deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3128
Published: 2021-04-12
Description: In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834
References: https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/; https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS/; https://www.asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX55/HelpDesk_BIOS/
CVE: CVE-2019-15059
Published: 2021-04-12
Description: In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar without authentication or authorization. These configuration files have all PBX information including extension numbers, contacts, and passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://gist.github.com/famatte69/52e6ad03d0f23428b92bd029c856112c; https://gist.github.com/famatte69/52e6ad03d0f23428b92bd029c856112c
CVE: CVE-2021-21524
Published: 2021-04-12
Description: Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to arbitrary privileged code execution on the vulnerable application. The severity is Critical as this may lead to system compromise by unauthenticated attackers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.dell.com/support/kbdoc/en-us/000184753/dsa-2021-054-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000184753/dsa-2021-054-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-21545
Published: 2021-04-12
Description: Dell Peripheral Manager 1.3.1 or greater contains remediation for a local privilege escalation vulnerability that could be potentially exploited to gain arbitrary code execution on the system with privileges of the system user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.dell.com/support/kbdoc/en-us/000185100/dsa-2021-079-dell-client-security-update-for-dell-peripheral-manager-local-privilege-escalation-vulnerability; https://www.dell.com/support/kbdoc/en-us/000185100/dsa-2021-079-dell-client-security-update-for-dell-peripheral-manager-local-privilege-escalation-vulnerability
CVE: CVE-2021-21394
Published: 2021-04-12
Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/matrix-org/synapse/pull/9321; https://github.com/matrix-org/synapse/pull/9393; https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362
CVE: CVE-2021-22497
Published: 2021-04-12
Description: Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.
CVSS Score: 3.8 (LOW)
CWE: CWE-287
References: https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-634/data/advanced-authentication-releasenotes-634.html; https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-634/data/advanced-authentication-releasenotes-634.html
CVE: CVE-2021-3163
Published: 2021-04-12
Description: A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://burninatorsec.blogspot.com/2021/04/cve-2021-3163-xss-slab-quill-js.html; https://github.com/quilljs/quill/issues/3273; https://github.com/quilljs/quill/issues/3364
CVE: CVE-2021-21392
Published: 2021-04-12
Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/matrix-org/synapse/pull/9240; https://github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
CVE: CVE-2021-21393
Published: 2021-04-12
Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/matrix-org/synapse/pull/9321; https://github.com/matrix-org/synapse/pull/9393; https://github.com/matrix-org/synapse/security/advisories/GHSA-jrh7-mhhx-6h88
CVE: CVE-2021-29429
Published: 2021-04-12
Description: In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded into the system temporary directory first. Sensitive information contained in these files can be exposed to other local users on the same system. If you do not use the `TextResourceFactory` API, you are not vulnerable. As of Gradle 7.0, uses of the system temporary directory have been moved to the Gradle User Home directory. By default, this directory is restricted to the user running the build. As a workaround, set a more restrictive umask that removes read access to other users. When files are created in the system temporary directory, they will not be accessible to other users. If you are unable to change your system's umask, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-377
References: https://docs.gradle.org/7.0/release-notes.html#security-advisories; https://github.com/gradle/gradle/security/advisories/GHSA-fp8h-qmr5-j4c8; https://docs.gradle.org/7.0/release-notes.html#security-advisories
CVE: CVE-2021-30030
Published: 2021-04-13
Description: Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162291/RemoteClinic-2.0-Cross-Site-Scripting.html; https://github.com/remoteclinic/RemoteClinic/issues/1; http://packetstormsecurity.com/files/162291/RemoteClinic-2.0-Cross-Site-Scripting.html
CVE: CVE-2021-30034
Published: 2021-04-13
Description: Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162291/RemoteClinic-2.0-Cross-Site-Scripting.html; https://github.com/remoteclinic/RemoteClinic/issues/5; http://packetstormsecurity.com/files/162291/RemoteClinic-2.0-Cross-Site-Scripting.html
CVE: CVE-2021-30039
Published: 2021-04-13
Description: Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162291/RemoteClinic-2.0-Cross-Site-Scripting.html; https://github.com/remoteclinic/RemoteClinic/issues/8; http://packetstormsecurity.com/files/162291/RemoteClinic-2.0-Cross-Site-Scripting.html
CVE: CVE-2021-30042
Published: 2021-04-13
Description: Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register.php
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162291/RemoteClinic-2.0-Cross-Site-Scripting.html; https://github.com/remoteclinic/RemoteClinic/issues/11; http://packetstormsecurity.com/files/162291/RemoteClinic-2.0-Cross-Site-Scripting.html
CVE: CVE-2021-30044
Published: 2021-04-13
Description: Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162262/RemoteClinic-2-Cross-Site-Scripting.html; https://github.com/remoteclinic/RemoteClinic/issues/13; http://packetstormsecurity.com/files/162262/RemoteClinic-2-Cross-Site-Scripting.html
CVE: CVE-2021-30503
Published: 2021-04-13
Description: The unofficial GLSL Linting extension before 1.4.0 for Visual Studio Code allows remote code execution via a crafted glslangValidatorPath in the workspace configuration.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/hsimpson/vscode-glsllint/commit/3effba525bdff7d4257e66a6815ff956d2bce8ac; https://marketplace.visualstudio.com/items/CADENAS.vscode-glsllint/changelog#:~:text=1.4.x; https://vuln.ryotak.me/advisories/27
CVE: CVE-2021-30637
Published: 2021-04-13
Description: htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162195/htmly-2.8.0-Cross-Site-Scripting.html; https://github.com/danpros/htmly/issues/456; http://packetstormsecurity.com/files/162195/htmly-2.8.0-Cross-Site-Scripting.html
CVE: CVE-2021-28938
Published: 2021-04-13
Description: Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before 7.10.2-22.2, and 7.11.x before 7.11.2-23.0 can leak user information across thread contexts. This occurs in opportunistic circumstances when there is concurrent query execution by a low-privilege user and a high-privilege user. The former query might run with the latter query's privileges.
CVSS Score: 4.3 (MEDIUM)
References: https://docs.siren.io/siren-federate-user-guide/22/siren-federate/release-notes.html; https://docs.siren.io/siren-federate-user-guide/22/siren-federate/release-notes.html
CVE: CVE-2021-29003
Published: 2021-04-13
Description: Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/162174/Genexis-PLATINUM-4410-2.1-P4410-V2-1.28-Remote-Command-Execution.html; https://hackerworld.home.blog/2021/03/19/rce-in-genexis-router/; http://packetstormsecurity.com/files/162174/Genexis-PLATINUM-4410-2.1-P4410-V2-1.28-Remote-Command-Execution.html
CVE: CVE-2021-29054
Published: 2021-04-13
Description: Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface. This affects Papoo CMS Light through 21.02 and Papoo CMS Pro through 6.0.1. The impact is: gain privileges (remote).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/raginx/security/blob/main/rADV-2021-01.txt; https://packetstormsecurity.com/files/162077/Papoo-CMS-Cross-Site-Request-Forgery.html; https://www.papoo.de/achtung---sicherheitsfeature-bitte-aktivieren.html
CVE: CVE-2021-27905
Published: 2021-04-13
Description: The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb[PII_REDACTED]425074a42eb326b10%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E; https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E
CVE: CVE-2021-29262
Published: 2021-04-13
Description: When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://lists.apache.org/thread.html/r1171f6417eeb6d5e1206d53e2b2ff2d6ee14026f8b595ef7d8a33b79%40%3Coak-issues.jackrabbit.apache.org%3E; https://lists.apache.org/thread.html/r1e92a2eff6c47a65c4a6e95e809a9707181de76f8062403a0bea1012%40%3Coak-issues.jackrabbit.apache.org%3E; https://lists.apache.org/thread.html/r51b29ff62060b67bc9999ded5e252b36b09311fe5a02d27f6de3e4d3%40%3Coak-issues.jackrabbit.apache.org%3E
CVE: CVE-2021-29425
Published: 2021-04-13
Description: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-22
References: https://issues.apache.org/jira/browse/IO-556; https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1%40%3Cnotifications.zookeeper.apache.org%3E; https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5%40%3Cnotifications.zookeeper.apache.org%3E
CVE: CVE-2021-29943
Published: 2021-04-13
Description: When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://lists.apache.org/thread.html/r91dd0ff556e0c9aab4c92852e0e540c59d4633718ce12881558cf44d%40%3Cusers.solr.apache.org%3E
CVE: CVE-2021-25250
Published: 2021-04-13
Description: An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://success.trendmicro.com/solution/000286019; https://success.trendmicro.com/solution/000286157; https://www.zerodayinitiative.com/advisories/ZDI-21-400/
CVE: CVE-2021-25253
Published: 2021-04-13
Description: An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://success.trendmicro.com/solution/000286019; https://success.trendmicro.com/solution/000286157; https://www.zerodayinitiative.com/advisories/ZDI-21-401/
CVE: CVE-2021-28645
Published: 2021-04-13
Description: An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://success.trendmicro.com/solution/000286019; https://success.trendmicro.com/solution/000286157; https://www.zerodayinitiative.com/advisories/ZDI-21-402/
CVE: CVE-2021-28646
Published: 2021-04-13
Description: An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://success.trendmicro.com/solution/000286019; https://success.trendmicro.com/solution/000286157; https://success.trendmicro.com/solution/000286019
CVE: CVE-2021-28647
Published: 2021-04-13
Description: Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a malicious DLL file during the installation progress and could execute a malicious program each time a user installs a program.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10282; https://helpcenter.trendmicro.com/en-us/article/TMKA-10282
CVE: CVE-2021-22505
Published: 2021-04-13
Description: Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12, 12.14 and 12.15. The vulnerability could be exploited to escalate privileges and execute code under the account of the Operations Agent.
CVSS Score: 9.8 (CRITICAL)
References: https://softwaresupport.softwaregrp.com/doc/KM03792442; https://softwaresupport.softwaregrp.com/doc/KM03792442
CVE: CVE-2021-28421
Published: 2021-04-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-30175
Published: 2021-04-13
Description: ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/awillix/research/blob/main/cve/CVE-2021-30175.md; https://pro.zerof.ru; https://github.com/awillix/research/blob/main/cve/CVE-2021-30175.md
CVE: CVE-2021-30176
Published: 2021-04-13
Description: The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/awillix/research/blob/main/cve/CVE-2021-30176.md; https://pro.zerof.ru; https://github.com/awillix/research/blob/main/cve/CVE-2021-30176.md
CVE: CVE-2020-13566
Published: 2021-04-13
Description: SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability In admin/edit_group.php, when the POST parameter action is “Delete”, the POST parameter delete_group leads to a SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1179; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1179
CVE: CVE-2020-13568
Published: 2021-04-13
Description: SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability in admin/edit_group.php, when the POST parameter action is “Submit”, the POST parameter parent_id leads to a SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1179; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1179
CVE: CVE-2020-27227
Published: 2021-04-13
Description: An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the server. An attacker can send a web request with parameters containing specific parameter to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and compromise underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1203; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1203
CVE: CVE-2020-27228
Published: 2021-04-13
Description: An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overwriting the binary can result in privilege escalation. An attacker can replace a file to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1204; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1204
CVE: CVE-2020-27233
Published: 2021-04-13
Description: An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1207