deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28495
Published: 2021-09-09
Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed when API access is enabled via the JSON-RPC APIs. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.13 and post releases in the MOS-0.1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in the MOS-0.3x train
CVSS Score: 7.2 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.arista.com/en/support/advisories-notices/security-advisories/12914-security-advisory-66; https://www.arista.com/en/support/advisories-notices/security-advisories/12914-security-advisory-66
CVE: CVE-2021-28497
Published: 2021-09-09
Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible to unprivileged users in situations where they should not have access. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in the MOS-0.3x train
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: https://www.arista.com/en/support/advisories-notices/security-advisories/12913-security-advisory-65; https://www.arista.com/en/support/advisories-notices/security-advisories/12913-security-advisory-65
CVE: CVE-2021-28498
Published: 2021-09-09
Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text could result in unprivileged users getting complete access to the systems. This issue affects: Arista Metamako Operating System MOS-0.13 and post releases in the MOS-0.1x train MOS-0.26.6 and prior releases in the MOS-0.2x train MOS-0.31.1 and prior releases in the MOS-0.3x train
CVSS Score: 8.7 (HIGH)
CWE: CWE-255, CWE-522
References: https://www.arista.com/en/support/advisories-notices/security-advisories/12912-security-advisory-64; https://www.arista.com/en/support/advisories-notices/security-advisories/12912-security-advisory-64
CVE: CVE-2021-28499
Published: 2021-09-09
Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text could leak to users without any password. This issue affects: Arista Metamako Operating System MOS-0.18 and post releases in the MOS-0.1x train All releases in the MOS-0.2x train MOS-0.31.1 and prior releases in the MOS-0.3x train
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-255, CWE-522
References: https://www.arista.com/en/support/advisories-notices/security-advisories/12912-security-advisory-64; https://www.arista.com/en/support/advisories-notices/security-advisories/12912-security-advisory-64
CVE: CVE-2021-37101
Published: 2021-09-09
Description: There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00). Due to improper authorization mangement, an attakcer can exploit this vulnerability by physical accessing the device and implant malicious code. Successfully exploit could leads to arbitrary code execution in the target device.
CVSS Score: 6.8 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en
CVE: CVE-2021-3761
Published: 2021-09-09
Description: Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/cloudflare/cfrpki/security/advisories/GHSA-c8xp-8mf3-62h9; https://www.debian.org/security/2022/dsa-5041; https://github.com/cloudflare/cfrpki/security/advisories/GHSA-c8xp-8mf3-62h9
CVE: CVE-2020-19143
Published: 2021-09-09
Description: Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the component 'libtiff/tif_dir.c'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2851; https://gitlab.com/libtiff/libtiff/-/issues/158; https://gitlab.com/libtiff/libtiff/-/merge_requests/119
CVE: CVE-2020-19144
Published: 2021-09-09
Description: Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2852; https://gitlab.com/libtiff/libtiff/-/issues/159; https://lists.debian.org/debian-lts-announce/2021/10/msg00004.html
CVE: CVE-2020-19515
Published: 2021-09-09
Description: qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://topsecalphalab.github.io/CVE/qdPM9.1-Installer-Cross-Site-Scripting; https://topsecalphalab.github.io/CVE/qdPM9.1-Installer-Cross-Site-Scripting
CVE: CVE-2021-22239
Published: 2021-09-09
Description: An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22239.json; https://gitlab.com/gitlab-org/gitlab/-/issues/336301; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22239.json
CVE: CVE-2021-38540
Published: 2021-09-09
Description: The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269, CWE-306
References: https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c[PII_REDACTED]f13328ca742b03a2%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/rb34c3dd1a[PII_REDACTED]17eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E; https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c[PII_REDACTED]f13328ca742b03a2%40%3Cannounce.apache.org%3E
CVE: CVE-2021-38721
Published: 2021-09-09
Description: FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/daylightstudio/FUEL-CMS/commit/6164cd794674d4d74da39f8b535ff588ab006e33; https://github.com/daylightstudio/FUEL-CMS/issues/584; https://github.com/daylightstudio/FUEL-CMS/commit/6164cd794674d4d74da39f8b535ff588ab006e33
CVE: CVE-2021-38723
Published: 2021-09-09
Description: FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/daylightstudio/FUEL-CMS/issues/583; https://github.com/daylightstudio/FUEL-CMS/issues/583
CVE: CVE-2021-38725
Published: 2021-09-09
Description: Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://github.com/daylightstudio/FUEL-CMS/commit/15934fdd309408640d1f2be18f93a8beadaa5e9b; https://github.com/daylightstudio/FUEL-CMS/issues/581; https://github.com/daylightstudio/FUEL-CMS/commit/15934fdd309408640d1f2be18f93a8beadaa5e9b
CVE: CVE-2021-32484
Published: 2021-09-09
Description: In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00500621; Issue ID: ALPS04964917.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2021; https://corp.mediatek.com/product-security-bulletin/September-2021
CVE: CVE-2021-32485
Published: 2021-09-09
Description: In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00500621; Issue ID: ALPS04964926.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2021; https://corp.mediatek.com/product-security-bulletin/September-2021
CVE: CVE-2021-32486
Published: 2021-09-09
Description: In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00500621; Issue ID: ALPS04964928.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2021; https://corp.mediatek.com/product-security-bulletin/September-2021
CVE: CVE-2021-32487
Published: 2021-09-09
Description: In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00500736; Issue ID: ALPS04938456.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2021; https://corp.mediatek.com/product-security-bulletin/September-2021
CVE: CVE-2021-38727
Published: 2021-09-09
Description: FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/daylightstudio/FUEL-CMS/issues/582; https://streamable.com/lxw3ln; https://www.nu11secur1ty.com/2021/10/cve-2021-38727.html
CVE: CVE-2021-40284
Published: 2021-09-09
Description: D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service. This vulnerability exists in the web interface "/cgi-bin/New_GUI/Igmp.asp". Authenticated remote attackers can trigger this vulnerability by sending a long string in parameter 'igmpsnoopEnable' via an HTTP request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10245; https://www.dlink.com/en/security-bulletin/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10245
CVE: CVE-2020-19263
Published: 2021-09-09
Description: A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to administrator via index.php?s=/user/ApiAdminUser/itemEdit.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/sansanyun/mipcms5/issues/4; https://github.com/sansanyun/mipcms5/issues/4
CVE: CVE-2020-19264
Published: 2021-09-09
Description: A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/ApiAdminUser/itemAdd.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/sansanyun/mipcms5/issues/4; https://github.com/sansanyun/mipcms5/issues/4
CVE: CVE-2020-19265
Published: 2021-09-09
Description: A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tifaweb/Dswjcms/issues/4; https://github.com/tifaweb/Dswjcms/issues/4
CVE: CVE-2020-19266
Published: 2021-09-09
Description: A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Site/articleList component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tifaweb/Dswjcms/issues/5; https://github.com/tifaweb/Dswjcms/issues/5
CVE: CVE-2020-19267
Published: 2021-09-09
Description: An issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/tifaweb/Dswjcms/issues/7; https://github.com/tifaweb/Dswjcms/issues/7
CVE: CVE-2020-19268
Published: 2021-09-09
Description: A cross-site request forgery (CSRF) in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: https://github.com/tifaweb/Dswjcms/issues/6; https://github.com/tifaweb/Dswjcms/issues/6
CVE: CVE-2021-28909
Published: 2021-09-09
Description: BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'admin'. This is usable and part of an attack chain to gain SSH root access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://psytester.github.io/CVE-2021-28909; https://psytester.github.io/CVE-2021-28909
CVE: CVE-2021-28910
Published: 2021-09-09
Description: BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://psytester.github.io/CVE-2021-28910; https://psytester.github.io/CVE-2021-28910
CVE: CVE-2021-28911
Published: 2021-09-09
Description: BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial number). Having those info, a possible loginId can be self-calculated in a brute force attack against BMX interface. This is usable and part of an attack chain to gain SSH root access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-863
References: https://psytester.github.io/CVE-2021-28911; https://psytester.github.io/CVE-2021-28911
CVE: CVE-2021-28912
Published: 2021-09-09
Description: BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-521, CWE-798
References: https://psytester.github.io/CVE-2021-28912; https://psytester.github.io/CVE-2021-28912
CVE: CVE-2021-28913
Published: 2021-09-09
Description: BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /webif/SecurityModule to validate the so called and hard coded unique 'eibPort String' which acts as the root SSH key passphrase. This is usable and part of an attack chain to gain SSH root access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://psytester.github.io/CVE-2021-28913; https://psytester.github.io/CVE-2021-28913
CVE: CVE-2021-39296
Published: 2021-09-09
Description: In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287
References: https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q; https://github.com/openbmc/openbmc; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html
CVE: CVE-2021-25449
Published: 2021-09-09
Description: An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers to execute arbitrary code in mediaextractor process.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122, CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25450
Published: 2021-09-09
Description: Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Sep-2021 Release 1 allows attackers to write file as system uid via remote socket.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-20, CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25451
Published: 2021-09-09
Description: A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data.
CVSS Score: 3.3 (LOW)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25452
Published: 2021-09-09
Description: An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform permanent denial of service on the device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25453
Published: 2021-09-09
Description: Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Bluetooth information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25454
Published: 2021-09-09
Description: OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac file.
CVSS Score: 3.1 (LOW)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25455
Published: 2021-09-09
Description: OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pointer via forged avi file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25456
Published: 2021-09-09
Description: OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcpy at arbitrary address via forged wmf file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25457
Published: 2021-09-09
Description: An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memory information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25458
Published: 2021-09-09
Description: NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption.
CVSS Score: 3.3 (LOW)
CWE: CWE-476, CWE-476
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25459
Published: 2021-09-09
Description: An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start BlockchainTZService.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25460
Published: 2021-09-09
Description: An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to terminate BlockchainTZService.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25461
Published: 2021-09-09
Description: An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25462
Published: 2021-09-09
Description: NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption.
CVSS Score: 3.3 (LOW)
CWE: CWE-476, CWE-476
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=9
CVE: CVE-2021-25463
Published: 2021-09-09
Description: Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=9; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=9
CVE: CVE-2021-25464
Published: 2021-09-09
Description: An improper file management vulnerability in SamsungCapture prior to version 4.8.02 allows sensitive information leak.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=9; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=9
CVE: CVE-2021-25465
Published: 2021-09-09
Description: An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack.
CVSS Score: 3.3 (LOW)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=9; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=9
CVE: CVE-2021-25466
Published: 2021-09-09
Description: Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Account token.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=9; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=9
CVE: CVE-2021-28914
Published: 2021-09-09
Description: BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration tool, but finally not enforced. This is usable and part of an attack chain to gain SSH root access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-521
References: https://psytester.github.io/CVE-2021-28914; https://psytester.github.io/CVE-2021-28914
CVE: CVE-2021-38316
Published: 2021-09-09
Description: The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-academic-people/tags/0.4.1/admin-panel.php#L57; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38316; https://plugins.trac.wordpress.org/browser/wp-academic-people/tags/0.4.1/admin-panel.php#L57