deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-27383
Published: 2021-06-09
Description: Battle.net.exe in Battle.Net 1.27.1.12428 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to weak set of permissions being granted to the "Authenticated Users Group" which grants the (F) Flag aka "Full Control"
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://github.com/FreySolarEye/CVE/blob/master/Battle%20Net%20Launcher%20Local%20Privilege%20Escalation; https://github.com/FreySolarEye/CVE/blob/master/Battle%20Net%20Launcher%20Local%20Privilege%20Escalation
CVE: CVE-2020-8670
Published: 2021-06-09
Description: Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html
CVE: CVE-2020-8700
Published: 2021-06-09
Description: Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-8702
Published: 2021-06-09
Description: Uncontrolled search path element in the Intel(R) Processor Diagnostic Tool before version 4.1.5.37 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00458.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00458.html
CVE: CVE-2020-8703
Published: 2021-06-09
Description: Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html
CVE: CVE-2020-8704
Published: 2021-06-09
Description: Race condition in a subsystem in the Intel(R) LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html; https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf
CVE: CVE-2021-0070
Published: 2021-06-09
Description: Improper input validation in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable an escalation of privilege via adjacent access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00474.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00474.html
CVE: CVE-2021-0095
Published: 2021-06-09
Description: Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-665
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-0097
Published: 2021-06-09
Description: Path traversal in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable a denial of service via adjacent access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00474.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00474.html
CVE: CVE-2021-0101
Published: 2021-06-09
Description: Buffer overflow in the BMC firmware for Intel(R) Server BoardM10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable an escalation of privilege via adjacent access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00474.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00474.html
CVE: CVE-2021-0105
Published: 2021-06-09
Description: Insecure inherited permissions in some Intel(R) ProSet/Wireless WiFi drivers may allow an authenticated user to potentially enable information disclosure and denial of service via adjacent access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00472.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00472.html
CVE: CVE-2021-0113
Published: 2021-06-09
Description: Out of bounds write in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable a denial of service via adjacent access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00474.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00474.html
CVE: CVE-2021-29049
Published: 2021-06-09
Description: Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17211; http://liferay.com
CVE: CVE-2021-33894
Published: 2021-06-09
Description: In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and/or execute SQL statements that alter or delete database elements.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-June-2021; https://www.progress.com/moveit; https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-June-2021
CVE: CVE-2020-24473
Published: 2021-06-09
Description: Out of bounds write in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00476.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00476.html
CVE: CVE-2020-24474
Published: 2021-06-09
Description: Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00476.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00476.html
CVE: CVE-2020-24475
Published: 2021-06-09
Description: Improper initialization in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00476.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00476.html
CVE: CVE-2020-24489
Published: 2021-06-09
Description: Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-459
References: https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html; https://www.debian.org/security/2021/dsa-4934; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
CVE: CVE-2021-0001
Published: 2021-06-09
Description: Observable timing discrepancy in Intel(R) IPP before version 2020 update 1 may allow authorized user to potentially enable information disclosure via local access.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-203
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00477.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00477.html
CVE: CVE-2021-0051
Published: 2021-06-09
Description: Improper input validation in the Intel(R) SPS versions before SPS_E5_04.04.04.023.0, SPS_E5_04.04.03.228.0 or SPS_SoC-A_05.00.03.098.0 may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00500.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-0052
Published: 2021-06-09
Description: Incorrect default privileges in the Intel(R) Computing Improvement Program before version 2.4.6522 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00530.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00530.html
CVE: CVE-2021-0054
Published: 2021-06-09
Description: Improper buffer restrictions in system firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00511.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00511.html
CVE: CVE-2021-0055
Published: 2021-06-09
Description: Insecure inherited permissions for some Intel(R) NUC 9 Extreme Laptop Kit LAN Drivers before version 10.42 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00505.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00505.html
CVE: CVE-2021-0056
Published: 2021-06-09
Description: Insecure inherited permissions for the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00507.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00507.html
CVE: CVE-2021-0057
Published: 2021-06-09
Description: Uncontrolled search path in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00507.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00507.html
CVE: CVE-2021-0058
Published: 2021-06-09
Description: Incorrect default permissions in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00507.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00507.html
CVE: CVE-2021-0067
Published: 2021-06-09
Description: &nbsp;Improper access control in system firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00511.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00511.html
CVE: CVE-2021-0073
Published: 2021-06-09
Description: Insufficient control flow management in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00510.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00510.html
CVE: CVE-2021-0074
Published: 2021-06-09
Description: Improper permissions in the installer for the Intel(R) Computing Improvement Program software before version 2.4.5982 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00530.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00530.html
CVE: CVE-2021-0077
Published: 2021-06-09
Description: Insecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before version 2021.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00518.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00518.html
CVE: CVE-2021-0086
Published: 2021-06-09
Description: Observable response discrepancy in floating-point operations for some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: http://www.openwall.com/lists/oss-security/2021/06/08/7; http://www.openwall.com/lists/oss-security/2021/06/09/2; http://www.openwall.com/lists/oss-security/2021/06/10/1
CVE: CVE-2021-0089
Published: 2021-06-09
Description: Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: http://www.openwall.com/lists/oss-security/2021/06/10/1; http://www.openwall.com/lists/oss-security/2021/06/10/10; http://www.openwall.com/lists/oss-security/2021/06/10/11
CVE: CVE-2021-0090
Published: 2021-06-09
Description: Uncontrolled search path element in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00510.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00510.html
CVE: CVE-2021-0094
Published: 2021-06-09
Description: Improper link resolution before file access in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00510.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00510.html
CVE: CVE-2021-0098
Published: 2021-06-09
Description: Improper access control in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html
CVE: CVE-2021-0100
Published: 2021-06-09
Description: Incorrect default permissions in the installer for the Intel(R) SSD Data Center Tool, versions downloaded before 12/31/2020, may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00537.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00537.html
CVE: CVE-2021-0102
Published: 2021-06-09
Description: Insecure inherited permissions in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html
CVE: CVE-2021-0104
Published: 2021-06-09
Description: Uncontrolled search path element in the installer for the Intel(R) Rapid Storage Technology software, before versions 17.9.0.34, 18.0.0.640 and 18.1.0.24, may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00545.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00545.html
CVE: CVE-2021-0106
Published: 2021-06-09
Description: Incorrect default permissions in the Intel(R) Optane(TM) DC Persistent Memory for Windows software versions before 2.00.00.3842 or 1.00.00.3515 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00541.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00541.html
CVE: CVE-2021-0108
Published: 2021-06-09
Description: Uncontrolled search path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html
CVE: CVE-2021-0112
Published: 2021-06-09
Description: Unquoted service path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-428
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html
CVE: CVE-2021-0129
Published: 2021-06-09
Description: Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.
CVSS Score: 5.7 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html; https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html; https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html
CVE: CVE-2021-0131
Published: 2021-06-09
Description: Use of cryptographically weak pseudo-random number generator (PRNG) in an API for the Intel(R) Security Library before version 3.3 may allow an authenticated user to potentially enable information disclosure via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-338
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00521.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00521.html
CVE: CVE-2021-0132
Published: 2021-06-09
Description: Missing release of resource after effective lifetime in an API for the Intel(R) Security Library before version 3.3 may allow a privileged user to potentially enable denial of service via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-772
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00521.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00521.html
CVE: CVE-2021-0133
Published: 2021-06-09
Description: Key exchange without entity authentication in the Intel(R) Security Library before version 3.3 may allow an authenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 8.1 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00521.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00521.html
CVE: CVE-2021-0134
Published: 2021-06-09
Description: Improper input validation in an API for the Intel(R) Security Library before version 3.3 may allow a privileged user to potentially enable denial of service via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00521.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00521.html
CVE: CVE-2021-33393
Published: 2021-06-09
Description: lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/163158/IPFire-2.25-Remote-Code-Execution.html; https://github.com/MucahitSaratar/ipfire-2-25-auth-rce; https://github.com/ipfire/ipfire-2.x/commit/6769d909306d7bdc43d[PII_REDACTED]6fcf1b217f6
CVE: CVE-2021-3588
Published: 2021-06-10
Description: The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-788, CWE-125
References: https://github.com/bluez/bluez/issues/70; https://security.gentoo.org/glsa/202209-16; https://github.com/bluez/bluez/issues/70
CVE: CVE-2019-17567
Published: 2021-06-10
Description: Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2021/06/10/2; https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E