deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-29556
Published: 2021-03-15
Description: The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/; https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/
CVE: CVE-2021-20286
Published: 2021-03-15
Description: A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service.
CVSS Score: 2.7 (LOW)
CWE: CWE-617
References: https://bugzilla.redhat.com/show_bug.cgi?id=1934727; https://gitlab.com/nbdkit/libnbd/-/commit/fb4440de9cc76e9c14bd3ddf3333e78621f40ad0; https://bugzilla.redhat.com/show_bug.cgi?id=1934727
CVE: CVE-2021-22191
Published: 2021-03-15
Description: Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22191.json; https://gitlab.com/wireshark/wireshark/-/issues/17232; https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html
CVE: CVE-2021-27890
Published: 2021-03-15
Description: SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/161908/MyBB-1.8.25-Remote-Command-Execution.html; https://blog.sonarsource.com/mybb-remote-code-execution-chain; https://github.com/mybb/mybb/security/advisories/GHSA-r34m-ccm8-mfhq
CVE: CVE-2021-27946
Published: 2021-03-15
Description: SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/161918/MyBB-1.8.25-SQL-Injection.html; https://github.com/mybb/mybb/security/advisories/GHSA-23m9-w75q-ph4p; http://packetstormsecurity.com/files/161918/MyBB-1.8.25-SQL-Injection.html
CVE: CVE-2021-27947
Published: 2021-03-15
Description: SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3).
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/mybb/mybb/security/advisories/GHSA-jjx8-8mcp-7h65; https://github.com/mybb/mybb/security/advisories/GHSA-jjx8-8mcp-7h65
CVE: CVE-2021-27948
Published: 2021-03-15
Description: SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3).
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/mybb/mybb/security/advisories/GHSA-3p9w-2q65-r6g2; https://github.com/mybb/mybb/security/advisories/GHSA-3p9w-2q65-r6g2
CVE: CVE-2021-27949
Published: 2021-03-15
Description: Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mybb/mybb/security/advisories/GHSA-cmmr-39v8-8rx2; https://github.com/mybb/mybb/security/advisories/GHSA-cmmr-39v8-8rx2
CVE: CVE-2021-28363
Published: 2021-03-15
Description: The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0; https://github.com/urllib3/urllib3/commits/main; https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
CVE: CVE-2020-29553
Published: 2021-03-15
Description: The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/; https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/
CVE: CVE-2021-23879
Published: 2021-03-15
Description: Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and protect the execution path. Local admin privileges are required to place the files in the required location.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428, CWE-428
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10351; https://kc.mcafee.com/corporate/index?page=content&id=SB10351
CVE: CVE-2021-3150
Published: 2021-03-15
Description: A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject arbitrary web script or HTML via the user name. The issue is fixed with the version 4.8.1
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10356; https://wiki.cryptshare.com/display/CSM/Update+from+v4.7.1+to+v4.8.1; https://kc.mcafee.com/corporate/index?page=content&id=SB10356
CVE: CVE-2020-27278
Published: 2021-03-15
Description: In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers with physical access to obtain admin privileges for the device’s configuration interface.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-798
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01
CVE: CVE-2020-27282
Published: 2021-03-15
Description: In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-112
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01
CVE: CVE-2020-27290
Published: 2021-03-15
Description: In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilator allows attackers with physical access to the configuration interface's logs to get valid checksums for tampered configuration files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-047-01
CVE: CVE-2021-20279
Published: 2021-03-15
Description: The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939033; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
CVE: CVE-2021-20280
Published: 2021-03-15
Description: Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/164817/Moodle-Cross-Site-Scripting-Server-Side-Request-Forgery.html; https://bugzilla.redhat.com/show_bug.cgi?id=1939037; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
CVE: CVE-2021-20281
Published: 2021-03-15
Description: It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939041; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
CVE: CVE-2021-20282
Published: 2021-03-15
Description: When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939046; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
CVE: CVE-2021-20283
Published: 2021-03-15
Description: The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939051; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
CVE: CVE-2021-24029
Published: 2021-03-15
Description: A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da[PII_REDACTED]d712b0 and proxygen versions prior to v2021.03.15.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://github.com/facebookincubator/mvfst/commit/a67083ff4b8dcbb7ee2839da[PII_REDACTED]d712b0; https://www.facebook.com/security/advisories/cve-2021-24029; https://github.com/facebookincubator/mvfst/commit/a67083ff4b8dcbb7ee2839da[PII_REDACTED]d712b0
CVE: CVE-2021-26987
Published: 2021-03-15
Description: Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.
CVSS Score: 9.8 (CRITICAL)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-3418
Published: 2021-03-15
Description: If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown, yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects grub2 versions prior to 2.06 and upstream and distributions using the shim_lock mechanism.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-281
References: https://bugzilla.redhat.com/show_bug.cgi?id=1933757; https://bugzilla.redhat.com/show_bug.cgi?id=1933757
CVE: CVE-2021-27230
Published: 2021-03-15
Description: ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://karmainsecurity.com/KIS-2021-03; http://packetstormsecurity.com/files/161805/ExpressionEngine-6.0.2-PHP-Code-Injection.html; http://seclists.org/fulldisclosure/2021/Mar/32
CVE: CVE-2020-1926
Published: 2021-03-16
Description: Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://issues.apache.org/jira/browse/HIVE-22708; https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E; https://issues.apache.org/jira/browse/HIVE-22708
CVE: CVE-2020-4851
Published: 2021-03-16
Description: IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user to poison log files which could impact support and development efforts. IBM X-Force ID: 190450.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190450; https://www.ibm.com/support/pages/node/6405774; https://exchange.xforce.ibmcloud.com/vulnerabilities/190450
CVE: CVE-2020-4890
Published: 2021-03-16
Description: IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a denial of service due to weak or absense of rate limiting. IBM X-Force ID: 190973.
CVSS Score: 4.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190973; https://www.ibm.com/support/pages/node/6430147; https://exchange.xforce.ibmcloud.com/vulnerabilities/190973
CVE: CVE-2020-4891
Published: 2021-03-16
Description: IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force Rest API account credentials. IBM X-Force ID: 190974.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190974; https://www.ibm.com/support/pages/node/6430147; https://exchange.xforce.ibmcloud.com/vulnerabilities/190974
CVE: CVE-2020-24263
Published: 2021-03-16
Description: Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical capabilities such as SYS_MODULE, which can be used to take over the Docker host.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://github.com/portainer/portainer/issues/4105; https://github.com/portainer/portainer/issues/4105
CVE: CVE-2020-24264
Published: 2021-03-16
Description: Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be leveraged to break out of the container leading to complete Docker host machine takeover.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/portainer/portainer/issues/4106; https://github.com/portainer/portainer/issues/4106
CVE: CVE-2021-21191
Published: 2021-03-16
Description: Use after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html; https://crbug.com/1167357; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N52OWF4BAP3JNK2QYGU3Q6QUVDZDCIMQ/
CVE: CVE-2021-21192
Published: 2021-03-16
Description: Heap buffer overflow in tab groups in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html; https://crbug.com/1181387; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N52OWF4BAP3JNK2QYGU3Q6QUVDZDCIMQ/
CVE: CVE-2021-21193
Published: 2021-03-16
Description: Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html; https://crbug.com/1186287; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N52OWF4BAP3JNK2QYGU3Q6QUVDZDCIMQ/
CVE: CVE-2021-28543
Published: 2021-03-16
Description: Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This does not affect organizations that only install the Varnish Cache product; however, it is common to install both Varnish Cache and varnish-modules. Specifically, an assertion failure or NULL pointer dereference can be triggered in Varnish Cache through the varnish-modules header.append() and header.copy() functions. For some Varnish Configuration Language (VCL) files, this gives remote clients an opportunity to cause a Varnish Cache restart. A restart reduces overall availability and performance due to an increased number of cache misses, and may cause higher load on backend servers.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-476, CWE-617
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPFBRQUJNWHCB3GQHSSAPRLQU6Q6PY43/; https://varnish-cache.org/security/VSV00006.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPFBRQUJNWHCB3GQHSSAPRLQU6Q6PY43/
CVE: CVE-2021-22887
Published: 2021-03-16
Description: A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device.
CVSS Score: 2.3 (LOW)
CWE: CWE-506
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44712; https://www.supermicro.com/en/support/security/Trickbot; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44712
CVE: CVE-2021-25916
Published: 2021-03-16
Description: Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/pjshumphreys/patchmerge/commit/5b383c537eae7a00ebd26d3f7211dac99ddecb12; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25916; https://github.com/pjshumphreys/patchmerge/commit/5b383c537eae7a00ebd26d3f7211dac99ddecb12
CVE: CVE-2021-27938
Published: 2021-03-16
Description: A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/symbiote/silverstripe-queuedjobs/releases; https://www.silverstripe.org/download/security-releases/cve-2021-27938; https://github.com/symbiote/silverstripe-queuedjobs/releases
CVE: CVE-2020-28899
Published: 2021-03-16
Description: The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote unauthenticated attackers (via crafted JSON action data to /cgi-bin/gui.cgi) to use all features provided by the router. Examples: change the router password, retrieve the Wi-Fi passphrase, send an SMS message, or modify the IP forwarding to access the internal network.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.zyxel.com/support/Zyxel-security-advisory-for-CGI-vulnerability-of-LTE.shtml; https://www.zyxel.com/support/Zyxel-security-advisory-for-CGI-vulnerability-of-LTE.shtml
CVE: CVE-2021-28294
Published: 2021-03-16
Description: Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php, which may lead to remote code execution (RCE).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/49615; https://www.exploit-db.com/exploits/49615
CVE: CVE-2021-28295
Published: 2021-03-16
Description: Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to database information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49618; https://www.exploit-db.com/exploits/49618
CVE: CVE-2021-28380
Published: 2021-03-16
Description: The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://typo3.org/security/advisory/typo3-ext-sa-2021-003; https://typo3.org/security/advisory/typo3-ext-sa-2021-003
CVE: CVE-2021-28381
Published: 2021-03-16
Description: The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://typo3.org/security/advisory/typo3-ext-sa-2021-001; https://typo3.org/security/advisory/typo3-ext-sa-2021-001
CVE: CVE-2021-3127
Published: 2021-03-16
Description: NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://advisories.nats.io/CVE/CVE-2021-3127.txt; https://advisories.nats.io/CVE/CVE-2021-3127.txt
CVE: CVE-2021-20218
Published: 2021-03-16
Description: A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
CVSS Score: 7.4 (HIGH)
CWE: CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=1923405; https://github.com/fabric8io/kubernetes-client/issues/2715; https://bugzilla.redhat.com/show_bug.cgi?id=1923405
CVE: CVE-2019-3853
Published: 2021-03-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-3897
Published: 2021-03-16
Description: It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://bugzilla.redhat.com/show_bug.cgi?id=1593768; https://bugzilla.redhat.com/show_bug.cgi?id=1593768
CVE: CVE-2019-3898
Published: 2021-03-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-3903
Published: 2021-03-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none