deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27242
Published: 2021-03-29
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11926.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-209/; https://kb.parallels.com/en/125013
CVE: CVE-2021-27243
Published: 2021-03-29
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-11924.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-210/; https://kb.parallels.com/en/125013
CVE: CVE-2021-27244
Published: 2021-03-29
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-11925.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-211/; https://kb.parallels.com/en/125013
CVE: CVE-2021-27245
Published: 2021-03-29
Description: This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(US)_V5_200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue results from the lack of proper filtering of IPv6 SSH connections. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-12309.
CVSS Score: 8.1 (HIGH)
CWE: CWE-693
References: https://www.zerodayinitiative.com/advisories/ZDI-21-214/; https://www.zerodayinitiative.com/advisories/ZDI-21-214/
CVE: CVE-2021-27272
Published: 2021-03-29
Description: This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ReportTemplateController class. When parsing the path parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12123.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://kb.netgear.com/000062723/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0537; https://www.zerodayinitiative.com/advisories/ZDI-21-355/; https://kb.netgear.com/000062723/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0537
CVE: CVE-2021-27273
Published: 2021-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SettingConfigController class. When parsing the fileName parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-12121.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://kb.netgear.com/000062686/Security-Advisory-for-Post-Authentication-Command-Injection-on-NMS300-PSV-2020-0559; https://www.zerodayinitiative.com/advisories/ZDI-21-356/; https://kb.netgear.com/000062686/Security-Advisory-for-Post-Authentication-Command-Injection-on-NMS300-PSV-2020-0559
CVE: CVE-2021-27274
Published: 2021-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MFileUploadController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-12124.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://kb.netgear.com/000062688/Security-Advisory-for-Pre-Authentication-Command-Injection-on-NMS300-PSV-2020-0560; https://www.zerodayinitiative.com/advisories/ZDI-21-357/; https://kb.netgear.com/000062688/Security-Advisory-for-Pre-Authentication-Command-Injection-on-NMS300-PSV-2020-0560
CVE: CVE-2021-27275
Published: 2021-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ConfigFileController class. When parsing the realName parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information or to create a denial-of-service condition on the system. Was ZDI-CAN-12125.
CVSS Score: 8.3 (HIGH)
CWE: CWE-22
References: https://kb.netgear.com/000062687/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0561; https://www.zerodayinitiative.com/advisories/ZDI-21-358/; https://kb.netgear.com/000062687/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0561
CVE: CVE-2021-27276
Published: 2021-03-29
Description: This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the MibController class. When parsing the realName parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12122.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://kb.netgear.com/000062722/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0500; https://www.zerodayinitiative.com/advisories/ZDI-21-359/; https://kb.netgear.com/000062722/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0500
CVE: CVE-2021-28671
Published: 2021-03-29
Description: Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Bridge), B405 before 38.65.51 and 38.59.01 (Bridge), B600/B610 before 32.65.51 and 32.59.01 (Bridge), B605/B615 before 33.65.51 and 33.59.01 (Bridge), B7025/30/35 before 58.65.51 and 58.59.11 (Bridge), C400 before 67.65.51 and 67.59.01 (Bridge), C405 before 68.65.51 and 68.59.01 (Bridge), C500/C600 before 61.65.51 and 61.59.01 (Bridge), C505/C605 before 62.65.51 and 62.59.01 (Bridge), C7000 before 56.65.51 and 56.59.01 (Bridge), C7020/25/30 before 57.65.51 and 57.59.01 (Bridge), C8000/C9000 before 70.65.51 and 70.59.01 (Bridge), C8000W before 72.65.51 have a remote Command Execution vulnerability in the Web User Interface that allows remote attackers with "a weaponized clone file" to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
References: https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX21D_for_PH6510_WC6515_VersaLink-1.pdf; https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX21D_for_PH6510_WC6515_VersaLink-1.pdf
CVE: CVE-2021-28672
Published: 2021-03-29
Description: Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Bridge), B405 before 38.65.51 and 38.59.01 (Bridge), B600/B610 before 32.65.51 and 32.59.01 (Bridge), B605/B615 before 33.65.51 and 33.59.01 (Bridge), B7025/30/35 before 58.65.51 and 58.59.11 (Bridge), C400 before 67.65.51 and 67.59.01 (Bridge), C405 before 68.65.51 and 68.59.01 (Bridge), C500/C600 before 61.65.51 and 61.59.01 (Bridge), C505/C605 before 62.65.51 and 62.59.01 (Bridge), C7000 before 56.65.51 and 56.59.01 (Bridge), C7020/25/30 before 57.65.51 and 57.59.01 (Bridge), C8000/C9000 before 70.65.51 and 70.59.01 (Bridge), C8000W before 72.65.51 allows remote attackers to execute arbitrary code through a buffer overflow in Web page parameter handling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX21D_for_PH6510_WC6515_VersaLink-1.pdf; https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX21D_for_PH6510_WC6515_VersaLink-1.pdf
CVE: CVE-2021-25145
Published: 2021-03-30
Description: A remote unauthorized disclosure of information vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aruba Instant 8.7.x: 8.7.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2021-25148
Published: 2021-03-30
Description: A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.4 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 8.1 (HIGH)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2021-25149
Published: 2021-03-30
Description: A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2021-25146
Published: 2021-03-30
Description: A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aruba Instant 8.7.x: 8.7.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2021-25150
Published: 2021-03-30
Description: A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.4 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2021-25155
Published: 2021-03-30
Description: A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.6 and below; Aruba Instant 8.7.x: 8.7.1.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
References: http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html; http://packetstormsecurity.com/files/163524/Aruba-Instant-8.7.1.0-Arbitrary-File-Modification.html; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2018-1107
Published: 2021-03-30
Description: It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1546357; https://snyk.io/vuln/npm:is-my-json-valid:20180214; https://bugzilla.redhat.com/show_bug.cgi?id=1546357
CVE: CVE-2018-1109
Published: 2021-03-30
Description: A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-185, CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1547272; https://snyk.io/vuln/npm:braces:20180219; https://bugzilla.redhat.com/show_bug.cgi?id=1547272
CVE: CVE-2018-1110
Published: 2021-03-30
Description: A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1944328; https://www.knot-resolver.cz/2018-04-23-knot-resolver-2.3.0.html; https://bugzilla.redhat.com/show_bug.cgi?id=1944328
CVE: CVE-2019-5319
Published: 2021-03-30
Description: A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2021-25156
Published: 2021-03-30
Description: A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.6 and below; Aruba Instant 8.7.x: 8.7.1.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 4.9 (MEDIUM)
References: http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt
CVE: CVE-2021-25157
Published: 2021-03-30
Description: A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.6 and below; Aruba Instant 8.7.x: 8.7.1.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 4.9 (MEDIUM)
References: http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt
CVE: CVE-2021-25158
Published: 2021-03-30
Description: A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt
CVE: CVE-2021-25159
Published: 2021-03-30
Description: A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
References: http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt
CVE: CVE-2021-25160
Published: 2021-03-30
Description: A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 4.9 (MEDIUM)
References: http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt
CVE: CVE-2021-25161
Published: 2021-03-30
Description: A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt
CVE: CVE-2021-25162
Published: 2021-03-30
Description: A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt
CVE: CVE-2020-19639
Published: 2021-03-30
Description: Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://xn--sb-lka.org/cve/INSMA.txt; https://xn--sb-lka.org/cve/INSMA.txt
CVE: CVE-2020-19640
Published: 2021-03-30
Description: An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. An unauthenticated attacker can reboot the device causing a Denial of Service, via a hidden reboot command to '/media/?action=cmd'.
CVSS Score: 7.5 (HIGH)
References: https://xn--sb-lka.org/cve/INSMA.txt; https://xn--sb-lka.org/cve/INSMA.txt
CVE: CVE-2020-19641
Published: 2021-03-30
Description: An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. Authenticated attackers with the "Operator" Privilege can gain admin privileges via a crafted request to '/goform/formUserMng'.
CVSS Score: 8.8 (HIGH)
References: https://xn--sb-lka.org/cve/INSMA.txt; https://xn--sb-lka.org/cve/INSMA.txt
CVE: CVE-2020-19642
Published: 2021-03-30
Description: An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. A local attacker can execute arbitrary code via editing the 'recdata.db' file to call a specially crafted GoAhead ASP-file on the SD card.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-434
References: https://xn--sb-lka.org/cve/INSMA.txt; https://xn--sb-lka.org/cve/INSMA.txt
CVE: CVE-2020-19643
Published: 2021-03-30
Description: Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://xn--sb-lka.org/cve/INSMA.txt; https://xn--sb-lka.org/cve/INSMA.txt