deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3479
Published: 2021-03-31
Description: There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370; https://bugzilla.redhat.com/show_bug.cgi?id=1939149; https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html
CVE: CVE-2021-22986
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: http://packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.html; http://packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-Code-Execution.html; https://support.f5.com/csp/article/K03009991
CVE: CVE-2021-22988
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 8.8 (HIGH)
References: https://support.f5.com/csp/article/K70031188; https://support.f5.com/csp/article/K70031188
CVE: CVE-2021-23348
Published: 2021-03-31
Description: This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/rrainn/PortProcesses/blob/fffceb09aff7180afbd0bd172e820404b33c8299/index.js%23L23; https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1; https://github.com/rrainn/PortProcesses/security/advisories/GHSA-vm67-7vmg-66vm
CVE: CVE-2021-22987
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 9.9 (CRITICAL)
References: https://support.f5.com/csp/article/K18132488; https://support.f5.com/csp/article/K18132488
CVE: CVE-2021-22989
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 9.1 (CRITICAL)
References: https://support.f5.com/csp/article/K56142644; https://support.f5.com/csp/article/K56142644
CVE: CVE-2021-22990
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.2 (HIGH)
References: https://support.f5.com/csp/article/K45056101; https://support.f5.com/csp/article/K45056101
CVE: CVE-2021-22992
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution (RCE), leading to complete system compromise. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://support.f5.com/csp/article/K52510511; https://support.f5.com/csp/article/K52510511
CVE: CVE-2021-22995
Published: 2021-03-31
Description: On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://support.f5.com/csp/article/K13155201; https://support.f5.com/csp/article/K13155201
CVE: CVE-2021-29658
Published: 2021-03-31
Description: The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace folder.
CVSS Score: 8.8 (HIGH)
References: https://github.com/jnbt/vscode-rufo/commit/bc0d212436f76d12cbdab287802fa5bc743f818a; https://marketplace.visualstudio.com/items/jnbt.vscode-rufo/changelog; https://vuln.ryotak.me/advisories/8
CVE: CVE-2021-21418
Published: 2021-03-31
Description: ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70; https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1; https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99
CVE: CVE-2021-21975
Published: 2021-03-31
Description: Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html; https://www.vmware.com/security/advisories/VMSA-2021-0004.html; http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
CVE: CVE-2021-21983
Published: 2021-03-31
Description: Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.
CVSS Score: 6.5 (MEDIUM)
References: http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html; https://www.vmware.com/security/advisories/VMSA-2021-0004.html; http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
CVE: CVE-2021-22991
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: https://support.f5.com/csp/article/K56715231; https://support.f5.com/csp/article/K56715231; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22991
CVE: CVE-2021-22993
Published: 2021-03-31
Description: On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://support.f5.com/csp/article/K55237223; https://support.f5.com/csp/article/K55237223
CVE: CVE-2021-22994
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnerability is due to an incomplete fix for CVE-2020-5948. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K66851119; https://support.f5.com/csp/article/K66851119
CVE: CVE-2021-22996
Published: 2021-03-31
Description: On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service (DoS) and impact the stability of a BIG-IQ high availability (HA) cluster. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K16352404; https://support.f5.com/csp/article/K16352404
CVE: CVE-2021-22997
Published: 2021-03-31
Description: On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://support.f5.com/csp/article/K34074377; https://support.f5.com/csp/article/K34074377
CVE: CVE-2021-22998
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation (SNAT) listeners. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
References: https://support.f5.com/csp/article/K31934524; https://support.f5.com/csp/article/K31934524
CVE: CVE-2021-22999
Published: 2021-03-31
Description: On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K02333782; https://support.f5.com/csp/article/K02333782
CVE: CVE-2021-23000
Published: 2021-03-31
Description: On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may cause TMM to restart. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K34441555; https://support.f5.com/csp/article/K34441555
CVE: CVE-2021-23001
Published: 2021-03-31
Description: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP system using a call to an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://support.f5.com/csp/article/K06440657; https://support.f5.com/csp/article/K06440657
CVE: CVE-2021-23002
Published: 2021-03-31
Description: When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 4.5 (MEDIUM)
References: https://support.f5.com/csp/article/K71891773; https://support.f5.com/csp/article/K71891773
CVE: CVE-2021-23003
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the Traffic Management Microkernel (TMM) process may produce a core file when undisclosed MPTCP traffic passes through a standard virtual server. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K43470422; https://support.f5.com/csp/article/K43470422
CVE: CVE-2021-23004
Published: 2021-03-31
Description: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K31025212; https://support.f5.com/csp/article/K31025212
CVE: CVE-2021-23005
Published: 2021-03-31
Description: On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 9.1 (CRITICAL)
References: https://support.f5.com/csp/article/K01243064; https://support.f5.com/csp/article/K01243064
CVE: CVE-2021-23006
Published: 2021-03-31
Description: On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K30585021; https://support.f5.com/csp/article/K30585021
CVE: CVE-2021-23007
Published: 2021-03-31
Description: On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
References: https://support.f5.com/csp/article/K37451543; https://support.f5.com/csp/article/K37451543
CVE: CVE-2021-29662
Published: 2021-03-31
Description: The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-704
References: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/; https://github.com/houseabsolute/Data-Validate-IP; https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e
CVE: CVE-2020-35308
Published: 2021-03-31
Description: CONQUEST DICOM SERVER before 1.5.0 has a code execution vulnerability which can be exploited by attackers to execute malicious code.
CVSS Score: 9.8 (CRITICAL)
References: https://www.cnvd.org.cn/flaw/show/2017713; https://www.cnvd.org.cn/flaw/show/2017713
CVE: CVE-2021-26943
Published: 2021-03-31
Description: The UX360CA BIOS through 303 on ASUS laptops allow an attacker (with the ring 0 privilege) to overwrite nearly arbitrary physical memory locations, including SMRAM, and execute arbitrary code in the SMM (issue 3 of 3).
CVSS Score: 8.2 (HIGH)
References: https://www.asus.com/support/FAQ/1045541/; https://www.youtube.com/watch?v=1H3AfaVyeuk; https://www.asus.com/support/FAQ/1045541/
CVE: CVE-2021-29663
Published: 2021-03-31
Description: CourseMS (aka Course Registration Management System) 2.1 is affected by cross-site scripting (XSS). When an attacker with access to an Admin account creates a Job Title in the Site area (aka the admin/add_jobs.php name parameter), they can insert an XSS payload. This payload will execute whenever anyone visits the registration page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://sourceforge.net/projects/coursems; https://github.com/cptsticky/A-0day-Per-Day-Keeps-The-Cope-Away/blob/main/CVE-2021-29663; http://sourceforge.net/projects/coursems
CVE: CVE-2021-22538
Published: 2021-03-31
Description: A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-276
References: https://github.com/google/exposure-notifications-verification-server/commit/eb8cf40b12dbe79304f1133c06fb73419383cd95; https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.23.1; https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.24.0
CVE: CVE-2020-24550
Published: 2021-03-31
Description: An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://labs.nettitude.com/blog/cve-2020-24550-open-redirect-in-episerver-find/; https://labs.nettitude.com/blog/cve-2020-24550-open-redirect-in-episerver-find/
CVE: CVE-2021-27220
Published: 2021-03-31
Description: An issue was discovered in PRTG Network Monitor before 21.1.66.1623. By invoking the screenshot functionality with prepared context paths, an attacker is able to verify the existence of certain files on the filesystem of the PRTG's Web server.
CVSS Score: 5.3 (MEDIUM)
References: https://www.paessler.com/prtg/history/stable#21.1.66.1623; https://www.paessler.com/prtg/history/stable#21.1.66.1623
CVE: CVE-2021-27349
Published: 2021-03-31
Description: Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/woo-order-export-lite/#developers; https://wordpress.org/plugins/woo-order-export-lite/#developers
CVE: CVE-2021-28994
Published: 2021-03-31
Description: kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2021/04/01/1; http://www.openwall.com/lists/oss-security/2021/04/25/1; https://www.openwall.com/lists/oss-security/2021/03/19/6
CVE: CVE-2021-29349
Published: 2021-03-31
Description: Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieform_delete_all_notifications request, which leads to removing all messages from a mailbox.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/0xBaz/CVE-2021-29349/issues/1; https://github.com/0xBaz/CVE-2021-29349/issues/1
CVE: CVE-2020-36238
Published: 2021-04-01
Description: The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-862
References: https://jira.atlassian.com/browse/JRASERVER-72249; https://jira.atlassian.com/browse/JRASERVER-72249
CVE: CVE-2020-36286
Published: 2021-04-01
Description: The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visible issue field.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-72272; https://jira.atlassian.com/browse/JRASERVER-72272
CVE: CVE-2021-26071
Published: 2021-04-01
Description: The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-72233; https://jira.atlassian.com/browse/JRASERVER-72233
CVE: CVE-2021-29251
Published: 2021-04-01
Description: BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies). This affects Docker use cases in which a mail server is configured.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.btcpayserver.org/vulnerability-disclosure-v1-0-7-0/; https://github.com/btcpayserver/btcpayserver/releases/tag/v1.0.7.1; https://blog.btcpayserver.org/vulnerability-disclosure-v1-0-7-0/
CVE: CVE-2021-29929
Published: 2021-04-01
Description: An issue was discovered in the endian_trait crate through 2021-01-04 for Rust. A double drop can occur when a user-provided Endian impl panics.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0039.html; https://rustsec.org/advisories/RUSTSEC-2021-0039.html