deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-43006
Published: 2021-12-07
Description: AmZetta Amzetta zPortal DVM Tools is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amzetta zPortal DVM Tools <= v3.3.148.148 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2021-43637
Published: 2021-12-07
Description: Amazon WorkSpaces agent is affected by Buffer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2021-43638
Published: 2021-12-07
Description: Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2020-27356
Published: 2021-12-07
Description: The debug-meta-data plugin 1.1.2 for WordPress allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ahmadawais/debug-meta-data/blob/master/changelog.md; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0009/MNDT-2021-0009.md; https://wordpress.org/plugins/debug-meta-data/#developers
CVE: CVE-2021-28680
Published: 2021-12-07
Description: The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.
CVSS Score: 8.1 (HIGH)
References: https://github.com/oivoodoo/devise_masquerade/issues/83; https://labanskoller.se/blog/2021/03/23/the-devise-extension-that-peeled-off-one-layer-of-the-security-onion-cve-2021-28680/; https://github.com/oivoodoo/devise_masquerade/issues/83
CVE: CVE-2021-34543
Published: 2021-12-07
Description: The web administration server in Solar-Log 500 before 2.8.2 Build 52 does not require authentication, which allows remote attackers to gain administrative privileges by connecting to the server. As a result, the attacker can modify configuration files and change the system status. Fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://drive.google.com/file/d/1z1TaANlDyX4SOP2vjNzkPQI3nETL9kZM/view?usp=sharing; https://www.exploit-db.com/exploits/49986; https://www.solar-log.com/en/support/firmware/
CVE: CVE-2021-34544
Published: 2021-12-07
Description: An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may allow sensitive information to be read by someone with access to the device. Fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://drive.google.com/file/d/1N8Ch1UGNcoocUaPhOe_1mAECOe5kr4pt/view?usp=sharing; https://www.exploit-db.com/exploits/49987; https://www.solar-log.com/en/support/firmware/
CVE: CVE-2021-36133
Published: 2021-12-07
Description: The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0001-OP-TEE_TrustZone_bypass.txt; https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0001-OP-TEE_TrustZone_bypass.txt
CVE: CVE-2021-36760
Published: 2021-12-07
Description: In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.wso2.com/display/Security/2021+Advisories; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1314; https://docs.wso2.com/display/Security/2021+Advisories
CVE: CVE-2021-38759
Published: 2021-12-07
Description: Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: http://packetstormsecurity.com/files/165211/Raspberry-Pi-5.10-Default-Credentials.html; https://arstechnica.com/gadgets/2022/04/raspberry-pi-os-axes-longstanding-default-user-account-in-the-name-of-security/; https://www.cnvd.org.cn/flaw/show/CNVD-2021-43968
CVE: CVE-2021-42681
Published: 2021-12-07
Description: A Buffer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105. The IOCTL Handler 0x22001B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2021-42682
Published: 2021-12-07
Description: An Integer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105 .The IOCTL Handler 0x22001B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2021-42683
Published: 2021-12-07
Description: A Buffer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. The IOCTL Handler 0x22001B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2021-42685
Published: 2021-12-07
Description: An Integer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105 . The IOCTL Handler 0x22005B in the Accops HyWorks DVM Tools prior to v3.3.1.105 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2021-42686
Published: 2021-12-07
Description: An Integer Overflow exists in Accops HyWorks Windows Client prior to v 3.2.8.200. The IOCTL Handler 0x22001B in the Accops HyWorks Windows Client prior to v 3.2.8.200 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2021-42687
Published: 2021-12-07
Description: A Buffer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. The IOCTL Handler 0x22005B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2021-42688
Published: 2021-12-07
Description: An Integer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. The IOCTL Handler 0x22005B in the Accops HyWorks Windows Client prior to v 3.2.8.200 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/; https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
CVE: CVE-2021-44149
Published: 2021-12-07
Description: An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle.
CVSS Score: 7.8 (HIGH)
References: https://github.com/OP-TEE/optee_os/tags; https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0002-OP-TEE_TrustZone_bypass_at_wakeup.txt; https://github.com/OP-TEE/optee_os/tags
CVE: CVE-2021-40578
Published: 2021-12-07
Description: Authenticated Blind & Error-based SQL injection vulnerability was discovered in Online Enrollment Management System in PHP and PayPal Free Source Code 1.0, that allows attackers to obtain sensitive information and execute arbitrary SQL commands via IDNO parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System; https://medium.com/%40J03KR/cve-2021-40578-127ceaf3f1bb; https://www.nu11secur1ty.com/2021/12/online-enrollment-management-system-sql.html
CVE: CVE-2021-42567
Published: 2021-12-07
Description: Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://apereo.github.io/2021/10/18/restvuln/; https://github.com/apereo/cas/releases; https://apereo.github.io/2021/10/18/restvuln/
CVE: CVE-2021-42717
Published: 2021-12-07
Description: ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://lists.debian.org/debian-lts-announce/2022/05/msg00042.html; https://www.debian.org/security/2021/dsa-5023; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2021-43810
Published: 2021-12-07
Description: Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21; https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b; https://github.com/Admidio/admidio/releases/tag/v4.0.12
CVE: CVE-2021-43963
Published: 2021-12-07
Description: An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain write access. (This issue does not affect clusters where Sync Gateway is authenticated with X.509 client certificates. This issue also does not affect clusters where shared bucket access is not enabled on Sync Gateway.)
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://www.couchbase.com/alerts; https://www.couchbase.com/alerts
CVE: CVE-2021-44148
Published: 2021-12-07
Description: GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://beaugraham.com/CVE-2021-44148-xss.html; https://beaugraham.com/CVE-2021-44148-xss.html
CVE: CVE-2021-43808
Published: 2021-12-08
Description: Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-327
References: https://github.com/laravel/framework/commit/b8174169b1807f36de[PII_REDACTED]e2828ceddb9b; https://github.com/laravel/framework/pull/39906; https://github.com/laravel/framework/pull/39908
CVE: CVE-2021-44420
Published: 2021-12-08
Description: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
CVSS Score: 7.3 (HIGH)
References: https://docs.djangoproject.com/en/3.2/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
CVE: CVE-2020-22421
Published: 2021-12-08
Description: 74CMS v6.0.4 was discovered to contain a cross-site scripting (XSS) vulnerability via /index.php?m=&c=help&a=help_list&key.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/congcong9184-123/congcong9184-123.github.io/blob/master/74cms.docx; https://github.com/congcong9184-123/congcong9184-123.github.io/blob/master/74cms.docx
CVE: CVE-2021-3370
Published: 2021-12-08
Description: DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/congcong9184-123/congcong9184-123.github.io/blob/master/douphp_xss.docx; https://github.com/congcong9184-123/congcong9184-123.github.io/blob/master/douphp_xss.docx
CVE: CVE-2021-41309
Published: 2021-12-08
Description: Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The affected versions of Jira Server and Data Center are before version 8.19.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://jira.atlassian.com/browse/JRASERVER-72803; https://jira.atlassian.com/browse/JRASERVER-72803
CVE: CVE-2021-41311
Published: 2021-12-08
Description: Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://jira.atlassian.com/browse/JRASERVER-72802; https://jira.atlassian.com/browse/JRASERVER-72802
CVE: CVE-2021-44725
Published: 2021-12-08
Description: KNIME Server before 4.13.4 allows directory traversal in a request for a client profile.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://docs.knime.com/2021-06/server_update_guide/index.html#_bugfixes; https://zigrin.com/advisories/knime-server-directory-path-traversal-in-the-profiles-section/; https://docs.knime.com/2021-06/server_update_guide/index.html#_bugfixes
CVE: CVE-2021-44726
Published: 2021-12-08
Description: KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://docs.knime.com/2021-06/server_update_guide/index.html#_bugfixes; https://zigrin.com/advisories/knime-server-dom-based-xss-in-a-login-panel/; https://docs.knime.com/2021-06/server_update_guide/index.html#_bugfixes
CVE: CVE-2018-25020
Published: 2021-12-08
Description: The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.c and net/core/filter.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html; https://github.com/torvalds/linux/commit/050fad7c4534c13c8eb1d9c2ba66012e014773cb; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-20038
Published: 2021-12-08
Description: A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://github.com/jbaines-r7/badblood; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026; https://www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2/
CVE: CVE-2021-20039
Published: 2021-12-08
Description: Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/165563/SonicWall-SMA-100-Series-Authenticated-Command-Injection.html; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026; http://packetstormsecurity.com/files/165563/SonicWall-SMA-100-Series-Authenticated-Command-Injection.html
CVE: CVE-2021-20040
Published: 2021-12-08
Description: A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE: CVE-2021-20041
Published: 2021-12-08
Description: An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles resulting in a loop with unreachable exit condition. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE: CVE-2021-20042
Published: 2021-12-08
Description: An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-441
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
CVE: CVE-2021-20043
Published: 2021-12-08
Description: A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the nobody user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026