deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-29930
Published: 2021-04-01
Description: An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A drop of uninitialized memory can sometimes occur upon a panic in T::default().
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2021-0040.html; https://rustsec.org/advisories/RUSTSEC-2021-0040.html
CVE: CVE-2021-29931
Published: 2021-04-01
Description: An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A double drop can sometimes occur upon a panic in T::drop().
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0040.html; https://rustsec.org/advisories/RUSTSEC-2021-0040.html
CVE: CVE-2021-29932
Published: 2021-04-01
Description: An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://rustsec.org/advisories/RUSTSEC-2021-0041.html; https://rustsec.org/advisories/RUSTSEC-2021-0041.html
CVE: CVE-2021-29933
Published: 2021-04-01
Description: An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0042.html; https://rustsec.org/advisories/RUSTSEC-2021-0042.html
CVE: CVE-2021-29934
Published: 2021-04-01
Description: An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-125, CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2021-0043.html; https://rustsec.org/advisories/RUSTSEC-2021-0043.html
CVE: CVE-2021-29935
Published: 2021-04-01
Description: An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
CVSS Score: 7.3 (HIGH)
CWE: CWE-416
References: https://rustsec.org/advisories/RUSTSEC-2021-0044.html; https://rustsec.org/advisories/RUSTSEC-2021-0044.html
CVE: CVE-2021-29936
Published: 2021-04-01
Description: An issue was discovered in the adtensor crate through 2021-01-11 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vector and Matrix.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2021-0045.html; https://rustsec.org/advisories/RUSTSEC-2021-0045.html
CVE: CVE-2021-29937
Published: 2021-04-01
Description: An issue was discovered in the telemetry crate through 2021-02-17 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2021-0046.html; https://rustsec.org/advisories/RUSTSEC-2021-0046.html
CVE: CVE-2021-29938
Published: 2021-04-01
Description: An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0047.html; https://rustsec.org/advisories/RUSTSEC-2021-0047.html
CVE: CVE-2021-29939
Published: 2021-04-01
Description: An issue was discovered in the stackvector crate through 2021-02-19 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain anomalous data.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2021-0048.html; https://rustsec.org/advisories/RUSTSEC-2021-0048.html
CVE: CVE-2021-29940
Published: 2021-04-01
Description: An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0049.html; https://rustsec.org/advisories/RUSTSEC-2021-0049.html
CVE: CVE-2021-29941
Published: 2021-04-01
Description: An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too small.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2021-0050.html; https://rustsec.org/advisories/RUSTSEC-2021-0050.html
CVE: CVE-2021-29942
Published: 2021-04-01
Description: An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index can return uninitialized values if an iterator returns a len() that is too large.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://rustsec.org/advisories/RUSTSEC-2021-0050.html; https://rustsec.org/advisories/RUSTSEC-2021-0050.html
CVE: CVE-2021-29083
Published: 2021-04-01
Description: Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-28918
Published: 2021-04-01
Description: Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-704
References: https://github.com/advisories/GHSA-pch5-whg9-qr2r; https://github.com/rs/node-netmask; https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
CVE: CVE-2021-20234
Published: 2021-04-01
Description: An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client that connects to multiple malicious or compromised servers to crash. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1921972; https://github.com/zeromq/libzmq/security/advisories/GHSA-wfr2-29gj-5w87; https://bugzilla.redhat.com/show_bug.cgi?id=1921972
CVE: CVE-2021-20235
Published: 2021-04-01
Description: There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1921983; https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6; https://bugzilla.redhat.com/show_bug.cgi?id=1921983
CVE: CVE-2021-20296
Published: 2021-04-01
Description: A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library, could cause a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24854; https://bugzilla.redhat.com/show_bug.cgi?id=1939141; https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html
CVE: CVE-2021-28545
Published: 2021-04-01
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are missing support for an integrity check. An unauthenticated attacker would have the ability to completely manipulate data in a certified PDF without invalidating the original certification. Exploitation of this issue requires user interaction in that a victim must open the tampered file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-353
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-28546
Published: 2021-04-01
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]8 (and earlier) and 2[PII_REDACTED]8 (and earlier) are missing support for an integrity check. An unauthenticated attacker could leverage this vulnerability to modify content in a certified PDF without invalidating the certification. Exploitation of this issue requires user interaction in that a victim must open the tampered file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-353
References: https://helpx.adobe.com/security/products/acrobat/apsb21-09.html; https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
CVE: CVE-2021-3393
Published: 2021-04-01
Description: An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://bugzilla.redhat.com/show_bug.cgi?id=1924005; https://security.gentoo.org/glsa/202105-32; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-22177
Published: 2021-04-01
Description: Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22177.json; https://gitlab.com/gitlab-org/gitlab/-/issues/238988; https://hackerone.com/reports/953444
CVE: CVE-2021-28163
Published: 2021-04-01
Description: In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
CVSS Score: 2.7 (LOW)
CWE: CWE-200, CWE-59
References: https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq; https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E; https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3E
CVE: CVE-2021-28164
Published: 2021-04-01
Description: In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-551
References: http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.html; https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5; https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E
CVE: CVE-2021-28165
Published: 2021-04-01
Description: In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-551, CWE-755, CWE-755
References: http://www.openwall.com/lists/oss-security/2021/04/20/3; https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w; https://lists.apache.org/thread.html/r002258611ed0c35b82b839d284b43db9dcdec120db8afc1c993137dc%40%3Cnotifications.zookeeper.apache.org%3E
CVE: CVE-2020-9146
Published: 2021-04-01
Description: A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local attackers can exploit this vulnerability to cause memory leakage and doS attacks by carefully constructing attack scenarios.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: https://consumer.huawei.com/cn/support/bulletin/2021/1; https://consumer.huawei.com/cn/support/bulletin/2021/1
CVE: CVE-2020-9147
Published: 2021-04-01
Description: A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local attackers may exploit this vulnerability by carefully constructing attack scenarios to cause out-of-bounds read.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://consumer.huawei.com/cn/support/bulletin/2021/1; https://consumer.huawei.com/cn/support/bulletin/2021/1
CVE: CVE-2020-9148
Published: 2021-04-01
Description: An application bypass mechanism vulnerability exists in a component interface of Huawei Smartphone. Local attackers can exploit this vulnerability to delete user SMS messages.
CVSS Score: 5.5 (MEDIUM)
References: https://consumer.huawei.com/cn/support/bulletin/2021/1; https://consumer.huawei.com/cn/support/bulletin/2021/1
CVE: CVE-2020-9149
Published: 2021-04-01
Description: An application error verification vulnerability exists in a component interface of Huawei Smartphone. Local attackers can exploit this vulnerability to modify and delete user SMS messages.
CVSS Score: 5.5 (MEDIUM)
References: https://consumer.huawei.com/cn/support/bulletin/2021/1; https://consumer.huawei.com/cn/support/bulletin/2021/1
CVE: CVE-2021-20291
Published: 2021-04-01
Description: A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-667
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939485; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5D7XL7FL24TWFMGQ3K2S72EOUSLZMKL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYOHNG2Q7DCAQZMGYLMENLKALGDLG3X/
CVE: CVE-2021-22195
Published: 2021-04-01
Description: Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22195.json; https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/issues/325; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22195.json
CVE: CVE-2021-22876
Published: 2021-04-01
Description: curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-359, CWE-200
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://curl.se/docs/CVE-2021-22876.html; https://hackerone.com/reports/1101882
CVE: CVE-2021-22890
Published: 2021-04-01
Description: curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.
CVSS Score: 3.7 (LOW)
CWE: CWE-300, CWE-290
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://curl.se/docs/CVE-2021-22890.html; https://hackerone.com/reports/1129529
CVE: CVE-2021-25924
Published: 2021-04-01
Description: In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/gocd/gocd/commit/7d0baab0d361c377af84994f95ba76c280048548; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25924%2C; https://github.com/gocd/gocd/commit/7d0baab0d361c377af84994f95ba76c280048548
CVE: CVE-2021-3447
Published: 2021-04-01
Description: A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939349; https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MS4VPUYVLGSAKOX26IT52BSMEZRZ3KS/
CVE: CVE-2020-19613
Published: 2021-04-01
Description: Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS version 20190503.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/sunkaifei/FlyCms/issues/1; https://github.com/sunkaifei/FlyCms/issues/1
CVE: CVE-2020-19616
Published: 2021-04-01
Description: Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/langhsu/mblog/issues/27; https://github.com/langhsu/mblog/issues/27
CVE: CVE-2020-19617
Published: 2021-04-01
Description: Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/langhsu/mblog/issues/27; https://github.com/langhsu/mblog/issues/27
CVE: CVE-2021-20078
Published: 2021-04-01
Description: Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.tenable.com/security/research/tra-2021-10; https://www.tenable.com/security/research/tra-2021-10
CVE: CVE-2021-21982
Published: 2021-04-01
Description: VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid authentication token. Successful exploitation of this issue would result in the attacker being able to view and alter administrative configuration settings.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://www.vmware.com/security/advisories/VMSA-2021-0005.html; https://www.vmware.com/security/advisories/VMSA-2021-0005.html
CVE: CVE-2021-26072
Published: 2021-04-01
Description: The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://jira.atlassian.com/browse/CONFSERVER-61399; https://jira.atlassian.com/browse/CONFSERVER-61399
CVE: CVE-2021-26580
Published: 2021-04-01
Description: A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). HPE has provided the following software update to resolve the vulnerability in HPE iLO Amplifier Pack: HPE iLO Amplifier Pack 1.95 or later.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04107en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04107en_us
CVE: CVE-2021-26581
Published: 2021-04-01
Description: A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be remotely exploited leaving hung connections to the BMC web interface. The monarch BMC must be rebooted to recover from this situation. Other BMC management is not impacted. HPE has made the following software update to resolve the vulnerability in HPE Superdome Flex Server: Superdome Flex Server Firmware 3.30.142 or later.
CVSS Score: 6.5 (MEDIUM)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04102en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04102en_us
CVE: CVE-2021-26718
Published: 2021-04-01
Description: KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310321; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310321
CVE: CVE-2021-27653
Published: 2021-04-01
Description: Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-284
References: https://collaborate.pega.com/discussion/pega-security-advisory-%E2%80%93-b21; https://robertwillishacking.com/census-vulnerability-exposes-10k-oauth-tokens-thousands-of-user-records/; https://collaborate.pega.com/discussion/pega-security-advisory-%E2%80%93-b21
CVE: CVE-2020-19618
Published: 2021-04-01
Description: Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/langhsu/mblog/issues/27; https://github.com/langhsu/mblog/issues/27
CVE: CVE-2020-19619
Published: 2021-04-01
Description: Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/langhsu/mblog/issues/27; https://github.com/langhsu/mblog/issues/27