deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27458
Published: 2021-04-19
Description: If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCC-6464: All versions, PC10P TCC-6372: All versions, PC10P-DP TCC-6726: All versions, PC10P-DP-IO TCC-6752: All versions, PC10B-P TCC-6373: All versions, PC10B TCC-1021: All versions, PC10B-E/C TCU-6521: All versions, PC10E TCC-4737: All versions; TOYOPUC-Plus Series: Plus CPU TCC-6740: All versions, Plus EX TCU-6741: All versions, Plus EX2 TCU-6858: All versions, Plus EFR TCU-6743: All versions, Plus EFR2 TCU-6859: All versions, Plus 2P-EFR TCU-6929: All versions, Plus BUS-EX TCU-6900: All versions; TOYOPUC-PC3J/PC2J Series: FL/ET-T-V2H THU-6289: All versions, 2PORT-EFR THU-6404: All versions) are left in an open state by an attacker, Ethernet communications cannot be established with other devices, depending on the settings of the link parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-103-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-103-03
CVE: CVE-2021-3506
Published: 2021-04-19
Description: An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: http://www.openwall.com/lists/oss-security/2021/05/08/1; https://bugzilla.redhat.com/show_bug.cgi?id=1944298; https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
CVE: CVE-2021-3035
Published: 2021-04-20
Description: An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://security.paloaltonetworks.com/CVE-2021-3035; https://security.paloaltonetworks.com/CVE-2021-3035
CVE: CVE-2021-3036
Published: 2021-04-20
Description: An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to use the PAN-OS XML API and exists only when a client includes a duplicate API parameter in API requests. Logged information includes the cleartext username, password, and API key of the administrator making the PAN-OS XML API request.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://security.paloaltonetworks.com/CVE-2021-3036; https://security.paloaltonetworks.com/CVE-2021-3036
CVE: CVE-2021-3037
Published: 2021-04-20
Description: An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS configuration to the destination server.
CVSS Score: 2.3 (LOW)
CWE: CWE-534, CWE-532
References: https://security.paloaltonetworks.com/CVE-2021-3037; https://security.paloaltonetworks.com/CVE-2021-3037
CVE: CVE-2021-3038
Published: 2021-04-20
Description: A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.8; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-248
References: https://security.paloaltonetworks.com/CVE-2021-3038; https://security.paloaltonetworks.com/CVE-2021-3038
CVE: CVE-2021-20023
Published: 2021-04-20
Description: SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20023
CVE: CVE-2021-20453
Published: 2021-04-20
Description: IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196648.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196648; https://www.ibm.com/support/pages/node/6445171; https://exchange.xforce.ibmcloud.com/vulnerabilities/196648
CVE: CVE-2021-25679
Published: 2021-04-20
Description: The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version 10.8.1 was able to be confirmed during primary research. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://adtran.com; http://packetstormsecurity.com/files/162268/Adtran-Personal-Phone-Manager-10.8.1-Persistent-Cross-Site-Scripting.html; https://depthsecurity.com/blog/vulnerability-disclosure
CVE: CVE-2021-25680
Published: 2021-04-20
Description: The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version 10.8.1 was able to be confirmed during primary research. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://adtran.com; http://packetstormsecurity.com/files/162269/Adtran-Personal-Phone-Manager-10.8.1-Cross-Site-Scripting.html; https://github.com/3ndG4me/AdTran-Personal-Phone-Manager-Vulns/blob/main/CVE-2021-25680.md
CVE: CVE-2021-25681
Published: 2021-04-20
Description: AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched
CVSS Score: 7.5 (HIGH)
References: http://adtran.com; http://packetstormsecurity.com/files/162280/Adtran-Personal-Phone-Manager-10.8.1-DNS-Exfiltration.html; https://github.com/3ndG4me/AdTran-Personal-Phone-Manager-Vulns/blob/main/CVE-2021-25681.md
CVE: CVE-2020-7856
Published: 2021-04-20
Description: A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36003; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36003
CVE: CVE-2021-28793
Published: 2021-04-20
Description: vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/vscode-restructuredtext/vscode-restructuredtext/commit/1dd3e878a5559e3dfe0e48f145c90418b208c5af; https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases; https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases/tag/147.0.0
CVE: CVE-2020-14105
Published: 2021-04-20
Description: The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.
CVSS Score: 5.5 (MEDIUM)
References: https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=28&locale=zh; https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=28&locale=zh
CVE: CVE-2020-25864
Published: 2021-04-20
Description: HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368; https://security.gentoo.org/glsa/202208-09; https://www.hashicorp.com/blog/category/consul
CVE: CVE-2021-1079
Published: 2021-04-20
Description: NVIDIA GeForce Experience, all versions prior to 3.22, contains a vulnerability in GameStream plugins where log files are created using NT/System level permissions, which may lead to code execution, denial of service, or local privilege escalation. The attacker does not have control over the consequence of a modification nor would they be able to leak information as a direct result of the overwrite.
CVSS Score: 6.1 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5184; https://nvidia.custhelp.com/app/answers/detail/a_id/5184
CVE: CVE-2021-28156
Published: 2021-04-20
Description: HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.
CVSS Score: 7.5 (HIGH)
References: https://discuss.hashicorp.com/t/hcsec-2021-08-consul-enterprise-audit-log-bypass-for-http-events/23369; https://security.gentoo.org/glsa/202208-09; https://www.hashicorp.com/blog/category/consul
CVE: CVE-2021-28492
Published: 2021-04-20
Description: Unisys Stealth (core) 5.x before 5.0.048.0, 5.1.x before 5.1.017.0, and 6.x before 6.0.037.0 stores passwords in a recoverable format.
CVSS Score: 4.9 (MEDIUM)
References: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=63; https://public.support.unisys.com/common/public/vulnerability/NVD_Home.aspx; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=63
CVE: CVE-2021-29155
Published: 2021-04-20
Description: An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073815b756c51ba9d8384d924c5d1c03ca3d1ae4; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=24c109bb1537c12c02aeed2d51a347b4d6a9b76e; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6f55b2f2a1178856c19bbce2f71449926e731914
CVE: CVE-2021-30496
Published: 2021-04-20
Description: The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that "this behavior can't be considered a vulnerability."
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-121
References: https://gist.github.com/raminfp/bf64c2974ee[PII_REDACTED]749148a4b31; https://t.me/joinchat/bJ9cnUosVh03ZTI0; https://gist.github.com/raminfp/bf64c2974ee[PII_REDACTED]749148a4b31
CVE: CVE-2020-26197
Published: 2021-04-20
Description: Dell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability. It may make it easier to eavesdrop and decrypt such traffic for a malicious actor. Note: This does not affect clusters which are not relying on an LDAP server for the authentication provider.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-319
References: https://www.dell.com/support/kbdoc/000185202; https://www.dell.com/support/kbdoc/000185202
CVE: CVE-2021-21526
Published: 2021-04-20
Description: Dell PowerScale OneFS 8.1.0 - 9.1.0 contains a privilege escalation in SmartLock compliance mode that may allow compadmin to execute arbitrary commands as root.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/000185202; https://www.dell.com/support/kbdoc/000185202
CVE: CVE-2021-28827
Published: 2021-04-20
Description: The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition for z/Linux, TIBCO Administrator - Enterprise Edition for z/Linux, TIBCO Runtime Agent, TIBCO Runtime Agent, TIBCO Runtime Agent for z/Linux, and TIBCO Runtime Agent for z/Linux contains an easily exploitable vulnerability that allows an unauthenticated attacker to social engineer a legitimate user with network access to execute a Stored XSS attack targeting the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.11.0 and 5.11.1, TIBCO Runtime Agent: versions 5.10.2 and below, TIBCO Runtime Agent: versions 5.11.0 and 5.11.1, TIBCO Runtime Agent for z/Linux: versions 5.10.2 and below, and TIBCO Runtime Agent for z/Linux: versions 5.11.0 and 5.11.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/04/tibco-security-advisory-april-20-2021-tibco-administrator-2021-28827; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28828
Published: 2021-04-20
Description: The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition for z/Linux, and TIBCO Administrator - Enterprise Edition for z/Linux contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a SQL injection attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.10.2 and below, and TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.11.0 and 5.11.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/04/tibco-security-advisory-april-20-2021-tibco-administrator-2021-28828; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28829
Published: 2021-04-20
Description: The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition for z/Linux, and TIBCO Administrator - Enterprise Edition for z/Linux contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a persistent CSV injection attack from the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.10.2 and below, and TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.11.0 and 5.11.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/04/tibco-security-advisory-april-20-2021-tibco-administrator-2021-28829; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-29459
Published: 2021-04-20
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inject scripts in XWiki versions prior to 12.6.3 and 12.8. Unregistred users can fill simple text fields. Registered users can fill in their personal information and (if they have edit rights) fill the values of static lists using App Within Minutes. There is no easy workaround except upgrading XWiki. The vulnerability has been patched on XWiki 12.8 and 12.6.3.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5c66-v29h-xjh8; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5c66-v29h-xjh8
CVE: CVE-2021-30464
Published: 2021-04-20
Description: OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet port.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.omicronenergy.com/download/file/e81f23250097e7d5e1071dfbdb7f16d2/; https://www.omicronenergy.com/en/support/product-security/; https://www.omicronenergy.com/download/file/e81f23250097e7d5e1071dfbdb7f16d2/
CVE: CVE-2020-35313
Published: 2021-04-20
Description: A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/robiso/wondercms; https://packetstormsecurity.com/files/160310/WonderCMS-3.1.3-Code-Execution-Server-Side-Request-Forgery.html; https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/
CVE: CVE-2020-35314
Published: 2021-04-20
Description: A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/robiso/wondercms; https://packetstormsecurity.com/files/160311/WonderCMS-3.1.3-Remote-Code-Execution.html; https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/
CVE: CVE-2020-7857
Published: 2021-04-20
Description: A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of improper classes. This issue affects: Tobesoft XPlatform versions prior to 9.2.2.280.
CVSS Score: 7.5 (HIGH)
CWE: CWE-470, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36006; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36006
CVE: CVE-2021-29461
Published: 2021-04-20
Description: Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in remote code execution. This issue has been fixed in version 0.0.3. As a workaround, one may copy the code from `assets/CommandInjection.py` in the Discord Recon Server code repository and overwrite vulnerable code from one's own Discord Recon Server implementation with code that contains the patch.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-88
References: https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-3m9v-v33c-g83x; https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-3m9v-v33c-g83x
CVE: CVE-2021-29462
Published: 2021-04-20
Description: The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-345
References: http://www.openwall.com/lists/oss-security/2021/04/20/4; https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg; http://www.openwall.com/lists/oss-security/2021/04/20/4
CVE: CVE-2021-28965
Published: 2021-04-21
Description: The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
CVSS Score: 7.5 (HIGH)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/
CVE: CVE-2021-20454
Published: 2021-04-21
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196649.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196649; https://www.ibm.com/support/pages/node/6445481; https://exchange.xforce.ibmcloud.com/vulnerabilities/196649
CVE: CVE-2021-20501
Published: 2021-04-21
Description: IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server, caused by using a non-default configuration. An attacker could exploit this vulnerability to consume unnecessary network bandwidth and disk space, and allow remote attackers to send spam email. IBM X-Force ID: 198056.
CVSS Score: 8.2 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198056; https://www.ibm.com/support/pages/node/6445505; https://exchange.xforce.ibmcloud.com/vulnerabilities/198056