deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21141
Published: 2021-02-09
Description: Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass file extension policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1140435; https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21141
CVE: CVE-2021-26719
Published: 2021-02-09
Description: A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://security.gradle.com/advisory/CVE-2021-26719; https://security.gradle.com/advisory/CVE-2021-26719
CVE: CVE-2020-27257
Published: 2021-02-09
Description: This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type-confusion condition in the Omron CX-One Version 4.60 and prior devices.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-007-02; https://www.zerodayinitiative.com/advisories/ZDI-21-184/; https://us-cert.cisa.gov/ics/advisories/icsa-21-007-02
CVE: CVE-2020-27259
Published: 2021-02-09
Description: The Omron CX-One Version 4.60 and prior may allow an attacker to supply a pointer to arbitrary memory locations, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-822
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-007-02; https://www.zerodayinitiative.com/advisories/ZDI-21-182/; https://us-cert.cisa.gov/ics/advisories/icsa-21-007-02
CVE: CVE-2020-27261
Published: 2021-02-09
Description: The Omron CX-One Version 4.60 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-007-02; https://www.zerodayinitiative.com/advisories/ZDI-21-183/; https://www.zerodayinitiative.com/advisories/ZDI-21-185/
CVE: CVE-2020-4790
Published: 2021-02-09
Description: IBM Security Identity Governance and Intelligence 5.2.6 could allow a user to cause a denial of service due to improperly validating a supplied URL, rendering the application unusuable. IBM X-Force ID: 189375.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189375; https://www.ibm.com/support/pages/node/6413391; https://exchange.xforce.ibmcloud.com/vulnerabilities/189375
CVE: CVE-2020-4791
Published: 2021-02-09
Description: IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle attacks due to improper certificate validation. IBM X-Force ID: 189379.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189379; https://www.ibm.com/support/pages/node/6403265; https://exchange.xforce.ibmcloud.com/vulnerabilities/189379
CVE: CVE-2020-4795
Published: 2021-02-09
Description: IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially crafted HTTP request. IBM X-Force ID: 189446.
CVSS Score: 8.2 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189446; https://www.ibm.com/support/pages/node/6413399; https://exchange.xforce.ibmcloud.com/vulnerabilities/189446
CVE: CVE-2020-4995
Published: 2021-02-09
Description: IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from another users' session. IBM X-Force ID: 192912.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192912; https://www.ibm.com/support/pages/node/6413393; https://exchange.xforce.ibmcloud.com/vulnerabilities/192912
CVE: CVE-2020-4996
Published: 2021-02-09
Description: IBM Security Identity Governance and Intelligence 5.2.6 could allow a local user to obtain sensitive information via the capturing of screenshots of authentication credentials. IBM X-Force ID: 192913.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192913; https://www.ibm.com/support/pages/node/6413389; https://exchange.xforce.ibmcloud.com/vulnerabilities/192913
CVE: CVE-2021-21142
Published: 2021-02-09
Description: Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html; https://crbug.com/1169317; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ACWYJ74Z3YN2XH4QMUEGNBC3VXX464L/
CVE: CVE-2021-21143
Published: 2021-02-09
Description: Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html; https://crbug.com/1163504; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ACWYJ74Z3YN2XH4QMUEGNBC3VXX464L/
CVE: CVE-2021-21144
Published: 2021-02-09
Description: Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html; https://crbug.com/1163845; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ACWYJ74Z3YN2XH4QMUEGNBC3VXX464L/
CVE: CVE-2021-21145
Published: 2021-02-09
Description: Use after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html; https://crbug.com/1154965; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ACWYJ74Z3YN2XH4QMUEGNBC3VXX464L/
CVE: CVE-2021-21146
Published: 2021-02-09
Description: Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html; https://crbug.com/1161705; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ACWYJ74Z3YN2XH4QMUEGNBC3VXX464L/
CVE: CVE-2021-21147
Published: 2021-02-09
Description: Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html; https://crbug.com/1162942; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ACWYJ74Z3YN2XH4QMUEGNBC3VXX464L/
CVE: CVE-2021-26921
Published: 2021-02-09
Description: In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://github.com/argoproj/argo-cd/commit/f5b0db240b4e3abf18e97f6fd99096b4f9e94dc5; https://github.com/argoproj/argo-cd/compare/v1.8.3...v1.8.4; https://github.com/argoproj/argo-cd/security/advisories/GHSA-9h6w-j7w4-jr52
CVE: CVE-2021-3394
Published: 2021-02-09
Description: Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious user for a local privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: http://packetstormsecurity.com/files/161334/Millewin-13.39.028-Unquoted-Service-Path-Insecure-Permissions.html; https://www.exploit-db.com/exploits/49530; http://packetstormsecurity.com/files/161334/Millewin-13.39.028-Unquoted-Service-Path-Insecure-Permissions.html
CVE: CVE-2021-21148
Published: 2021-02-09
Description: Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/162579/Chrome-Array-Transfer-Bypass.html; https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html; https://crbug.com/1170176
CVE: CVE-2021-26675
Published: 2021-02-09
Description: A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.suse.com/show_bug.cgi?id=1181751; https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=e4079a20f617a4b076af503f6e4e8b0304c9f2cb; https://git.kernel.org/pub/scm/network/connman/connman.git/tree/ChangeLog
CVE: CVE-2021-26676
Published: 2021-02-09
Description: gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.suse.com/show_bug.cgi?id=1181751; https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=58d397ba74873384aee449690a9070bacd5676fa; https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=a74524b3e3fad81b0fd1084ffdf9f2ea469cd9b1
CVE: CVE-2020-10048
Published: 2021-02-09
Description: A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC WinCC (All versions < V7.5 SP2). Due to an insecure password verification process, an attacker could bypass the password protection set on protected files, thus being granted access to the protected content, circumventing authentication.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-288, CWE-287
References: https://cert-portal.siemens.com/productcert/pdf/ssa-944678.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-944678.pdf
CVE: CVE-2020-15798
Published: 2021-02-09
Description: A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected devices with enabled telnet service do not require authentication for this service. This could allow a remote attacker to gain full access to the device. (ZDI-CAN-12046)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://cert-portal.siemens.com/productcert/pdf/ssa-520004.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-752103.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-033-02
CVE: CVE-2020-25237
Published: 2021-02-09
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within the intended target directory. With this an attacker could create or overwrite arbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054)
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-156833.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-040-03; https://www.zerodayinitiative.com/advisories/ZDI-21-253/
CVE: CVE-2020-25238
Published: 2021-02-09
Description: A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in specific folders could allow a local attacker to execute code with SYSTEM privileges. The security vulnerability could be exploited by an attacker with a valid account and limited access rights on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-427
References: https://cert-portal.siemens.com/productcert/pdf/ssa-428051.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-040-05; https://www.kb.cert.org/vuls/id/466044
CVE: CVE-2020-25245
Published: 2021-02-09
Description: A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10; https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf
CVE: CVE-2020-26998
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information. (ZDI-CAN-12040)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-238/
CVE: CVE-2020-26999
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information. (ZDI-CAN-12042)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-239/
CVE: CVE-2020-27000
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing BMP files. This can result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12018)
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-237/; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
CVE: CVE-2020-27001
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a stack based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12041)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-227/
CVE: CVE-2020-27002
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12043)
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-228/
CVE: CVE-2020-27003
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing TIFF files. This could lead to pointer dereferences of a value obtained from untrusted source. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12158)
CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-119
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-229/; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
CVE: CVE-2020-27004
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of CGM files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12163)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-230/; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
CVE: CVE-2020-27005
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of TGA files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12178)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-231/; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
CVE: CVE-2020-27006
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of PCT files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12182)
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-232/; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
CVE: CVE-2020-27007
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of HPG files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12207)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-233/; https://www.zerodayinitiative.com/advisories/ZDI-21-234/
CVE: CVE-2020-27008
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of PLT files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12209)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-235/; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
CVE: CVE-2021-22663
Published: 2021-02-09
Description: Cscape (All versions prior to 9.90 SP3.5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-035-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-035-02
CVE: CVE-2021-25139
Published: 2021-02-09
Description: A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. The HPE Moonshot Provisioning Manager is an application that is installed in a VMWare or Microsoft Hyper-V environment that is used to setup and configure an HPE Moonshot 1500 chassis. This vulnerability could be remotely exploited by an unauthenticated user to cause a stack based buffer overflow using user supplied input to the `khuploadfile.cgi` CGI ELF. The stack based buffer overflow could lead to Remote Code Execution, Denial of Service, and/or compromise system integrity. **Note:** HPE recommends that customers discontinue the use of the HPE Moonshot Provisioning Manager. The HPE Moonshot Provisioning Manager application is discontinued, no longer supported, is not available to download from the HPE Support Center, and no patch is available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04084en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04084en_us
CVE: CVE-2021-25140
Published: 2021-02-09
Description: A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. The HPE Moonshot Provisioning Manager is an application that is installed in a VMWare or Microsoft Hyper-V environment that is used to setup and configure an HPE Moonshot 1500 chassis. This vulnerability could be remotely exploited by an unauthenticated user to cause a directory traversal in user supplied input to the `khuploadfile.cgi` CGI ELF. The directory traversal could lead to Remote Code Execution, Denial of Service, and/or compromise system integrity. **Note:** HPE recommends that customers discontinue the use of the HPE Moonshot Provisioning Manager. The HPE Moonshot Provisioning Manager application is discontinued, no longer supported, is not available to download from the HPE Support Center, and no patch is available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04085en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04085en_us