deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-22907
Published: 2021-07-13
Description: Stack overflow vulnerability in function jsi_evalcode_sub in jsish before 3.0.18, allows remote attackers to cause a Denial of Service via a crafted value to the execute parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/pcmacdon/jsish/issues/16; https://github.com/pcmacdon/jsish/issues/16
CVE: CVE-2021-20360
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 195031.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195031; https://www.ibm.com/support/pages/node/6471271; https://exchange.xforce.ibmcloud.com/vulnerabilities/195031
CVE: CVE-2021-20361
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195032.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195032; https://www.ibm.com/support/pages/node/6471269; https://exchange.xforce.ibmcloud.com/vulnerabilities/195032
CVE: CVE-2021-20362
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195033.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195033; https://www.ibm.com/support/pages/node/6471343; https://exchange.xforce.ibmcloud.com/vulnerabilities/195033
CVE: CVE-2021-20363
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195034.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195034; https://www.ibm.com/support/pages/node/6471341; https://exchange.xforce.ibmcloud.com/vulnerabilities/195034
CVE: CVE-2021-20364
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195035.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195035; https://www.ibm.com/support/pages/node/6471339; https://exchange.xforce.ibmcloud.com/vulnerabilities/195035
CVE: CVE-2021-20365
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195036.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195036; https://www.ibm.com/support/pages/node/6471345; https://exchange.xforce.ibmcloud.com/vulnerabilities/195036
CVE: CVE-2021-20366
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195037.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195037; https://www.ibm.com/support/pages/node/6471337; https://exchange.xforce.ibmcloud.com/vulnerabilities/195037
CVE: CVE-2021-20368
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195357.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195357; https://www.ibm.com/support/pages/node/6471335; https://exchange.xforce.ibmcloud.com/vulnerabilities/195357
CVE: CVE-2021-20369
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 195361.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195361; https://www.ibm.com/support/pages/node/6471331; https://exchange.xforce.ibmcloud.com/vulnerabilities/195361
CVE: CVE-2021-20422
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 could disclose sensitive information to a malicious attacker by accessing data stored in memory. IBM X-Force ID: 196304.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196304; https://www.ibm.com/support/pages/node/6471327; https://exchange.xforce.ibmcloud.com/vulnerabilities/196304
CVE: CVE-2021-20423
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges due to improper application permissions. IBM X-Force ID: 196308.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196308; https://www.ibm.com/support/pages/node/6471329; https://exchange.xforce.ibmcloud.com/vulnerabilities/196308
CVE: CVE-2021-20424
Published: 2021-07-13
Description: IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. X-Force ID: 196309.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196309; https://www.ibm.com/support/pages/node/6471325; https://exchange.xforce.ibmcloud.com/vulnerabilities/196309
CVE: CVE-2021-34552
Published: 2021-07-13
Description: Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/
CVE: CVE-2020-20252
Published: 2021-07-13
Description: Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-787
References: https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2020-20252/README.md; https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2020-20252/README.md
CVE: CVE-2021-31217
Published: 2021-07-13
Description: In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-276
References: https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_12-2_release_notes.htm; https://support.solarwinds.com/SuccessCenter/s/; https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_12-2_release_notes.htm
CVE: CVE-2021-36214
Published: 2021-07-13
Description: LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/988332; https://hackerone.com/reports/988332
CVE: CVE-2021-21994
Published: 2021-07-13
Description: SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may exploit this issue to bypass SFCB authentication by sending a specially crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.vmware.com/security/advisories/VMSA-2021-0014.html; https://www.vmware.com/security/advisories/VMSA-2021-0014.html
CVE: CVE-2021-21995
Published: 2021-07-13
Description: OpenSLP as used in ESXi has a denial-of-service vulnerability due a heap out-of-bounds read issue. A malicious actor with network access to port 427 on ESXi may be able to trigger a heap out-of-bounds read in OpenSLP service resulting in a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.vmware.com/security/advisories/VMSA-2021-0014.html; https://www.vmware.com/security/advisories/VMSA-2021-0014.html
CVE: CVE-2021-22000
Published: 2021-07-13
Description: VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator level on the Windows operating system having VMware ThinApp installed on it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://packetstormsecurity.com/files/163521/VMware-ThinApp-DLL-Hijacking.html; http://seclists.org/fulldisclosure/2021/Jul/35; https://www.vmware.com/security/advisories/VMSA-2021-0015.html
CVE: CVE-2021-32755
Published: 2021-07-13
Description: Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users running iOS 13 or higher. This new websocket implementation is not configured to enforce certificate pinning when available. Certificate pinning for the new websocket is enforced in version 3.84 or above.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-v8mx-h3vj-w39v; https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-v8mx-h3vj-w39v
CVE: CVE-2020-19715
Published: 2021-07-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-13110 Reason: This candidate is a duplicate of CVE-2019-13110. Notes: All CVE users should reference CVE-2019-13110 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-19716
Published: 2021-07-13
Description: A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Exiv2/exiv2/issues/980; https://lists.debian.org/debian-lts-announce/2022/11/msg00013.html; https://github.com/Exiv2/exiv2/issues/980
CVE: CVE-2020-19717
Published: 2021-07-13
Description: An unhandled memory allocation failure in Core/Ap48bdlAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/416; https://github.com/axiomatic-systems/Bento4/issues/416
CVE: CVE-2020-19718
Published: 2021-07-13
Description: An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/417; https://github.com/axiomatic-systems/Bento4/issues/417
CVE: CVE-2020-19719
Published: 2021-07-13
Description: A buffer overflow vulnerability in Ap4ElstAtom.cpp of Bento 1.5.1-628 leads to a denial of service (DOS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/axiomatic-systems/Bento4/issues/414; https://github.com/axiomatic-systems/Bento4/issues/414
CVE: CVE-2020-19720
Published: 2021-07-13
Description: An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/413; https://github.com/axiomatic-systems/Bento4/issues/413
CVE: CVE-2020-19721
Published: 2021-07-13
Description: A heap buffer overflow vulnerability in Ap4TrunAtom.cpp of Bento 1.5.1-628 may lead to an out-of-bounds write while running mp42aac, leading to system crashes and a denial of service (DOS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/122.html; https://github.com/axiomatic-systems/Bento4/issues/415; https://cwe.mitre.org/data/definitions/122.html
CVE: CVE-2020-19722
Published: 2021-07-13
Description: An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference, leading to a denial of service (DOS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/418; https://github.com/axiomatic-systems/Bento4/issues/418
CVE: CVE-2021-20747
Published: 2021-07-14
Description: Improper authorization in handler for custom URL scheme vulnerability in Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://drive.google.com/file/d/1PBYqIsK8QxEEhGJ4SEgpY7iZw3RTTDho/view; https://jvn.jp/en/jp/JVN26891339/index.html; https://drive.google.com/file/d/1PBYqIsK8QxEEhGJ4SEgpY7iZw3RTTDho/view
CVE: CVE-2021-20748
Published: 2021-07-14
Description: Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://drive.google.com/file/d/1PBYqIsK8QxEEhGJ4SEgpY7iZw3RTTDho/view; https://jvn.jp/en/jp/JVN26891339/index.html; https://drive.google.com/file/d/1PBYqIsK8QxEEhGJ4SEgpY7iZw3RTTDho/view
CVE: CVE-2021-20781
Published: 2021-07-14
Description: Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN48413554/index.html; https://wp-filter.com/; https://wp-filter.com/update-v-2-2-8-v-1-2-8/
CVE: CVE-2021-20782
Published: 2021-07-14
Description: Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN89054582/index.html; https://wordpress.org/plugins/software-license-manager/; https://www.tipsandtricks-hq.com/software-license-manager-plugin-for-wordpress
CVE: CVE-2021-20784
Published: 2021-07-14
Description: HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website that uses the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-644
References: https://jvn.jp/en/jp/JVN68971465/; https://www.voidtools.com/; https://www.voidtools.com/downloads/
CVE: CVE-2021-36373
Published: 2021-07-14
Description: When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-130
References: https://ant.apache.org/security.html; https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E; https://lists.apache.org/thread.html/r544c9e[PII_REDACTED]465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
CVE: CVE-2021-36374
Published: 2021-07-14
Description: When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-130
References: https://ant.apache.org/security.html; https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a%40%3Ccommits.groovy.apache.org%3E; https://lists.apache.org/thread.html/r544c9e[PII_REDACTED]465b8b2d13982c75123109bd816acf839d46010d%40%3Ccommits.groovy.apache.org%3E
CVE: CVE-2021-22318
Published: 2021-07-14
Description: A component of the HarmonyOS 2.0 has a Null Pointer Dereference Vulnerability. Local attackers may exploit this vulnerability to cause system denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://device.harmonyos.com/cn/console/safetyDetail?id=9145efa5d9064d94a7fc3968b6054d83&pageSize=10&pageIndex=1; https://device.harmonyos.com/cn/console/safetyDetail?id=9145efa5d9064d94a7fc3968b6054d83&pageSize=10&pageIndex=1
CVE: CVE-2021-25953
Published: 2021-07-14
Description: Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25953; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25953
CVE: CVE-2021-33667
Published: 2021-07-14
Description: Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, through SDK calls, of Analytical Reporting bundle, a part of the frontend application, which would otherwise be restricted.
CVSS Score: 4.3 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3044751; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3044751
CVE: CVE-2021-33670
Published: 2021-07-14
Description: SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2022/May/4; https://launchpad.support.sap.com/#/notes/3056652
CVE: CVE-2021-33671
Published: 2021-07-14
Description: SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. The impact of missing authorization could result to abuse of functionality restricted to a particular user group, and could allow unauthorized users to read, modify or delete restricted data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/3059446; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3059446
CVE: CVE-2021-33676
Published: 2021-07-14
Description: A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/3066316; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3066316
CVE: CVE-2021-33677
Published: 2021-07-14
Description: SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead to information disclosure.
CVSS Score: 7.5 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3044754; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3044754
CVE: CVE-2021-33678
Published: 2021-07-14
Description: A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-95, CWE-94
References: http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html; http://seclists.org/fulldisclosure/2022/May/42; https://launchpad.support.sap.com/#/notes/3048657
CVE: CVE-2021-33680
Published: 2021-07-14
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer overflow and causes the application to crash and becoming temporarily unavailable until the user restarts the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://launchpad.support.sap.com/#/notes/3067890; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3067890
CVE: CVE-2021-33681
Published: 2021-07-14
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of bounds write and causes the application to crash and becoming temporarily unavailable until the user restarts the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3067890; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3067890
CVE: CVE-2021-33682
Published: 2021-07-14
Description: SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This would allow an attacker with basic level privileges to store a malicious script on SAP Lumira Server. The execution of the script content, by a victim registered on SAP Lumira Server, could compromise the confidentiality and integrity of SAP Lumira content.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3053403; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506; https://launchpad.support.sap.com/#/notes/3053403