deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-29906
Published: 2021-10-08
Description: IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to a local user when it is configured to use an IBM Cloud API key to connect to cloud-based connectors. IBM X-Force ID: 207630.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/207630; https://www.ibm.com/support/pages/node/6497177; https://exchange.xforce.ibmcloud.com/vulnerabilities/207630
CVE: CVE-2021-42109
Published: 2021-10-08
Description: VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://whitehoodhacker.net/posts/2021-10-04-the-big-rick; https://www.exterity.com; https://whitehoodhacker.net/posts/2021-10-04-the-big-rick
CVE: CVE-2020-22617
Published: 2021-10-08
Description: Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/Ardour/ardour/commit/96daa4036a; https://tracker.ardour.org/view.php?id=7926; https://github.com/Ardour/ardour/commit/96daa4036a
CVE: CVE-2021-30625
Published: 2021-10-08
Description: Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a malicious website to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html; https://crbug.com/1237533; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-30626
Published: 2021-10-08
Description: Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html; https://crbug.com/1241036; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-30627
Published: 2021-10-08
Description: Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html; https://crbug.com/1245786; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-30628
Published: 2021-10-08
Description: Stack buffer overflow in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html; https://crbug.com/1241123; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-30629
Published: 2021-10-08
Description: Use after free in Permissions in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html; https://crbug.com/1243646; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-30630
Published: 2021-10-08
Description: Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html; https://crbug.com/1244568; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-30632
Published: 2021-10-08
Description: Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/172845/Chrome-JIT-Compiler-Type-Confusion.html; https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html; https://crbug.com/1247763
CVE: CVE-2021-30633
Published: 2021-10-08
Description: Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html; https://crbug.com/1247766; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-42112
Published: 2021-10-08
Description: The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.limesurvey.org/view.php?id=17562; https://github.com/LimeSurvey/LimeSurvey/commit/d56619a50cfd191bbffd0adb660638a5e438070d; https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_limesurvey_-_cve-2021-42112.pdf
CVE: CVE-2021-37956
Published: 2021-10-08
Description: Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1243117; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37957
Published: 2021-10-08
Description: Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1242269; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37958
Published: 2021-10-08
Description: Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page.
CVSS Score: 5.4 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1223290; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37959
Published: 2021-10-08
Description: Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1229625; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37961
Published: 2021-10-08
Description: Use after free in Tab Strip in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1228557; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37962
Published: 2021-10-08
Description: Use after free in Performance Manager in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1231933; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37963
Published: 2021-10-08
Description: Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1199865; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37964
Published: 2021-10-08
Description: Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
CVSS Score: 3.3 (LOW)
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1203612; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37965
Published: 2021-10-08
Description: Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1239709; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37966
Published: 2021-10-08
Description: Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1238944; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37967
Published: 2021-10-08
Description: Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1243622; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37968
Published: 2021-10-08
Description: Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1245053; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37969
Published: 2021-10-08
Description: Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local privilege escalation via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1245879; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37970
Published: 2021-10-08
Description: Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1248030; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37971
Published: 2021-10-08
Description: Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1219354; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37972
Published: 2021-10-08
Description: Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html; https://crbug.com/1234259; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37973
Published: 2021-10-08
Description: Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_24.html; https://crbug.com/1251727; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-37974
Published: 2021-10-08
Description: Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html; https://crbug.com/1245578; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D63JZ3ROXCUHP4CFWDHCPZNTGET7T34R/
CVE: CVE-2021-37975
Published: 2021-10-08
Description: Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/172847/Chrome-V8-Logic-Bug-Use-After-Free.html; https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html; https://crbug.com/1252918
CVE: CVE-2021-37976
Published: 2021-10-08
Description: Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html; https://crbug.com/1251787; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D63JZ3ROXCUHP4CFWDHCPZNTGET7T34R/
CVE: CVE-2021-25966
Published: 2021-10-10
Description: In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613, CWE-613
References: https://github.com/OrchardCMS/OrchardCore/blob/v1.0.0/src/OrchardCore.Modules/OrchardCore.Users/Controllers/ResetPasswordController.cs#L123; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25966; https://github.com/OrchardCMS/OrchardCore/blob/v1.0.0/src/OrchardCore.Modules/OrchardCore.Users/Controllers/ResetPasswordController.cs#L123
CVE: CVE-2021-42134
Published: 2021-10-11
Description: The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/adamghill/django-unicorn/commit/3a832a9e3f6455ddd3b87f[PII_REDACTED]18ad10c6; https://github.com/adamghill/django-unicorn/compare/0.36.0...0.36.1; https://github.com/adamghill/django-unicorn/commit/3a832a9e3f6455ddd3b87f[PII_REDACTED]18ad10c6
CVE: CVE-2021-41055
Published: 2021-10-11
Description: Gajim 1.2.x and 1.3.x before 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted XMPP Last Message Correction (XEP-0308) message in multi-user chat, where the message ID equals the correction ID.
CVSS Score: 7.5 (HIGH)
References: https://dev.gajim.org/gajim/gajim/-/issues/10638; https://dev.gajim.org/gajim/gajim/-/tags/gajim-1.3.3; https://dev.gajim.org/gajim/gajim/-/issues/10638
CVE: CVE-2021-42135
Published: 2021-10-11
Description: HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards/; https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards/
CVE: CVE-2021-42137
Published: 2021-10-11
Description: An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://zammad.com/en/advisories/zaa-2021-19; https://zammad.com/en/advisories/zaa-2021-19
CVE: CVE-2021-42139
Published: 2021-10-11
Description: Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/denoland/deno_std/pull/1275; https://github.com/denoland/deno_std/releases/tag/0.107.0; https://vuln.ryotak.me/advisories/58
CVE: CVE-2021-41798
Published: 2021-10-11
Description: MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on the Special:Search results page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/
CVE: CVE-2021-41799
Published: 2021-10-11
Description: MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=query&list=backlinks) can cause a full table scan.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/
CVE: CVE-2021-41800
Published: 2021-10-11
Description: MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/wikimedia/mediawiki/commit/781caf83dba90c18349f930bbaaa0e89f003f874; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
CVE: CVE-2021-41801
Published: 2021-10-11
Description: The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog)
CVSS Score: 8.8 (HIGH)
References: https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/; https://phabricator.wikimedia.org/T279090; https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
CVE: CVE-2021-41830
Published: 2021-10-11
Description: It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25633 for the LibreOffice advisory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347, CWE-347
References: https://lists.apache.org/thread.html/r97d287c88881aa581f1b18cb01e2cbedc4e6eae85958491acb89b12e%40%3Cusers.openoffice.apache.org%3E; https://lists.apache.org/thread.html/raaab8a3b91f8d7b7ba14f873b8d0fd13952c823acc3385b7a374e754%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/r97d287c88881aa581f1b18cb01e2cbedc4e6eae85958491acb89b12e%40%3Cusers.openoffice.apache.org%3E
CVE: CVE-2021-41831
Published: 2021-10-11
Description: It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25634 for the LibreOffice advisory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://lists.apache.org/thread.html/ra74d5057cdc781a36286a83e8bcbc90a7678f030ae73339c35dfc4f9%40%3Cusers.openoffice.apache.org%3E; https://lists.apache.org/thread.html/rc5c277cb83e335696657c5f27da1d1e2b5cb48346b0b55415a233757%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/ra74d5057cdc781a36286a83e8bcbc90a7678f030ae73339c35dfc4f9%40%3Cusers.openoffice.apache.org%3E