deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-22947
Published: 2021-09-29
Description: When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-310, CWE-345
References: http://seclists.org/fulldisclosure/2022/Mar/29; https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://hackerone.com/reports/1334763
CVE: CVE-2021-35943
Published: 2021-09-29
Description: Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://www.couchbase.com/alerts; https://docs.couchbase.com/server/current/release-notes/relnotes.html
CVE: CVE-2021-35944
Published: 2021-09-29
Description: Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://www.couchbase.com/alerts; https://docs.couchbase.com/server/current/release-notes/relnotes.html
CVE: CVE-2021-35945
Published: 2021-09-29
Description: Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://www.couchbase.com/alerts; https://docs.couchbase.com/server/current/release-notes/relnotes.html
CVE: CVE-2021-39342
Published: 2021-09-29
Description: The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-522
References: https://plugins.trac.wordpress.org/changeset/2606811/credova-financial/trunk/credova-financial.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39342; https://plugins.trac.wordpress.org/changeset/2606811/credova-financial/trunk/credova-financial.php
CVE: CVE-2021-3653
Published: 2021-09-29
Description: A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html; https://bugzilla.redhat.com/show_bug.cgi?id=1983686; https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
CVE: CVE-2021-41764
Published: 2021-09-29
Description: A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3f; https://gist.github.com/omriinbar/[PII_REDACTED]d0edf20ef71299f304ab93; https://github.com/streamaserver/streama
CVE: CVE-2021-41795
Published: 2021-09-29
Description: The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass. By targeting a vulnerable component of this extension, a malicious web page could read a subset of 1Password vault items that would normally be fillable by the user on that web page. These items are usernames and passwords for vault items associated with its domain, usernames and passwords without a domain association, credit cards, and contact items. (1Password must be unlocked for these items to be accessible, but no further user interaction is required.)
CVSS Score: 6.5 (MEDIUM)
References: https://support.1password.com/kb/202109/; https://support.1password.com/kb/202109/
CVE: CVE-2020-20128
Published: 2021-09-29
Description: LaraCMS v1.0.1 transmits sensitive information in cleartext which can be intercepted by attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://github.com/wanglelecc/laracms/issues/33; https://github.com/wanglelecc/laracms/issues/33
CVE: CVE-2020-20129
Published: 2021-09-29
Description: LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content editor.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wanglelecc/laracms/issues/34; https://github.com/wanglelecc/laracms/issues/34
CVE: CVE-2020-20131
Published: 2021-09-29
Description: LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows atackers to execute arbitrary web scripts or HTML via a crafted payload in the page management module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wanglelecc/laracms/issues/36; https://github.com/wanglelecc/laracms/issues/36
CVE: CVE-2021-41034
Published: 2021-09-29
Description: The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.
CVSS Score: 8.1 (HIGH)
CWE: CWE-924, CWE-924
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989; https://bugs.eclipse.org/bugs/show_bug.cgi?id=540989
CVE: CVE-2020-20781
Published: 2021-09-29
Description: A stored cross-site scripting (XSS) vulnerability in /ucms/index.php?do=list_edit of UCMS 1.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the title, key words, description or content text fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/forget-code/ucms/issues/1; https://github.com/forget-code/ucms/issues/1
CVE: CVE-2021-41821
Published: 2021-09-29
Description: Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial of service. A crafted message must be sent from an authenticated agent to the manager.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-191
References: https://documentation.wazuh.com/current/release-notes/release_4_2_0.html; https://github.com/wazuh/wazuh/issues/9201; https://documentation.wazuh.com/current/release-notes/release_4_2_0.html
CVE: CVE-2021-41824
Published: 2021-09-30
Description: Craft CMS before 3.7.14 allows CSV injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28; https://github.com/craftcms/cms/security/advisories/GHSA-h7vq-5qgw-jwwq; https://twitter.com/craftcmsupdates/status/[PII_REDACTED]45366018
CVE: CVE-2021-41826
Published: 2021-09-30
Description: PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/164345/PlaceOS-1.2109.1-Open-Redirection.html; https://github.com/PlaceOS/auth/issues/36; http://packetstormsecurity.com/files/164345/PlaceOS-1.2109.1-Open-Redirection.html
CVE: CVE-2020-18683
Published: 2021-09-30
Description: Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://drive.google.com/open?id=15I75JBmFYB9rLm9ZvcFtjHy0e2a-9lyO; https://drive.google.com/open?id=15I75JBmFYB9rLm9ZvcFtjHy0e2a-9lyO
CVE: CVE-2020-18684
Published: 2021-09-30
Description: Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://drive.google.com/open?id=1310MS7djRfF0N2YmmzVTs8x5oJuHQVX5; https://drive.google.com/open?id=1310MS7djRfF0N2YmmzVTs8x5oJuHQVX5
CVE: CVE-2020-18685
Published: 2021-09-30
Description: Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP ports, or group or table IDs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://drive.google.com/open?id=1oIt6jViGxLALUkLVELsQpC26MJYFZt2U; https://drive.google.com/open?id=1oIt6jViGxLALUkLVELsQpC26MJYFZt2U
CVE: CVE-2021-41827
Published: 2021-09-30
Description: Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds to the DCBackupRestore JAR archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://medium.com/nestedif/vulnerability-disclosure-hardcoded-keys-password-zoho-r-a-p-318aa9bba2e; https://www.manageengine.com/remote-desktop-management/hotfix-readme.html; https://medium.com/nestedif/vulnerability-disclosure-hardcoded-keys-password-zoho-r-a-p-318aa9bba2e
CVE: CVE-2021-41828
Published: 2021-09-30
Description: Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://medium.com/nestedif/vulnerability-disclosure-hardcoded-keys-password-zoho-r-a-p-318aa9bba2e; https://www.manageengine.com/remote-desktop-management/hotfix-readme.html; https://medium.com/nestedif/vulnerability-disclosure-hardcoded-keys-password-zoho-r-a-p-318aa9bba2e
CVE: CVE-2021-41829
Published: 2021-09-30
Description: Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://medium.com/nestedif/vulnerability-disclosure-statically-derived-encryption-key-zoho-r-a-p[PII_REDACTED]97; https://www.manageengine.com/remote-desktop-management/hotfix-readme.html; https://medium.com/nestedif/vulnerability-disclosure-statically-derived-encryption-key-zoho-r-a-p[PII_REDACTED]97
CVE: CVE-2021-25963
Published: 2021-09-30
Description: In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/shuup/shuup/commit/75714c37e32796eb7cbb0d977af5bcaa26573588; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25963; https://github.com/shuup/shuup/commit/75714c37e32796eb7cbb0d977af5bcaa26573588
CVE: CVE-2021-41616
Published: 2021-09-30
Description: Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used ObjectInputStream.readObject without validating that the input data was safe to deserialize. Please note that DdlUtils is no longer being actively developed. To address the insecurity of the BinaryObjectHelper class, the following changes to DdlUtils have been made: (1) BinaryObjectsHelper.java has been deleted from the DdlUtils source repository and the DdlUtils feature of propagating data of SQL binary types is therefore no longer present in DdlUtils; (2) The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure; (3) The DdlUtils web site has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread.html/r3d7a8303a820144f5e2d1fd0b067e18d419421b58346b53b58d3fa72%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/r3d7a8303a820144f5e2d1fd0b067e18d419421b58346b53b58d3fa72%40%3Cannounce.apache.org%3E
CVE: CVE-2021-41290
Published: 2021-09-30
Description: ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-22
References: https://www.twcert.org.tw/tw/cp-132-5126-ca315-1.html; https://www.twcert.org.tw/tw/cp-132-5126-ca315-1.html
CVE: CVE-2021-41291
Published: 2021-09-30
Description: ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.twcert.org.tw/tw/cp-132-5127-3cbd3-1.html; https://www.twcert.org.tw/tw/cp-132-5127-3cbd3-1.html
CVE: CVE-2021-41292
Published: 2021-09-30
Description: ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://www.twcert.org.tw/tw/cp-132-5128-b075a-1.html; https://www.twcert.org.tw/tw/cp-132-5128-b075a-1.html
CVE: CVE-2021-41293
Published: 2021-09-30
Description: ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.twcert.org.tw/tw/cp-132-5129-7e623-1.html; https://www.twcert.org.tw/tw/cp-132-5129-7e623-1.html
CVE: CVE-2021-41294
Published: 2021-09-30
Description: ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.twcert.org.tw/tw/cp-132-5130-7de92-1.html; https://www.twcert.org.tw/tw/cp-132-5130-7de92-1.html
CVE: CVE-2021-41295
Published: 2021-09-30
Description: ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands (GET, POST, PUT, DELETE) to perform arbitrary operations in the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.twcert.org.tw/tw/cp-132-5131-c653b-1.html; https://www.twcert.org.tw/tw/cp-132-5131-c653b-1.html
CVE: CVE-2021-41296
Published: 2021-09-30
Description: ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://www.twcert.org.tw/tw/cp-132-5132-65705-1.html; https://www.twcert.org.tw/tw/cp-132-5132-65705-1.html
CVE: CVE-2021-41297
Published: 2021-09-30
Description: ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts in plain-text.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://www.twcert.org.tw/tw/cp-132-5133-f3c4b-1.html; https://www.twcert.org.tw/tw/cp-132-5133-f3c4b-1.html
CVE: CVE-2021-41298
Published: 2021-09-30
Description: ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-639
References: https://www.twcert.org.tw/tw/cp-132-5134-39f74-1.html; https://www.twcert.org.tw/tw/cp-132-5134-39f74-1.html
CVE: CVE-2021-41299
Published: 2021-09-30
Description: ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.twcert.org.tw/tw/cp-132-5135-a9f5c-1.html; https://www.twcert.org.tw/tw/cp-132-5135-a9f5c-1.html
CVE: CVE-2021-41300
Published: 2021-09-30
Description: ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-522
References: https://www.twcert.org.tw/tw/cp-132-5136-3e315-1.html; https://www.twcert.org.tw/tw/cp-132-5136-3e315-1.html
CVE: CVE-2021-41301
Published: 2021-09-30
Description: ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-639
References: https://www.twcert.org.tw/tw/cp-132-5137-730a6-1.html; https://www.twcert.org.tw/tw/cp-132-5137-730a6-1.html
CVE: CVE-2021-41302
Published: 2021-09-30
Description: ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege.
CVSS Score: 7.3 (HIGH)
CWE: CWE-311, CWE-312
References: https://www.twcert.org.tw/tw/cp-132-5138-d40ae-1.html; https://www.twcert.org.tw/tw/cp-132-5138-d40ae-1.html
CVE: CVE-2021-41729
Published: 2021-09-30
Description: BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the server through /user/ppsave.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://github.com/meiko-S/BaiCloud-cms/issues/3; https://github.com/meiko-S/BaiCloud-cms/issues/3
CVE: CVE-2021-41720
Published: 2021-09-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-21089
Published: 2021-09-30
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are affected by an out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to locally escalate privileges in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-41109
Published: 2021-09-30
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/parse-community/parse-server/commit/4ac4b7f71002ed4fbedbb901db1f6ed1e9ac5559; https://github.com/parse-community/parse-server/releases/tag/4.10.4; https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x
CVE: CVE-2021-24016
Published: 2021-09-30
Description: An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.
CVSS Score: 3.7 (LOW)
CWE: CWE-1236
References: https://fortiguard.com/advisory/FG-IR-20-190; https://fortiguard.com/advisory/FG-IR-20-190
CVE: CVE-2021-24017
Published: 2021-09-30
Description: An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://fortiguard.com/advisory/FG-IR-20-189; https://fortiguard.com/advisory/FG-IR-20-189
CVE: CVE-2020-20662
Published: 2021-09-30
Description: libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_example1.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/fcovatti/libiec_iccp_mod/issues/6; https://github.com/fcovatti/libiec_iccp_mod/issues/6
CVE: CVE-2020-20663
Published: 2021-09-30
Description: libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_connection.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/fcovatti/libiec_iccp_mod/issues/7; https://github.com/fcovatti/libiec_iccp_mod/issues/7
CVE: CVE-2020-20664
Published: 2021-09-30
Description: libiec_iccp_mod v1.5 contains a segmentation violation in the component server_example1.c.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/fcovatti/libiec_iccp_mod/issues/8; https://github.com/fcovatti/libiec_iccp_mod/issues/8
CVE: CVE-2020-20665
Published: 2021-09-30
Description: rudp v0.6 was discovered to contain a memory leak in the component main.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://cwe.mitre.org/data/definitions/401.html; https://github.com/cloudwu/rudp/issues/6; https://cwe.mitre.org/data/definitions/401.html
CVE: CVE-2021-20554
Published: 2021-09-30
Description: IBM Sterling Order Management 9.4, 9.5, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199179.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199179; https://www.ibm.com/support/pages/node/6493881; https://exchange.xforce.ibmcloud.com/vulnerabilities/199179