deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24002
Published: 2021-06-24
Description: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1702374; https://www.mozilla.org/security/advisories/mfsa2021-14/; https://www.mozilla.org/security/advisories/mfsa2021-15/
CVE: CVE-2021-27658
Published: 2021-06-24
Description: exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-180-02; https://us-cert.gov/ics/advisories; https://www.johnsoncontrols.com/cyber-solutions/security-advisories
CVE: CVE-2021-27659
Published: 2021-06-24
Description: exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-180-01; https://us-cert.gov/ics/advisories; https://www.johnsoncontrols.com/cyber-solutions/security-advisories
CVE: CVE-2021-29944
Published: 2021-06-24
Description: Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 88.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1697604; https://www.mozilla.org/security/advisories/mfsa2021-16/; https://bugzilla.mozilla.org/show_bug.cgi?id=1697604
CVE: CVE-2021-29945
Published: 2021-06-24
Description: The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-682
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1700690; https://www.mozilla.org/security/advisories/mfsa2021-14/; https://www.mozilla.org/security/advisories/mfsa2021-15/
CVE: CVE-2021-29946
Published: 2021-06-24
Description: Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1698503; https://www.mozilla.org/security/advisories/mfsa2021-14/; https://www.mozilla.org/security/advisories/mfsa2021-15/
CVE: CVE-2021-29947
Published: 2021-06-24
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1651449%2C1674142%2C1693476%2C1696886%2C1700091; https://www.mozilla.org/security/advisories/mfsa2021-16/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1651449%2C1674142%2C1693476%2C1696886%2C1700091
CVE: CVE-2021-29948
Published: 2021-06-24
Description: Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird < 78.10.
CVSS Score: 2.5 (LOW)
CWE: CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1692899; https://www.mozilla.org/security/advisories/mfsa2021-14/; https://bugzilla.mozilla.org/show_bug.cgi?id=1692899
CVE: CVE-2021-29949
Published: 2021-06-24
Description: When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been infected with a malicious library of the alternative filename, and the malicious library has been copied to a directory that is contained in the search path for executable libraries, then Thunderbird will load the incorrect library. This vulnerability affects Thunderbird < 78.9.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1682101; https://www.mozilla.org/security/advisories/mfsa2021-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1682101
CVE: CVE-2021-29950
Published: 2021-06-24
Description: Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may remain in memory in its unprotected state. This vulnerability affects Thunderbird < 78.8.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1673239; https://www.mozilla.org/security/advisories/mfsa2021-17/; https://bugzilla.mozilla.org/show_bug.cgi?id=1673239
CVE: CVE-2021-29951
Published: 2021-06-24
Description: The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. *Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1690062; https://www.mozilla.org/security/advisories/mfsa2021-10/; https://www.mozilla.org/security/advisories/mfsa2021-18/
CVE: CVE-2021-29952
Published: 2021-06-24
Description: When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1704227; https://www.mozilla.org/security/advisories/mfsa2021-20/; https://bugzilla.mozilla.org/show_bug.cgi?id=1704227
CVE: CVE-2021-29953
Published: 2021-06-24
Description: A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1701684; https://www.mozilla.org/security/advisories/mfsa2021-20/; https://bugzilla.mozilla.org/show_bug.cgi?id=1701684
CVE: CVE-2021-29954
Published: 2021-06-24
Description: Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. This vulnerability affects Hubs Cloud < mozillareality/reticulum/1.0.1/[PII_REDACTED]1255.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-312
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1707898; https://www.mozilla.org/security/advisories/mfsa2021-21/; https://bugzilla.mozilla.org/show_bug.cgi?id=1707898
CVE: CVE-2021-29955
Published: 2021-06-24
Description: A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1692972; https://www.mozilla.org/security/advisories/mfsa2021-10/; https://www.mozilla.org/security/advisories/mfsa2021-11/
CVE: CVE-2021-29956
Published: 2021-06-24
Description: OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1710290; https://www.mozilla.org/security/advisories/mfsa2021-22/; https://bugzilla.mozilla.org/show_bug.cgi?id=1710290
CVE: CVE-2021-29957
Published: 2021-06-24
Description: If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1673241; https://www.mozilla.org/security/advisories/mfsa2021-22/; https://bugzilla.mozilla.org/show_bug.cgi?id=1673241
CVE: CVE-2021-29958
Published: 2021-06-24
Description: When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in normal browsing mode. This vulnerability affects Firefox for iOS < 34.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1670127; https://www.mozilla.org/security/advisories/mfsa2021-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1670127
CVE: CVE-2021-29959
Published: 2021-06-24
Description: When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt. This was only possible if the website kept recording with the microphone until re-enabling the camera. This vulnerability affects Firefox < 89.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1395819; https://security.gentoo.org/glsa/202107-09; https://www.mozilla.org/security/advisories/mfsa2021-23/
CVE: CVE-2021-29960
Published: 2021-06-24
Description: Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk. This vulnerability affects Firefox < 89.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-669
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1675965; https://security.gentoo.org/glsa/202107-09; https://www.mozilla.org/security/advisories/mfsa2021-23/
CVE: CVE-2021-29961
Published: 2021-06-24
Description: When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface. This vulnerability affects Firefox < 89.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1700235; https://security.gentoo.org/glsa/202107-09; https://www.mozilla.org/security/advisories/mfsa2021-23/
CVE: CVE-2021-29962
Published: 2021-06-24
Description: Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1701673; https://www.mozilla.org/security/advisories/mfsa2021-23/; https://bugzilla.mozilla.org/show_bug.cgi?id=1701673
CVE: CVE-2021-29963
Published: 2021-06-24
Description: Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1705068; https://www.mozilla.org/security/advisories/mfsa2021-23/; https://bugzilla.mozilla.org/show_bug.cgi?id=1705068
CVE: CVE-2021-29964
Published: 2021-06-24
Description: A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1706501; https://www.mozilla.org/security/advisories/mfsa2021-23/; https://www.mozilla.org/security/advisories/mfsa2021-24/
CVE: CVE-2021-29965
Published: 2021-06-24
Description: A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-610
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1709257; https://www.mozilla.org/security/advisories/mfsa2021-23/; https://bugzilla.mozilla.org/show_bug.cgi?id=1709257
CVE: CVE-2021-29966
Published: 2021-06-24
Description: Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 89.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1660307%2C1686154%2C1702948%2C1708124; https://security.gentoo.org/glsa/202107-09; https://www.mozilla.org/security/advisories/mfsa2021-23/
CVE: CVE-2021-29967
Published: 2021-06-24
Description: Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1602862%2C1703191%2C1703760%2C1704722%2C1706041; https://security.gentoo.org/glsa/202208-14; https://www.mozilla.org/security/advisories/mfsa2021-23/
CVE: CVE-2021-29968
Published: 2021-06-24
Description: When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.0.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1712047; https://www.mozilla.org/security/advisories/mfsa2021-27/; https://bugzilla.mozilla.org/show_bug.cgi?id=1712047
CVE: CVE-2020-18661
Published: 2021-06-24
Description: Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LoRexxar/CVE_Request/tree/master/gnuboard5%20mul%20vuls%20before%20v5.3.2.8#limited-reflective-xss-in-bbsloginphp; https://github.com/gnuboard/gnuboard5/issues/43; https://www.seebug.org/vuldb/ssvid-97925
CVE: CVE-2020-21787
Published: 2021-06-24
Description: CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gitee.com/ZhongBangKeJi/CRMEB/issues/I18MGD; https://gitee.com/ZhongBangKeJi/CRMEB/issues/I18MGD
CVE: CVE-2020-21788
Published: 2021-06-24
Description: In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyTaobao.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://gitee.com/ZhongBangKeJi/CRMEB/issues/I18MKC; https://gitee.com/ZhongBangKeJi/CRMEB/issues/I18MKC
CVE: CVE-2021-23398
Published: 2021-06-24
Description: All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118; https://github.com/AllenFang/react-bootstrap-table/issues/2071; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286
CVE: CVE-2021-33348
Published: 2021-06-24
Description: An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jfinal/jfinal/issues/188; https://github.com/jfinal/jfinal/issues/188
CVE: CVE-2020-18662
Published: 2021-06-24
Description: SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LoRexxar/CVE_Request/tree/master/gnuboard5%20mul%20vuls%20before%20v5.3.2.8#sql-injection-in-install_dbphp; https://github.com/gnuboard/gnuboard5/issues/43; https://www.seebug.org/vuldb/ssvid-97927
CVE: CVE-2020-18663
Published: 2021-06-24
Description: Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LoRexxar/CVE_Request/tree/master/gnuboard5%20mul%20vuls%20before%20v5.3.2.8#reflective-xss-in-bbsmove_updatephp; https://github.com/gnuboard/gnuboard5/issues/43; https://www.seebug.org/vuldb/ssvid-97926
CVE: CVE-2020-18664
Published: 2021-06-24
Description: Cross Site Scripting (XSS) vulnerability in WebPort <=1.19.1via the connection name parameter in type-conn.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LoRexxar/CVE_Request/blob/master/web%20port%20mul%20vuls%20before%20v1.19.1/web%20port%20mul%20vuls%20before%20v1.19.1.md#stored-xss--in-accesssetuptype-conn; https://www.seebug.org/vuldb/ssvid-97994; https://github.com/LoRexxar/CVE_Request/blob/master/web%20port%20mul%20vuls%20before%20v1.19.1/web%20port%20mul%20vuls%20before%20v1.19.1.md#stored-xss--in-accesssetuptype-conn
CVE: CVE-2020-18665
Published: 2021-06-24
Description: Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/LoRexxar/CVE_Request/blob/master/web%20port%20mul%20vuls%20before%20v1.19.1/web%20port%20mul%20vuls%20before%20v1.19.1.md#directory-traversal-in-tags-of-system-settings; https://www.seebug.org/vuldb/ssvid-97995; https://github.com/LoRexxar/CVE_Request/blob/master/web%20port%20mul%20vuls%20before%20v1.19.1/web%20port%20mul%20vuls%20before%20v1.19.1.md#directory-traversal-in-tags-of-system-settings
CVE: CVE-2020-18666
Published: 2021-06-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-18664. Reason: This candidate is a duplicate of CVE-2020-18664. Notes: All CVE users should reference CVE-2020-18664 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-21783
Published: 2021-06-24
Description: In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/ibos/IBOS/issues/I189ZF; https://gitee.com/ibos/IBOS/issues/I189ZF
CVE: CVE-2020-21784
Published: 2021-06-24
Description: phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cwe.mitre.org/data/definitions/96.html; https://github.com/slackero/phpwcms/issues/286; https://cwe.mitre.org/data/definitions/96.html
CVE: CVE-2020-21785
Published: 2021-06-24
Description: In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://gitee.com/ibos/IBOS/issues/I18IIV; https://gitee.com/ibos/IBOS/issues/I18IIV
CVE: CVE-2020-21786
Published: 2021-06-24
Description: In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gitee.com/ibos/IBOS/issues/I18JRG; https://gitee.com/ibos/IBOS/issues/I18JRG
CVE: CVE-2021-31649
Published: 2021-06-24
Description: In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://note.youdao.com/noteshare?id=787ccbb8345dbd4a905aebe35f1d8aa8&sub=6C5C072C901949429EFD978405212FA4; https://note.youdao.com/ynoteshare1/index.html?id=787ccbb8345dbd4a905aebe35f1d8aa8&type=note; http://note.youdao.com/noteshare?id=787ccbb8345dbd4a905aebe35f1d8aa8&sub=6C5C072C901949429EFD978405212FA4
CVE: CVE-2021-32704
Published: 2021-06-24
Description: DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint in DHIS2 versions 2.34.4, 2.35.2, 2.35.3, 2.35.4, and 2.36.0. Earlier versions, such as 2.34.3 and 2.35.1 and all versions 2.33 and older are unaffected. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. However, we strongly recommend that all DHIS2 implementations using versions 2.34, 2.35 and 2.36 install these patches as soon as possible. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the /api/trackedEntityInstance endpoint as a temporary workaround while waiting to upgrade.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://github.com/dhis2/dhis2-core/security/advisories/GHSA-fj38-585h-hxgj; https://github.com/dhis2/dhis2-core/security/advisories/GHSA-fj38-585h-hxgj
CVE: CVE-2021-33346
Published: 2021-06-24
Description: There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password of the admin user without authorization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/EmYiQing/CVE; https://www.dlink.com/en/security-bulletin/; https://github.com/EmYiQing/CVE