deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-36119
Published: 2022-08-25
Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for a domain authenticated user to send a crafted message to the Blue Prism Server and accomplish a remote code execution attack that is possible because of insecure deserialization. Exploitation of this vulnerability allows for code to be executed in the context of the Blue Prism Server service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://blueprism.com; https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise; https://portal.blueprism.com/security-vulnerabilities-august-2022
CVE: CVE-2022-37316
Published: 2022-08-25
Description: Archer Platform 6.8 before 6.11 P3 (6.11.0.3) contains an improper API access control vulnerability in a multi-instance system that could potentially present unauthorized metadata to an authenticated user of the affected system. 6.10 P3 HF1 (6.10.0.3.1) is also a fixed release.
CVSS Score: 6.5 (MEDIUM)
References: https://archerirm.com; https://www.archerirm.community/t5/security-advisories/archer-update-for-improper-access-control/ta-p/682059; https://archerirm.com
CVE: CVE-2022-37317
Published: 2022-08-25
Description: Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious code in the context of the web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://archerirm.com; https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060; https://archerirm.com
CVE: CVE-2022-37318
Published: 2022-08-25
Description: Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases.
CVSS Score: 7.0 (HIGH)
CWE: CWE-79
References: https://archerirm.com; https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/682060; https://archerirm.com
CVE: CVE-2021-32570
Published: 2022-08-26
Description: In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All AMOS users are considered to be highly privileged users in ENM system and all must be previously defined and authorized by the Security Administrator. Those users can access some log’s files, under a common path, and read information stored in the log’s files in order to conduct privilege escalation.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532
References: https://www.ericsson.com; https://www.gruppotim.it/it/footer/red-team.html; https://www.ericsson.com
CVE: CVE-2021-3020
Published: 2022-08-26
Description: An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://bugzilla.suse.com/show_bug.cgi?id=1180571; https://github.com/ClusterLabs/crmsh/commit/c538024b8ebd138dc373b005189471d9b77e9c82; https://github.com/ClusterLabs/hawk/releases
CVE: CVE-2022-29850
Published: 2022-08-26
Description: Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-668
References: https://publications.lexmark.com/publications/security-alerts/CVE-2022-29850.pdf; https://support.lexmark.com/alerts/; https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE: CVE-2022-30984
Published: 2022-08-26
Description: A buffer overflow vulnerability in the Rubrik Backup Service (RBS) Agent for Linux or Unix-based systems in Rubrik CDM 7.0.1, 7.0.1-p1, 7.0.1-p2 or 7.0.1-p3 before CDM 7.0.2-p2 could allow a local attacker to obtain root privileges by sending a crafted message to the RBS agent.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://rubrik.com; https://www.rubrik.com/advisories/rbk-20220705-V0037; https://rubrik.com
CVE: CVE-2022-35192
Published: 2022-08-26
Description: D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via the User parameter or Pwd parameter to Login.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://d-link.com; http://wireless.com; https://pastebin.com/upHp001e
CVE: CVE-2022-36120
Published: 2022-08-26
Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the getChartData administrative function. Using a low/no privilege Blue Prism user account, the attacker can alter the server's settings by abusing the getChartData method, allowing the Blue Prism server to execute any MSSQL stored procedure by name.
CVSS Score: 8.1 (HIGH)
References: https://blueprism.com; https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise; https://portal.blueprism.com/security-vulnerabilities-august-2022
CVE: CVE-2022-36121
Published: 2022-08-26
Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the UpdateOfflineHelpData administrative function. Abusing this function will allow any Blue Prism user to change the offline help URL to one of their choice, opening the possibility of spoofing the help page or executing a local file.
CVSS Score: 5.3 (MEDIUM)
References: https://blueprism.com; https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise; https://portal.blueprism.com/security-vulnerabilities-august-2022
CVE: CVE-2022-36168
Published: 2022-08-26
Description: A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php:
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: https://github.com/Cigar-Fasion/CVE/issues/1; https://github.com/wuzhicms/wuzhicms/issues/202; https://github.com/Cigar-Fasion/CVE/issues/1
CVE: CVE-2022-36226
Published: 2022-08-26
Description: SiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax/ajaxOtherService.aspx.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://github.com/we1h0/SiteServer-CMS-Remote-download-Getshell; https://www.slpyue.com; https://github.com/we1h0/SiteServer-CMS-Remote-download-Getshell
CVE: CVE-2022-38533
Published: 2022-08-26
Description: In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/bminor/binutils-gdb/commit/45d92439aebd0386ef8af76e1796d08cfe457e1d; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AKZ2DTS3ATVN5PANNVLKLE5OP4OF25Q/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MTEHT3G6YKJ7F7MSGWYSI4UM3XBAYXZ/
CVE: CVE-2022-24304
Published: 2022-08-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2564. Reason: This candidate is a duplicate of CVE-2022-2564. Notes: All CVE users should reference CVE-2022-2564 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-39393
Published: 2022-08-26
Description: mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/phachon/mm-wiki/issues/315; https://github.com/phachon/mm-wiki/issues/315
CVE: CVE-2021-39394
Published: 2022-08-26
Description: mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add user accounts and modify user information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/phachon/mm-wiki/issues/316; https://github.com/phachon/mm-wiki/issues/316
CVE: CVE-2021-40285
Published: 2022-08-26
Description: htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://github.com/danpros/htmly/issues/462; https://github.com/danpros/htmly/issues/462
CVE: CVE-2022-36678
Published: 2022-08-26
Description: Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-2.md
CVE: CVE-2022-36679
Published: 2022-08-26
Description: Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-1.md
CVE: CVE-2022-36680
Published: 2022-08-26
Description: Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_schedule.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-3.md
CVE: CVE-2022-36681
Published: 2022-08-26
Description: Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-5.md
CVE: CVE-2022-36682
Published: 2022-08-26
Description: Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_student.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-4.md
CVE: CVE-2022-36683
Published: 2022-08-26
Description: Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_payment.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-task-scheduler-system/SQLi-6.md
CVE: CVE-2022-37150
Published: 2022-08-26
Description: An issue was discovered in Online Diagnostic Lab Management System 1.0. There is a stored XSS vulnerability via firstname, address, middlename, lastname , gender, email, contact parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Fjowel/CVE-2022-37150; https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html; https://github.com/Fjowel/CVE-2022-37150
CVE: CVE-2022-37151
Published: 2022-08-26
Description: There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Fjowel/CVE-2022-37151; https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html; https://github.com/Fjowel/CVE-2022-37151
CVE: CVE-2022-37152
Published: 2022-08-26
Description: An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/classes/Users.php?f=save_client"
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Fjowel/CVE-2022-37152; https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html; https://github.com/Fjowel/CVE-2022-37152
CVE: CVE-2022-36521
Published: 2022-08-26
Description: Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/chatopera/cskefu/issues/724; https://github.com/chatopera/cskefu/issues/724
CVE: CVE-2021-20260
Published: 2022-08-26
Description: A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200, CWE-522
References: https://access.redhat.com/security/cve/CVE-2021-20260; https://bugzilla.redhat.com/show_bug.cgi?id=1932181; https://access.redhat.com/security/cve/CVE-2021-20260
CVE: CVE-2021-35939
Published: 2022-08-26
Description: It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://access.redhat.com/security/cve/CVE-2021-35939; https://bugzilla.redhat.com/show_bug.cgi?id=1964129; https://github.com/rpm-software-management/rpm/commit/96ec957e281220f8e137a2d5eb23b83a6377d556
CVE: CVE-2021-3414
Published: 2022-08-26
Description: A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing a user to view and manage other organizations are also granted. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 8.1 (HIGH)
CWE: CWE-281, CWE-281
References: https://access.redhat.com/security/cve/CVE-2021-3414; https://bugzilla.redhat.com/show_bug.cgi?id=1926139; https://access.redhat.com/security/cve/CVE-2021-3414
CVE: CVE-2021-3427
Published: 2022-08-26
Description: The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://dev.deluge-torrent.org/ticket/3459; https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg; https://security.gentoo.org/glsa/202210-07
CVE: CVE-2021-3563
Published: 2022-08-26
Description: A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Score: 7.4 (HIGH)
CWE: CWE-863, CWE-863
References: https://access.redhat.com/security/cve/CVE-2021-3563; https://bugs.launchpad.net/ossa/+bug/1901891; https://bugzilla.redhat.com/show_bug.cgi?id=1962908
CVE: CVE-2021-3574
Published: 2022-08-26
Description: A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.
CVSS Score: 3.3 (LOW)
CWE: CWE-401, CWE-401
References: https://github.com/ImageMagick/ImageMagick/commit/c6ad94fbb7b280f39c2fbbdc1c140e51b1b466e9; https://github.com/ImageMagick/ImageMagick/issues/3540; https://github.com/ImageMagick/ImageMagick6/commit/cd7f9fb7751b0d59d5a74b12d971155caad5a792
CVE: CVE-2021-3585
Published: 2022-08-26
Description: A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-312
References: https://access.redhat.com/security/cve/CVE-2021-3585; https://bugs.launchpad.net/tripleo/+bug/1931132; https://bugzilla.redhat.com/show_bug.cgi?id=1961709
CVE: CVE-2021-3627
Published: 2022-08-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-3632
Published: 2022-08-26
Description: A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://access.redhat.com/security/cve/CVE-2021-3632; https://bugzilla.redhat.com/show_bug.cgi?id=1978196; https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
CVE: CVE-2021-3644
Published: 2022-08-26
Description: A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://access.redhat.com/security/cve/CVE-2021-3644; https://bugzilla.redhat.com/show_bug.cgi?id=1976052; https://github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714
CVE: CVE-2021-3651
Published: 2022-08-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-3669
Published: 2022-08-26
Description: A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://access.redhat.com/security/cve/CVE-2021-3669; https://bugzilla.redhat.com/show_bug.cgi?id=1980619; https://bugzilla.redhat.com/show_bug.cgi?id=1986473
CVE: CVE-2021-3688
Published: 2022-08-26
Description: A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolon(s). This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-200, CWE-22
References: https://access.redhat.com/security/cve/CVE-2021-3688; https://bugzilla.redhat.com/show_bug.cgi?id=1990252; https://access.redhat.com/security/cve/CVE-2021-3688
CVE: CVE-2021-3691
Published: 2022-08-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-3703
Published: 2022-08-26
Description: It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16.0 and Serverless client kn 1.16.0. These have been fixed with Serverless 1.17.0.
CVSS Score: 7.5 (HIGH)
References: https://access.redhat.com/security/cve/CVE-2021-3703; https://bugzilla.redhat.com/show_bug.cgi?id=1992955; https://access.redhat.com/security/cve/CVE-2021-3703
CVE: CVE-2021-3735
Published: 2022-08-26
Description: A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-667, CWE-400, CWE-667
References: https://access.redhat.com/security/cve/CVE-2021-3735; https://bugzilla.redhat.com/show_bug.cgi?id=1997184; https://security-tracker.debian.org/tracker/CVE-2021-3735
CVE: CVE-2021-3754
Published: 2022-08-26
Description: A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/security/cve/CVE-2021-3754; https://bugzilla.redhat.com/show_bug.cgi?id=1999196; https://access.redhat.com/security/cve/CVE-2021-3754
CVE: CVE-2021-3856
Published: 2022-08-26
Description: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-552, CWE-22
References: https://access.redhat.com/security/cve/CVE-2021-3856; https://bugzilla.redhat.com/show_bug.cgi?id=2010164; https://github.com/keycloak/keycloak/commit/73f0474008e1bebd0733e62a22aceda9e5de6743
CVE: CVE-2021-3859
Published: 2022-08-26
Description: A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-214, CWE-668
References: https://access.redhat.com/security/cve/CVE-2021-3859; https://bugzilla.redhat.com/show_bug.cgi?id=2010378; https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2