deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-36184
Published: 2021-11-02
Description: A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosure device, users and database information via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fortiguard.com/advisory/FG-IR-21-107; https://fortiguard.com/advisory/FG-IR-21-107
CVE: CVE-2021-36185
Published: 2021-11-02
Description: A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/advisory/FG-IR-21-110; https://fortiguard.com/advisory/FG-IR-21-110
CVE: CVE-2021-36186
Published: 2021-11-02
Description: A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://fortiguard.com/advisory/FG-IR-21-119; https://fortiguard.com/advisory/FG-IR-21-119
CVE: CVE-2021-36187
Published: 2021-11-02
Description: A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://fortiguard.com/advisory/FG-IR-21-039; https://fortiguard.com/advisory/FG-IR-21-039
CVE: CVE-2021-41022
Published: 2021-11-02
Description: A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or commands via powershell scripts
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://fortiguard.com/advisory/FG-IR-21-176; https://fortiguard.com/advisory/FG-IR-21-176
CVE: CVE-2021-41023
Published: 2021-11-02
Description: A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due to plaintext credential storage in log files
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://fortiguard.com/advisory/FG-IR-21-175; https://fortiguard.com/advisory/FG-IR-21-175
CVE: CVE-2021-42754
Published: 2021-11-02
Description: An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious dylib file.
CVSS Score: 3.2 (LOW)
CWE: CWE-94
References: https://fortiguard.com/advisory/FG-IR-21-079; https://fortiguard.com/advisory/FG-IR-21-079
CVE: CVE-2018-6044
Published: 2021-11-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-16064. Reason: This candidate is a reservation duplicate of CVE-2018-16064. Notes: All CVE users should reference CVE-2018-16064 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-6058
Published: 2021-11-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11215. Reason: This candidate is a reservation duplicate of CVE-2017-11215. Notes: All CVE users should reference CVE-2017-11215 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-6059
Published: 2021-11-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11225. Reason: This candidate is a reservation duplicate of CVE-2017-11225. Notes: All CVE users should reference CVE-2017-11225 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-5863
Published: 2021-11-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-30631
Published: 2021-11-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-37960
Published: 2021-11-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-37977
Published: 2021-11-02
Description: Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop.html; https://crbug.com/1252878; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNARCF5HEZK7GJXZRN5TQ45AQDCRM2WO/
CVE: CVE-2021-37978
Published: 2021-11-02
Description: Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop.html; https://crbug.com/1236318; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNARCF5HEZK7GJXZRN5TQ45AQDCRM2WO/
CVE: CVE-2021-37979
Published: 2021-11-02
Description: heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop.html; https://crbug.com/1247260; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNARCF5HEZK7GJXZRN5TQ45AQDCRM2WO/
CVE: CVE-2021-37980
Published: 2021-11-02
Description: Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows.
CVSS Score: 7.4 (HIGH)
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop.html; https://crbug.com/1254631; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNARCF5HEZK7GJXZRN5TQ45AQDCRM2WO/
CVE: CVE-2017-5123
Published: 2021-11-02
Description: Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://crbug.com/772848; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=96ca579a1ecc943b75beba58bebb0356f6cc4b51; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-13776
Published: 2021-11-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: some publications have used this number when they meant to use CVE-2019-13376
CVE: CVE-2021-37981
Published: 2021-11-02
Description: Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1246631; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37982
Published: 2021-11-02
Description: Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1248661; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37983
Published: 2021-11-02
Description: Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1249810; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37984
Published: 2021-11-02
Description: Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1253399; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37985
Published: 2021-11-02
Description: Use after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had convinced a user to allow for connection to debugger to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1241860; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37986
Published: 2021-11-02
Description: Heap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to engage with Dev Tools to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1242404; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37987
Published: 2021-11-02
Description: Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1206928; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37988
Published: 2021-11-02
Description: Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestures to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1228248; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37989
Published: 2021-11-02
Description: Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1233067; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37990
Published: 2021-11-02
Description: Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app.
CVSS Score: 5.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1247395; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37991
Published: 2021-11-02
Description: Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1250660; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37992
Published: 2021-11-02
Description: Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1253746; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37993
Published: 2021-11-02
Description: Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1255332; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37994
Published: 2021-11-02
Description: Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1100761; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37995
Published: 2021-11-02
Description: Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay and spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1242315; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-37996
Published: 2021-11-02
Description: Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html; https://crbug.com/1243020; https://www.debian.org/security/2022/dsa-5046
CVE: CVE-2021-42697
Published: 2021-11-02
Description: Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://packetstormsecurity.com/files/167018/Akka-HTTP-10.1.14-Denial-Of-Service.html; https://akka.io/blog/; https://akka.io/blog/news/2021/11/02/akka-http-10.2.7-released
CVE: CVE-2021-43264
Published: 2021-11-02
Description: In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character.
CVSS Score: 3.3 (LOW)
CWE: CWE-22
References: https://bugs.launchpad.net/mahara/+bug/1944979; https://mahara.org/interaction/forum/topic.php?id=8954; https://bugs.launchpad.net/mahara/+bug/1944979
CVE: CVE-2021-43265
Published: 2021-11-02
Description: In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.launchpad.net/mahara/+bug/1944633; https://mahara.org/interaction/forum/topic.php?id=8953; https://bugs.launchpad.net/mahara/+bug/1944633
CVE: CVE-2021-43266
Published: 2021-11-02
Description: In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://bugs.launchpad.net/mahara/+bug/1942903; https://bugs.launchpad.net/mahara/+bug/1949527; https://mahara.org/interaction/forum/topic.php?id=8952
CVE: CVE-2018-6122
Published: 2021-11-02
Description: Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://crbug.com/836141; https://crbug.com/836141
CVE: CVE-2018-6125
Published: 2021-11-02
Description: Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://crbug.com/818592; https://crbug.com/818592
CVE: CVE-2020-16048
Published: 2021-11-02
Description: Out of bounds read in ANGLE allowed a remote attacker to obtain sensitive data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://crbug.com/1174641; https://crbug.com/1174641
CVE: CVE-2020-6492
Published: 2021-11-02
Description: Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html; https://crbug.com/1078375; https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html
CVE: CVE-2021-43267
Published: 2021-11-02
Description: An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1284
References: http://www.openwall.com/lists/oss-security/2022/02/10/1; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.16; https://github.com/torvalds/linux/commit/fa40d9734a57bcbfa79a280189799f76c88f7bb0
CVE: CVE-2021-43270
Published: 2021-11-02
Description: Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where encryption on port 465 was intended.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://github.com/datalust/seq-app-htmlemail/pull/93; https://github.com/datalust/seq-app-htmlemail/pull/93
CVE: CVE-2020-27820
Published: 2021-11-03
Description: A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1901726; https://lore.kernel.org/dri-devel/[PII_REDACTED]4912.184413-2-jcline%40redhat.com/; https://lore.kernel.org/dri-devel/[PII_REDACTED]4912.184413-3-jcline%40redhat.com/
CVE: CVE-2021-20135
Published: 2021-11-03
Description: Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. Tenable has included a fix for this issue in Nessus 10.0.0. The installation files can be obtained from the Tenable Downloads Portal (https://www.tenable.com/downloads/nessus).
CVSS Score: 6.7 (MEDIUM)
References: https://www.tenable.com/security/tns-2021-18; https://www.tenable.com/security/tns-2021-18
CVE: CVE-2021-20700
Published: 2021-11-03
Description: Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://jpn.nec.com/security-info/secinfo/nv21-015_en.html; https://jpn.nec.com/security-info/secinfo/nv21-015_en.html
CVE: CVE-2021-20701
Published: 2021-11-03
Description: Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://jpn.nec.com/security-info/secinfo/nv21-015_en.html; https://jpn.nec.com/security-info/secinfo/nv21-015_en.html
CVE: CVE-2021-20702
Published: 2021-11-03
Description: Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://jpn.nec.com/security-info/secinfo/nv21-015_en.html; https://jpn.nec.com/security-info/secinfo/nv21-015_en.html
CVE: CVE-2021-20703
Published: 2021-11-03
Description: Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://jpn.nec.com/security-info/secinfo/nv21-015_en.html; https://jpn.nec.com/security-info/secinfo/nv21-015_en.html
CVE: CVE-2021-20704
Published: 2021-11-03
Description: Buffer overflow vulnerability in the compatible API with previous versions CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://jpn.nec.com/security-info/secinfo/nv21-015_en.html; https://jpn.nec.com/security-info/secinfo/nv21-015_en.html
CVE: CVE-2021-20705
Published: 2021-11-03
Description: Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote file upload via network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://jpn.nec.com/security-info/secinfo/nv21-015_en.html; https://jpn.nec.com/security-info/secinfo/nv21-015_en.html
CVE: CVE-2021-20706
Published: 2021-11-03
Description: Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote file upload via network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://jpn.nec.com/security-info/secinfo/nv21-015_en.html; https://jpn.nec.com/security-info/secinfo/nv21-015_en.html
CVE: CVE-2021-20707
Published: 2021-11-03
Description: Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to read files upload via network..
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://jpn.nec.com/security-info/secinfo/nv21-015_en.html; https://jpn.nec.com/security-info/secinfo/nv21-015_en.html