/ICMS%20CSRF; https://github.com/hxcc/just_for_fun/blob/master/ICMS%20CSRF
CVE: CVE-2021-3519
Published: 2021-11-12
Description: A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://support.lenovo.com/us/en/product_security/LEN-67440; https://support.lenovo.com/us/en/product_security/LEN-67440
CVE: CVE-2021-3577
Published: 2021-11-12
Description: An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-863
References: https://binatoneglobal.com/security-advisory/; https://binatoneglobal.com/security-advisory/
CVE: CVE-2021-3599
Published: 2021-11-12
Description: A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-67440; https://support.lenovo.com/us/en/product_security/LEN-67440
CVE: CVE-2021-3718
Published: 2021-11-12
Description: A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-232
References: https://support.lenovo.com/us/en/product_security/LEN-72619; https://support.lenovo.com/us/en/product_security/LEN-72619
CVE: CVE-2021-3719
Published: 2021-11-12
Description: A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-67440; https://support.lenovo.com/us/en/product_security/LEN-67440
CVE: CVE-2021-3720
Published: 2021-11-12
Description: An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could allow other applications to access device GPS data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://iknow.lenovo.com.cn/detail/dc_199217.html; https://iknow.lenovo.com.cn/detail/dc_199217.html
CVE: CVE-2021-3723
Published: 2021-11-12
Description: A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that could allow the execution of operating system commands over an authenticated SSH or Telnet session.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://support.lenovo.com/us/en/product_security/LEN-66347; https://support.lenovo.com/us/en/product_security/LEN-66347
CVE: CVE-2021-3786
Published: 2021-11-12
Description: A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-67440; https://support.lenovo.com/us/en/product_security/LEN-67440
CVE: CVE-2021-3787
Published: 2021-11-12
Description: A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MQTT credentials that could result in unauthorized access to backend Hubble services.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-256
References: https://binatoneglobal.com/security-advisory/; https://binatoneglobal.com/security-advisory/
CVE: CVE-2021-3788
Published: 2021-11-12
Description: An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access to the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1299, CWE-287
References: https://binatoneglobal.com/security-advisory/; https://binatoneglobal.com/security-advisory/
CVE: CVE-2021-3789
Published: 2021-11-12
Description: An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-522, CWE-326
References: https://binatoneglobal.com/security-advisory/; https://binatoneglobal.com/security-advisory/
CVE: CVE-2021-3790
Published: 2021-11-12
Description: A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same network to perform a denial-of-service attack against the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-120
References: https://binatoneglobal.com/security-advisory/; https://binatoneglobal.com/security-advisory/
CVE: CVE-2021-3791
Published: 2021-11-12
Description: An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such as WiFi SSID and password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://binatoneglobal.com/security-advisory/; https://binatoneglobal.com/security-advisory/
CVE: CVE-2021-3792
Published: 2021-11-12
Description: Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead to the communication channel being accessible by an attacker.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://binatoneglobal.com/security-advisory/; https://binatoneglobal.com/security-advisory/
CVE: CVE-2021-3793
Published: 2021-11-12
Description: An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the same network as the device to access administrative pages that could result in information disclosure or device firmware update with verified firmware.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-424
References: https://binatoneglobal.com/security-advisory/; https://binatoneglobal.com/security-advisory/
CVE: CVE-2021-3840
Published: 2021-11-12
Description: A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://github.com/lenovo/Antilles/security/advisories/GHSA-hgc3-hp6x-wpgx; https://github.com/lenovo/Antilles/security/advisories/GHSA-hgc3-hp6x-wpgx
CVE: CVE-2021-3843
Published: 2021-11-12
Description: A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-72619; https://support.lenovo.com/us/en/product_security/LEN-72619
CVE: CVE-2021-43610
Published: 2021-11-12
Description: Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in an unauthenticated SIP message, a different issue than CVE-2021-33056.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://github.com/BelledonneCommunications/belle-sip/commit/d3f0651531e45e91c2e60f3a16a8b612802e5d2d; https://github.com/BelledonneCommunications/belle-sip/compare/5.0.18...5.0.20; https://github.com/BelledonneCommunications/belle-sip/commit/d3f0651531e45e91c2e60f3a16a8b612802e5d2d
CVE: CVE-2021-43611
Published: 2021-11-12
Description: Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \ " in the display name of a From header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://github.com/BelledonneCommunications/belle-sip/commit/d3f0651531e45e91c2e60f3a16a8b612802e5d2d; https://github.com/BelledonneCommunications/belle-sip/compare/5.0.18...5.0.20; https://github.com/BelledonneCommunications/belle-sip/commit/d3f0651531e45e91c2e60f3a16a8b612802e5d2d
CVE: CVE-2021-21528
Published: 2021-11-12
Description: Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. This vulnerability is triggered when upgrading from a previous versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-548
References: https://www.dell.com/support/kbdoc/en-us/000193005/; https://www.dell.com/support/kbdoc/en-us/000193005/
CVE: CVE-2021-36305
Published: 2021-11-12
Description: Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. An authenticated user of SMB on a cluster with CA could potentially exploit this vulnerability, leading to a denial of service over SMB.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-662
References: https://www.dell.com/support/kbdoc/000192046; https://www.dell.com/support/kbdoc/000192046
CVE: CVE-2021-36315
Published: 2021-11-12
Description: Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity.
CVSS Score: 6.8 (MEDIUM)
References: https://www.dell.com/support/kbdoc/en-us/000193005/; https://www.dell.com/support/kbdoc/en-us/000193005/
CVE: CVE-2021-36323
Published: 2021-11-12
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000192967; https://www.dell.com/support/kbdoc/en-us/000192967
CVE: CVE-2021-36324
Published: 2021-11-12
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000192967; https://www.dell.com/support/kbdoc/en-us/000192967
CVE: CVE-2021-36325
Published: 2021-11-12
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000192967; https://www.dell.com/support/kbdoc/en-us/000192967
CVE: CVE-2021-41229
Published: 2021-11-12
Description: BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://github.com/bluez/bluez/security/advisories/GHSA-3fqg-r8j5-f5xq; https://lists.debian.org/debian-lts-announce/2021/11/msg00022.html; https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html
CVE: CVE-2021-34357
Published: 2021-11-13
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and later
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-21-47; https://www.qnap.com/en/security-advisory/qsa-21-47
CVE: CVE-2021-38684
Published: 2021-11-13
Description: A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Multimedia Console: Multimedia Console 1.4.3 ( 2021/10/05 ) and later Multimedia Console 1.5.3 ( 2021/10/05 ) and later
CVSS Score: 8.1 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-21-45; https://www.qnap.com/en/security-advisory/qsa-21-45
CVE: CVE-2021-3918
Published: 2021-11-13
Description: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/kriszyp/json-schema/commit/22f146111f541d9737e832823699ad3528ca7741; https://huntr.dev/bounties/bb6ccd63-f505-4e3a-b55f-cd2662c261a9; https://lists.debian.org/debian-lts-announce/2022/12/msg00013.html
CVE: CVE-2021-3921
Published: 2021-11-13
Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/firefly-iii/firefly-iii/commit/47fa9e39561a9ec9e210e4023d090a7b33381684; https://huntr.dev/bounties/724d3fd5-9f04-45c4-98d6-35a7d15468f5; https://github.com/firefly-iii/firefly-iii/commit/47fa9e39561a9ec9e210e4023d090a7b33381684
CVE: CVE-2021-3931
Published: 2021-11-13
Description: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/snipe/snipe-it/commit/0d811d067c8e064252c0143c39d6cd4c3133679e; https://huntr.dev/bounties/03b21d69-3bf5-4b2f-a2cf-872dd677a68f; https://github.com/snipe/snipe-it/commit/0d811d067c8e064252c0143c39d6cd4c3133679e
CVE: CVE-2021-3932
Published: 2021-11-13
Description: twill is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/area17/twill/commit/81d80d1fbbdd8bb73c020f03c623fd4487bd9b78; https://huntr.dev/bounties/6ef21e34-f6d9-445a-b657-375c53dc2b43; https://github.com/area17/twill/commit/81d80d1fbbdd8bb73c020f03c623fd4487bd9b78
CVE: CVE-2021-3938
Published: 2021-11-13
Description: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/snipe/snipe-it/commit/9ed1442bd124710f4178992cc4eca5236c7396b9; https://huntr.dev/bounties/198a0d67-9189-4170-809b-0f8aea43b063; https://github.com/snipe/snipe-it/commit/9ed1442bd124710f4178992cc4eca5236c7396b9
CVE: CVE-2021-3945
Published: 2021-11-13
Description: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/django-helpdesk/django-helpdesk/commit/2c7065e0c4296e0c692fb4a7ee19c7357583af30; https://huntr.dev/bounties/745f483c-70ed-441f-ab2e-7ac1305439a4; https://github.com/django-helpdesk/django-helpdesk/commit/2c7065e0c4296e0c692fb4a7ee19c7357583af30
CVE: CVE-2021-3683
Published: 2021-11-13
Description: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/star7th/showdoc/commit/67093c879a6563aa6ee[PII_REDACTED]7d1975e2351; https://huntr.dev/bounties/063a339a-5d78-40d6-a96a-6716960e8134; https://github.com/star7th/showdoc/commit/67093c879a6563aa6ee[PII_REDACTED]7d1975e2351
CVE: CVE-2021-3775
Published: 2021-11-13
Description: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/star7th/showdoc/commit/67093c879a6563aa6ee[PII_REDACTED]7d1975e2351; https://huntr.dev/bounties/6a59d203-4ca7-4aed-bdb9-1e39b66c77b3; https://github.com/star7th/showdoc/commit/67093c879a6563aa6ee[PII_REDACTED]7d1975e2351
CVE: CVE-2021-3776
Published: 2021-11-13
Description: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/star7th/showdoc/commit/67093c879a6563aa6ee[PII_REDACTED]7d1975e2351; https://huntr.dev/bounties/e0edf27d-437e-44fe-907a-df020f385304; https://github.com/star7th/showdoc/commit/67093c879a6563aa6ee[PII_REDACTED]7d1975e2351
CVE: CVE-2021-3915
Published: 2021-11-13
Description: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/bookstackapp/bookstack/commit/ae155d67454d6b9f6c93b2bb457aaa4b2eb1a9ed; https://huntr.dev/bounties/fcb65f2d-257a-46f4-bac9-f6ded5649079; https://github.com/bookstackapp/bookstack/commit/ae155d67454d6b9f6c93b2bb457aaa4b2eb1a9ed
CVE: CVE-2021-41653
Published: 2021-11-13
Description: The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://tp-link.com; https://k4m1ll0.com/cve-2021-41653.html; https://www.tp-link.com/us/press/security-advisory/
CVE: CVE-2021-43616
Published: 2021-11-13
Description: The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to socially engineer package.json which has different dependencies than package-lock.json. That user would have to have file system or write access to change dependencies. The npm team states preventing malicious actors from socially engineering or gaining file system access is outside the scope of the npm CLI.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-345
References: https://docs.npmjs.com/cli/v7/commands/npm-ci; https://docs.npmjs.com/cli/v8/commands/npm-ci; https://github.com/icatalina/CVE-2021-43616
CVE: CVE-2021-43617
Published: 2021-11-14
Description: Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1331-L1333; https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6; https://salsa.debian.org/php-team/php/-/commit/dc253886b5b2e9bc8d9e36db787abb083a667fd8
CVE: CVE-2020-14424
Published: 2021-11-14
Description: Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=2001016; https://github.com/Cacti/cacti/pull/4261; https://bugzilla.redhat.com/show_bug.cgi?id=2001016
CVE: CVE-2020-16152
Published: 2021-11-14
Description: The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-829
References: http://packetstormsecurity.com/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html; https://gtacknowledge.extremenetworks.com/articles/Vulnerability_Notice/VN-2020-001; http://packetstormsecurity.com/files/164957/Aerohive-NetConfig-10.0r8a-Local-File-Inclusion-Remote-Code-Execution.html
CVE: CVE-2021-26795
Published: 2021-11-14
Description: A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/164961/Talariax-sendQuick-Alertplus-Server-Admin-4.3-SQL-Injection.html; http://seclists.org/fulldisclosure/2021/Nov/37; http://packetstormsecurity.com/files/164961/Talariax-sendQuick-Alertplus-Server-Admin-4.3-SQL-Injection.html
CVE: CVE-2021-41057
Published: 2021-11-14
Description: In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210910-01.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-580693.pdf; https://www.wibu.com/us/support/security-advisories.html