deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28732
Published: 2021-09-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-28372. Reason: This candidate is a duplicate of CVE-2021-28372. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2021-28372 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-33981
Published: 2021-09-08
Description: An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and images of their hunting/fishing licenses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://gist.github.com/p4lsec/1f024d96b44ea733cdae0605c7ce8a49; https://gist.github.com/p4lsec/1f024d96b44ea733cdae0605c7ce8a49
CVE: CVE-2021-33982
Published: 2021-09-08
Description: An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://gist.github.com/p4lsec/1f024d96b44ea733cdae0605c7ce8a49; https://gist.github.com/p4lsec/1f024d96b44ea733cdae0605c7ce8a49
CVE: CVE-2021-3049
Published: 2021-09-08
Description: An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex XSOAR 5.5.0 builds; Cortex XSOAR 6.1.0 builds earlier than 12099345. This issue does not impact Cortex XSOAR 6.2.0 versions.
CVSS Score: 2.6 (LOW)
CWE: CWE-285
References: https://security.paloaltonetworks.com/CVE-2021-3049; https://security.paloaltonetworks.com/CVE-2021-3049
CVE: CVE-2021-3051
Published: 2021-09-08
Description: An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances.
CVSS Score: 8.1 (HIGH)
CWE: CWE-347, CWE-347
References: https://security.paloaltonetworks.com/CVE-2021-3051; https://security.paloaltonetworks.com/CVE-2021-3051
CVE: CVE-2021-3052
Published: 2021-09-08
Description: A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead another authenticated PAN-OS administrator to click on a specially crafted link that performs arbitrary actions in the PAN-OS web interface as the targeted authenticated administrator. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.20; PAN-OS 9.0 versions earlier than 9.0.14; PAN-OS 9.1 versions earlier than 9.1.10; PAN-OS 10.0 versions earlier than 10.0.2. This issue does not affect Prisma Access.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2021-3052; https://security.paloaltonetworks.com/CVE-2021-3052
CVE: CVE-2021-3053
Published: 2021-09-08
Description: An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.5. This issue does not affect Prisma Access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://security.paloaltonetworks.com/CVE-2021-3053; https://security.paloaltonetworks.com/CVE-2021-3053
CVE: CVE-2021-3054
Published: 2021-09-08
Description: A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7; PAN-OS 10.1 versions earlier than PAN-OS 10.1.2. This issue does not affect Prisma Access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-367, CWE-367
References: https://security.paloaltonetworks.com/CVE-2021-3054; https://security.paloaltonetworks.com/CVE-2021-3054
CVE: CVE-2021-3055
Published: 2021-09-08
Description: An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10; PAN-OS 10.0 versions earlier than PAN-OS 10.0.6. This issue does not affect Prisma Access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://security.paloaltonetworks.com/CVE-2021-3055; https://security.paloaltonetworks.com/CVE-2021-3055
CVE: CVE-2021-40346
Published: 2021-09-08
Description: An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://git.haproxy.org/?p=haproxy.git; https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95; https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/
CVE: CVE-2021-31274
Published: 2021-09-08
Description: In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://community.librenms.org/t/vulnerability-report-cross-site-scripting-xss-in-the-api-access-page/15431; https://github.com/librenms/librenms; https://github.com/librenms/librenms/pull/12739
CVE: CVE-2021-32805
Published: 2021-09-08
Description: Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability. To resolve this issue upgrade to Flask-AppBuilder 3.2.2 or above. If upgrading is infeasible users may filter HTTP traffic containing `?next={next-site}` where the `next-site` domain is different from the application you are protecting as a workaround.
CVSS Score: 7.2 (HIGH)
CWE: CWE-601
References: https://github.com/dpgaspar/Flask-AppBuilder/commit/6af[PII_REDACTED]9b1dbafd[PII_REDACTED]ee9a4fa74; https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-624f-cqvr-3qw4; https://github.com/dpgaspar/Flask-AppBuilder/commit/6af[PII_REDACTED]9b1dbafd[PII_REDACTED]ee9a4fa74
CVE: CVE-2021-36215
Published: 2021-09-08
Description: LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling.
CVSS Score: 5.3 (MEDIUM)
References: https://hackerone.com/reports/1082991; https://hackerone.com/reports/1082991
CVE: CVE-2021-36216
Published: 2021-09-08
Description: LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://hackerone.com/reports/950688; https://hackerone.com/reports/950688
CVE: CVE-2021-38388
Published: 2021-09-08
Description: Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the authorization of the project.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://github.com/line/centraldogma/pull/621; https://github.com/line/centraldogma/pull/621
CVE: CVE-2021-40537
Published: 2021-09-08
Description: Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary for exploitation.
CVSS Score: 2.7 (LOW)
CWE: CWE-918
References: https://owncloud.com/security-advisories/cve-2021-40537/; https://owncloud.com/security-advisories/cve-2021-40537/
CVE: CVE-2021-40797
Published: 2021-09-08
Description: An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.openwall.com/lists/oss-security/2021/09/09/2; https://launchpad.net/bugs/1942179; https://security.openstack.org/ossa/OSSA-2021-006.html
CVE: CVE-2020-19137
Published: 2021-09-08
Description: Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10".
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://github.com/ShuaiJunlan/Autumn/issues/82; https://github.com/ShuaiJunlan/Autumn/issues/82
CVE: CVE-2020-19138
Published: 2021-09-08
Description: Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/dotCMS/core/issues/17796; https://github.com/dotCMS/core/issues/17796
CVE: CVE-2020-26772
Published: 2021-09-08
Description: Command Injection in PPGo_Jobs v2.8.0 allows remote attackers to execute arbitrary code via the 'AjaxRun()' function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.csdn.net/qq_33020901/article/details/108938473; https://github.com/george518/PPGo_Job/issues/56; https://blog.csdn.net/qq_33020901/article/details/108938473
CVE: CVE-2021-30605
Published: 2021-09-08
Description: Inappropriate implementation in the ChromeOS Readiness Tool installer on Windows prior to 1.0.2.0 loosens DCOM access rights on two objects allowing an attacker to potentially bypass discretionary access controls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://bit.ly/37CS6G9; https://crbug.com/1240952; https://bit.ly/37CS6G9
CVE: CVE-2021-36440
Published: 2021-09-08
Description: Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/star7th/showdoc/issues/1406; https://github.com/star7th/showdoc/issues/1406
CVE: CVE-2021-40812
Published: 2021-09-08
Description: The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/libgd/libgd/commit/6f5136821be86e7068fcdf651ae9420b5d42e9a9; https://github.com/libgd/libgd/issues/750#issuecomment-914872385; https://lists.debian.org/debian-lts-announce/2024/04/msg00003.html
CVE: CVE-2021-40814
Published: 2021-09-08
Description: The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.getastra.com/blog/911/plugin-exploit/prestashops-customer-photo-gallery-module-vulnerable-to-sql-injection-attacks/; https://www.getastra.com/blog/911/plugin-exploit/prestashops-customer-photo-gallery-module-vulnerable-to-sql-injection-attacks/
CVE: CVE-2021-40818
Published: 2021-09-08
Description: scheme/webauthn.c in Glewlwyd SSO server through 2.5.3 has a buffer overflow during FIDO2 signature validation in webauthn registration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://bugs.debian.org/993867; https://github.com/babelouest/glewlwyd/commit/0efd112bb62f566877750ad62ee828bff579b4e2; https://bugs.debian.org/993867
CVE: CVE-2020-26300
Published: 2021-09-09
Description: systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/advisories/GHSA-fj59-f6c3-3vw4; https://github.com/sebhildebrandt/systeminformation/commit/bad372e654cdd549e7d786acbba0035ded54c607; https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-fj59-f6c3-3vw4
CVE: CVE-2021-32833
Published: 2021-09-09
Description: Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are /Videos/Id/hls/PlaylistId/SegmentId.SegmentContainer, /Images/Ratings/theme/name and /Images/MediaInfo/theme/name. For more details including proof of concept code, refer to the referenced GHSL-2021-051. This issue may lead to unauthorized access to the system especially when Emby Server is configured to be accessible from the Internet.
CVSS Score: 8.6 (HIGH)
CWE: CWE-552
References: https://securitylab.github.com/advisories/GHSL-2021-051-emby/; https://securitylab.github.com/advisories/GHSL-2021-051-emby/
CVE: CVE-2021-32834
Published: 2021-09-09
Description: Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.
CVSS Score: 8.2 (HIGH)
CWE: CWE-94, CWE-917
References: https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/; https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/
CVE: CVE-2021-32835
Published: 2021-09-09
Description: Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lead to post-authentication Remote Code execution. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-693
References: https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/; https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/
CVE: CVE-2021-32836
Published: 2021-09-09
Description: ZStack is open source IaaS(infrastructure as a service) software. In ZStack before versions 3.10.12 and 4.1.6 there is a pre-auth unsafe deserialization vulnerability in the REST API. An attacker in control of the request body will be able to provide both the class name and the data to be deserialized and therefore will be able to instantiate an arbitrary type and assign arbitrary values to its fields. This issue may lead to a Denial Of Service. If a suitable gadget is available, then an attacker may also be able to exploit this vulnerability to gain pre-auth remote code execution. For additional details see the referenced GHSL-2021-087.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94, CWE-502
References: https://github.com/zstackio/zstack/security/advisories/GHSA-jfvq-548h-342x; https://securitylab.github.com/advisories/GHSL-2021-087-zstack/; https://github.com/zstackio/zstack/security/advisories/GHSA-jfvq-548h-342x
CVE: CVE-2021-34708
Published: 2021-09-09
Description: Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR Software for Cisco 8000 Series Routers could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lnt-QN9mCzwn; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lnt-QN9mCzwn
CVE: CVE-2021-34709
Published: 2021-09-09
Description: Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR Software for Cisco 8000 Series Routers could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lnt-QN9mCzwn; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lnt-QN9mCzwn
CVE: CVE-2021-34713
Published: 2021-09-09
Description: A vulnerability in the Layer 2 punt code of Cisco IOS XR Software running on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to cause the affected line card to reboot. This vulnerability is due to incorrect handling of specific Ethernet frames that cause a spin loop that can make the network processors unresponsive. An attacker could exploit this vulnerability by sending specific types of Ethernet frames on the segment where the affected line cards are attached. A successful exploit could allow the attacker to cause the affected line card to reboot.
CVSS Score: 7.4 (HIGH)
CWE: CWE-399
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-npspin-QYpwdhFD; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-npspin-QYpwdhFD
CVE: CVE-2021-34718
Published: 2021-09-09
Description: A vulnerability in the SSH Server process of Cisco IOS XR Software could allow an authenticated, remote attacker to overwrite and read arbitrary files on the local device. This vulnerability is due to insufficient input validation of arguments that are supplied by the user for a specific file transfer method. An attacker with lower-level privileges could exploit this vulnerability by specifying Secure Copy Protocol (SCP) parameters when authenticating to a device. A successful exploit could allow the attacker to elevate their privileges and retrieve and upload files on a device that they should not have access to.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88, CWE-88
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-inject-QwZOCv2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-inject-QwZOCv2
CVE: CVE-2021-34719
Published: 2021-09-09
Description: Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privescal-dZYMrKf; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privescal-dZYMrKf
CVE: CVE-2021-34720
Published: 2021-09-09
Description: A vulnerability in the IP Service Level Agreements (IP SLA) responder and Two-Way Active Measurement Protocol (TWAMP) features of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause device packet memory to become exhausted or cause the IP SLA process to crash, resulting in a denial of service (DoS) condition. This vulnerability exists because socket creation failures are mishandled during the IP SLA and TWAMP processes. An attacker could exploit this vulnerability by sending specific IP SLA or TWAMP packets to an affected device. A successful exploit could allow the attacker to exhaust the packet memory, which will impact other processes, such as routing protocols, or crash the IP SLA process.
CVSS Score: 8.6 (HIGH)
CWE: CWE-771
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsla-ZA3SRrpP; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsla-ZA3SRrpP
CVE: CVE-2021-34721
Published: 2021-09-09
Description: Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc
CVE: CVE-2021-34722
Published: 2021-09-09
Description: Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cmd-inj-wbZKvPxc
CVE: CVE-2021-34728
Published: 2021-09-09
Description: Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privescal-dZYMrKf; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privescal-dZYMrKf