deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24111
Published: 2021-02-25
Description: .NET Framework Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24111; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24111
CVE: CVE-2021-24112
Published: 2021-02-25
Description: .NET Core Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24112; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24112
CVE: CVE-2021-24113
Published: 2021-02-25
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 5.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24113; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24113
CVE: CVE-2021-24114
Published: 2021-02-25
Description: Microsoft Teams iOS Information Disclosure Vulnerability
CVSS Score: 5.7 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24114; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24114
CVE: CVE-2021-25195
Published: 2021-02-25
Description: Windows PKU2U Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-25195; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-25195
CVE: CVE-2021-26700
Published: 2021-02-25
Description: Visual Studio Code npm-script Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26700; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26700
CVE: CVE-2021-26701
Published: 2021-02-25
Description: .NET Core Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5/
CVE: CVE-2021-21328
Published: 2021-02-26
Description: Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23; https://github.com/vapor/vapor/releases/tag/4.40.1; https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc
CVE: CVE-2021-23968
Published: 2021-02-26
Description: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1687342; https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html; https://security.gentoo.org/glsa/202104-09
CVE: CVE-2021-23969
Published: 2021-02-26
Description: As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1542194; https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html; https://security.gentoo.org/glsa/202104-09
CVE: CVE-2021-23970
Published: 2021-02-26
Description: Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. This vulnerability affects Firefox < 86.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1681724; https://security.gentoo.org/glsa/202104-10; https://www.mozilla.org/security/advisories/mfsa2021-07/
CVE: CVE-2021-23971
Published: 2021-02-26
Description: When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy. This would have potentially resulted in more information than intended by the original origin being provided to the destination of the redirect. This vulnerability affects Firefox < 86.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1678545; https://security.gentoo.org/glsa/202104-10; https://www.mozilla.org/security/advisories/mfsa2021-07/
CVE: CVE-2021-23972
Published: 2021-02-26
Description: One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser. This vulnerability affects Firefox < 86.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1683536; https://security.gentoo.org/glsa/202104-10; https://www.mozilla.org/security/advisories/mfsa2021-07/
CVE: CVE-2021-23973
Published: 2021-02-26
Description: When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1690976; https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html; https://security.gentoo.org/glsa/202104-09
CVE: CVE-2021-23974
Published: 2021-02-26
Description: The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86.
CVSS Score: 6.1 (MEDIUM)
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1528997%2C1683627; https://security.gentoo.org/glsa/202104-10; https://www.mozilla.org/security/advisories/mfsa2021-07/
CVE: CVE-2021-23975
Published: 2021-02-26
Description: The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox < 86.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1685145; https://security.gentoo.org/glsa/202104-10; https://www.mozilla.org/security/advisories/mfsa2021-07/
CVE: CVE-2021-23976
Published: 2021-02-26
Description: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1684627; https://security.gentoo.org/glsa/202104-10; https://www.mozilla.org/security/advisories/mfsa2021-07/
CVE: CVE-2020-24455
Published: 2021-02-26
Description: Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-909
References: https://bugzilla.redhat.com/show_bug.cgi?id=1902167; https://github.com/tpm2-software/tpm2-tss/releases/tag/2.4.3; https://github.com/tpm2-software/tpm2-tss/releases/tag/3.0.1
CVE: CVE-2021-21330
Published: 2021-02-26
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
CVSS Score: 3.1 (LOW)
CWE: CWE-601, CWE-601
References: https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25; https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96b; https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg
CVE: CVE-2021-21724
Published: 2021-02-26
Description: A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scenarios, a local attacker with device permissions repeatedly attenuated the optical signal to cause memory leak and abnormal service. This affects: ZXR10 8900E, all versions up to V3.03.20R2B30P1.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-401
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014584; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014584
CVE: CVE-2021-23953
Published: 2021-02-26
Description: If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1683940; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://www.mozilla.org/security/advisories/mfsa2021-04/
CVE: CVE-2021-23954
Published: 2021-02-26
Description: Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1684020; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://www.mozilla.org/security/advisories/mfsa2021-04/
CVE: CVE-2021-23955
Published: 2021-02-26
Description: The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability affects Firefox < 85.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1684837; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1684837
CVE: CVE-2021-23956
Published: 2021-02-26
Description: An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox < 85.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1338637; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1338637
CVE: CVE-2021-23957
Published: 2021-02-26
Description: Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.
CVSS Score: 7.4 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1584582; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1584582
CVE: CVE-2021-23958
Published: 2021-02-26
Description: The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability affects Firefox < 85.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1642747; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1642747
CVE: CVE-2021-23959
Published: 2021-02-26
Description: An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1659035; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1659035
CVE: CVE-2021-23960
Published: 2021-02-26
Description: Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1675755; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://www.mozilla.org/security/advisories/mfsa2021-04/
CVE: CVE-2021-23961
Published: 2021-02-26
Description: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85.
CVSS Score: 7.4 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1677940; https://lists.debian.org/debian-lts-announce/2021/04/msg00019.html; https://lists.debian.org/debian-lts-announce/2021/04/msg00020.html
CVE: CVE-2021-23962
Published: 2021-02-26
Description: Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox < 85.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1677194; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1677194
CVE: CVE-2021-23963
Published: 2021-02-26
Description: When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-281
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1680793; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1680793
CVE: CVE-2021-23977
Published: 2021-02-26
Description: Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directories. Note: This issue is only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-367
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1684761; https://security.gentoo.org/glsa/202104-10; https://www.mozilla.org/security/advisories/mfsa2021-07/
CVE: CVE-2019-18942
Published: 2021-02-26
Description: Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without encoding.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm; http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE: CVE-2019-18943
Published: 2021-02-26
Description: Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-611, CWE-611
References: http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm; http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE: CVE-2019-18944
Published: 2021-02-26
Description: Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm; http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE: CVE-2019-18945
Published: 2021-02-26
Description: Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm; http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE: CVE-2019-18946
Published: 2021-02-26
Description: Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-384, CWE-384
References: http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm; http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE: CVE-2019-18947
Published: 2021-02-26
Description: Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure.
CVSS Score: 3.5 (LOW)
CWE: CWE-200, CWE-209
References: http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm; http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE: CVE-2020-26200
Published: 2021-02-26
Description: A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk (KRD) and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security (KES). This issue allowed to bypass the UEFI Secure Boot security feature. An attacker would need physical access to the computer to exploit it. Otherwise, local administrator privileges would be required to modify the boot loader component.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#170221; https://github.com/CVEProject/cvelist/blob/master/2020/26xxx/CVE-2020-26200.json; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#170221
CVE: CVE-2020-28199
Published: 2021-02-26
Description: best it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://aramido.de/blog/sicherheitshinweise/sicherheitswarnung-amazon-secret-key-offentlich-einsehbar-cve-2020-28199; https://aramido.de/media/aramido-2020-006-disclosure-amazon-secret-access-key.md; https://aramido.de/blog/sicherheitshinweise/sicherheitswarnung-amazon-secret-key-offentlich-einsehbar-cve-2020-28199
CVE: CVE-2020-28646
Published: 2021-02-26
Description: ownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development plugins from certain directories when they were present.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://owncloud.com/security-advisories/cve-2020-28646/; https://owncloud.com/security-advisories/feed/; https://owncloud.com/security-advisories/cve-2020-28646/
CVE: CVE-2021-22661
Published: 2021-02-26
Description: Changing the password on the module webpage does not require the user to type in the current password first. Thus, the password could be changed by a user or external process without knowledge of the current password on the ICX35-HWC-A and ICX35-HWC-E (Versions 1.9.62 and prior).
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-056-04; https://us-cert.cisa.gov/ics/advisories/icsa-21-056-04
CVE: CVE-2021-26903
Published: 2021-02-26
Description: LMA ISIDA Retriever 5.2 is vulnerable to XSS via query['text'].
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Security-AVS/CVE-2021-26903; https://www.isida.by/category/news/; https://github.com/Security-AVS/CVE-2021-26903
CVE: CVE-2021-26904
Published: 2021-02-26
Description: LMA ISIDA Retriever 5.2 allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Security-AVS/-CVE-2021-26904; https://www.isida.by/category/news/; https://github.com/Security-AVS/-CVE-2021-26904
CVE: CVE-2021-3010
Published: 2021-02-26
Description: There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server Version 20.3. The application allows a remote attacker to introduce arbitrary JavaScript by crafting malicious form values that are later not sanitized.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49578; https://www.opentext.com/products-and-solutions/products/enterprise-content-management/content-management; https://www.exploit-db.com/exploits/49578
CVE: CVE-2019-11684
Published: 2021-02-26
Description: Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-306
References: https://psirt.bosch.com/security-advisories/bosch-sa-804652.html; https://psirt.bosch.com/security-advisories/bosch-sa-804652.html