deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-26677
Published: 2021-05-26
Description: Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://vfairs.com; https://api.vfairs.com/v1/users/; https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack
CVE: CVE-2020-26678
Published: 2021-05-26
Description: vFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual conference or event can abuse the functionality to upload a profile picture in order to place a malicious PHP file on the server and gain code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://vfairs.com; https://api.vfairs.com/v1/profiles; https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack
CVE: CVE-2020-26679
Published: 2021-05-26
Description: vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profile description or supply a new profile image. This can lead to potential cross-site scripting attacks on any user, or upload malicious PHP webshells as "profile pictures." The user IDs can be easily determined by other responses from the API for an event or chat room.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: http://vfairs.com; https://api.vfairs.com/v1/profiles; https://api.vfairs.com/v1/profiles?access_key=
CVE: CVE-2020-26680
Published: 2021-05-26
Description: In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://vfairs.com; https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack; http://vfairs.com
CVE: CVE-2021-20178
Published: 2021-05-26
Description: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://bugzilla.redhat.com/show_bug.cgi?id=1914774; https://github.com/ansible-collections/community.general/pull/1635%2C; https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst#security-fixes%2C
CVE: CVE-2020-25697
Published: 2021-05-26
Description: A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.
CVSS Score: 7.0 (HIGH)
CWE: CWE-306, CWE-306
References: http://www.openwall.com/lists/oss-security/2020/11/09/3; http://www.openwall.com/lists/oss-security/2020/11/09/3; https://bugzilla.redhat.com/show_bug.cgi?id=1895295
CVE: CVE-2020-27815
Published: 2021-05-26
Description: A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: http://www.openwall.com/lists/oss-security/2020/11/30/5; http://www.openwall.com/lists/oss-security/2020/12/28/1; https://bugzilla.redhat.com/show_bug.cgi?id=1897668%2C
CVE: CVE-2021-22160
Published: 2021-05-26
Description: If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E; https://lists.apache.org/thread.html/r8e[PII_REDACTED]31a83bf0644548c660255859e52feb86bbfcd42590da%40%3Cdev.pulsar.apache.org%3E; https://lists.apache.org/thread.html/r9a12b4da2f26ce9b8f7e7117a879efaa973dab7e54717bbc7923fab1%40%3Cdev.pulsar.apache.org%3E
CVE: CVE-2021-32457
Published: 2021-05-26
Description: Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which could allow an attacker to issue a specially crafted iotcl to escalate privileges on affected devices. An attacker must first obtain the ability to execute low-privileged code on the target device in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10337; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1230; https://helpcenter.trendmicro.com/en-us/article/TMKA-10337
CVE: CVE-2021-33038
Published: 2021-05-26
Description: An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://gitlab.com/mailman/hyperkitty/-/commit/[PII_REDACTED]d60b2dff740e49b70b15589d6804fa; https://gitlab.com/mailman/hyperkitty/-/issues/380; https://techblog.wikimedia.org/2021/06/11/discovering-and-fixing-cve-2021-33038-in-mailman3/
CVE: CVE-2020-18221
Published: 2021-05-26
Description: Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during block rendering of a mathematical formula.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/typora/typora-issues/issues/2204; https://github.com/typora/typora-issues/issues/2204
CVE: CVE-2020-24020
Published: 2021-05-26
Description: Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn_execute_layer_pad in libavfilter/dnn/dnn_backend_native_layer_pad.c due to a call to memcpy without length checks, which could let a remote malicious user execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=584f396132aa19d21bb1e38ad9a5d428869290cb; https://trac.ffmpeg.org/ticket/8718; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=584f396132aa19d21bb1e38ad9a5d428869290cb
CVE: CVE-2021-21985
Published: 2021-05-26
Description: The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-20, CWE-470, CWE-918
References: http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html; http://packetstormsecurity.com/files/163487/VMware-vCenter-Server-Virtual-SAN-Health-Check-Remote-Code-Execution.html; https://www.vmware.com/security/advisories/VMSA-2021-0010.html
CVE: CVE-2021-21986
Published: 2021-05-26
Description: The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html; https://www.vmware.com/security/advisories/VMSA-2021-0010.html; http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html
CVE: CVE-2021-25945
Published: 2021-05-26
Description: Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25945; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25945
CVE: CVE-2021-33194
Published: 2021-05-26
Description: golang.org/x/net before v0.0.0[PII_REDACTED]0846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/golang/net/commit/37e1c6afe[PII_REDACTED]5deced573a85ab75209d7; https://groups.google.com/g/golang-announce/c/wPunbCPkWUg; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/
CVE: CVE-2021-33506
Published: 2021-05-26
Description: jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This can allow an attacker to circumvent conference moderation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://github.com/jitsi/jitsi-meet/compare/5025...5026; https://github.com/jitsi/jitsi-meet/pull/9252/files; https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2021-0001.md
CVE: CVE-2019-4588
Published: 2021-05-26
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167365; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6456029
CVE: CVE-2020-22015
Published: 2021-05-26
Description: Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user obtain sensitive information, cause a Denial of Service, or execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8190; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2021-20486
Published: 2021-05-26
Description: IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197668; https://www.ibm.com/support/pages/node/6456033; https://exchange.xforce.ibmcloud.com/vulnerabilities/197668
CVE: CVE-2021-20487
Published: 2021-05-26
Description: IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-347
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197730; https://www.ibm.com/support/pages/node/6455911; https://exchange.xforce.ibmcloud.com/vulnerabilities/197730
CVE: CVE-2021-20492
Published: 2021-05-26
Description: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197793; https://www.ibm.com/support/pages/node/6456017; https://exchange.xforce.ibmcloud.com/vulnerabilities/197793
CVE: CVE-2021-33469
Published: 2021-05-26
Description: COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://phpgurukul.com/; https://www.exploit-db.com/exploits/49887; https://phpgurukul.com/
CVE: CVE-2021-33470
Published: 2021-05-26
Description: COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/163014/COVID-19-Testing-Management-System-1.0-SQL-Injection.html; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-04; https://phpgurukul.com/
CVE: CVE-2018-10863
Published: 2021-05-26
Description: It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer directory, through the /rhcert-transfer URL. An unauthorized attacker may use this flaw to gather sensible information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552, CWE-552
References: https://access.redhat.com/security/cve/CVE-2018-10863; https://bugzilla.redhat.com/show_bug.cgi?id=1594122; https://access.redhat.com/security/cve/CVE-2018-10863
CVE: CVE-2018-10865
Published: 2021-05-26
Description: It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to call a "restart" RPC method on any host accessible by the system, even if not belonging to him.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://access.redhat.com/security/cve/CVE-2018-10865; https://bugzilla.redhat.com/show_bug.cgi?id=1593631; https://access.redhat.com/security/cve/CVE-2018-10865
CVE: CVE-2018-10866
Published: 2021-05-26
Description: It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://access.redhat.com/security/cve/CVE-2018-10866; https://bugzilla.redhat.com/show_bug.cgi?id=1593632; https://access.redhat.com/security/cve/CVE-2018-10866
CVE: CVE-2018-10867
Published: 2021-05-26
Description: Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-552, CWE-552
References: https://access.redhat.com/security/cve/CVE-2018-10867; https://bugzilla.redhat.com/show_bug.cgi?id=1593764; https://access.redhat.com/security/cve/CVE-2018-10867
CVE: CVE-2018-10868
Published: 2021-05-26
Description: redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "Billion Laugh Attack" by replying to XMLRPC methods when getting the status of an host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400, CWE-776
References: https://access.redhat.com/security/cve/CVE-2018-10868; https://bugzilla.redhat.com/show_bug.cgi?id=1593776; https://access.redhat.com/security/cve/CVE-2018-10868
CVE: CVE-2018-16494
Published: 2021-05-26
Description: In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result in an arbitrary read, write, or execution of newly created files and directories. Insecure umask setting was present throughout the Versa servers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-377, CWE-668
References: https://hackerone.com/reports/1168191; https://hackerone.com/reports/1168191
CVE: CVE-2018-16495
Published: 2021-05-26
Description: In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user successfully logs into the application. Failing to issue a new session ID following a successful login introduces the possibility for an attacker to set up a trap session on the device the victim is likely to login with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384, CWE-384
References: https://hackerone.com/reports/1168192; https://hackerone.com/reports/1168192
CVE: CVE-2018-16496
Published: 2021-05-26
Description: In Versa Director, the un-authentication request found.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://hackerone.com/reports/1168193; https://hackerone.com/reports/1168193
CVE: CVE-2018-16497
Published: 2021-05-26
Description: In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user root, there is a potential privilege escalation vulnerability. In this case, the job runs a script as root that is writable by users who are members of the versa group.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://hackerone.com/reports/1168194; https://hackerone.com/reports/1168194
CVE: CVE-2018-16498
Published: 2021-05-26
Description: In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These credentials are for various application components such as SNMP, and SSL and Trust keystores.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://hackerone.com/reports/1168195; https://hackerone.com/reports/1168195
CVE: CVE-2018-16499
Published: 2021-05-26
Description: In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man-in-the-middle attacks. Usage of unapproved SSH encryption protocols or cipher suites also violates the Data Protection TSR (Technical Security Requirements).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://hackerone.com/reports/1168196; https://hackerone.com/reports/1168196
CVE: CVE-2019-25029
Published: 2021-05-26
Description: In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://hackerone.com/reports/1168198; https://hackerone.com/reports/1168198
CVE: CVE-2019-25030
Published: 2021-05-26
Description: In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage. Popular hashing algorithms based on the Merkle-Damgardconstruction (such as MD5 and SHA-1) alone are insufficient in thwarting password cracking. Attackers can generate and use precomputed hashes for all possible password character combinations (commonly referred to as "rainbow tables") relatively quickly. The use of adaptive hashing algorithms such asscryptorbcryptor Key-Derivation Functions (i.e.PBKDF2) to hash passwords make generation of such rainbow tables computationally infeasible.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://hackerone.com/reports/1168197; https://hackerone.com/reports/1168197
CVE: CVE-2020-15076
Published: 2021-05-26
Description: Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-61, CWE-59
References: https://swupdate.openvpn.net/downloads/privatetunnel/changelog.txt; https://swupdate.openvpn.net/downloads/privatetunnel/changelog.txt
CVE: CVE-2020-22019
Published: 2021-05-26
Description: Buffer Overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c, which could let a remote malicious user cause a Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://trac.ffmpeg.org/ticket/8241; https://www.debian.org/security/2021/dsa-4990; https://trac.ffmpeg.org/ticket/8241
CVE: CVE-2020-22020
Published: 2021-05-26
Description: Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=ce5274c1385d55892a[PII_REDACTED]02023526b765; https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8239
CVE: CVE-2020-22021
Published: 2021-05-26
Description: Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remote malicious user cause a Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/8240; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2021-22699
Published: 2021-05-26
Description: Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specific crafted requests are sent to the controller over HTTP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-05; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-05
CVE: CVE-2021-22705
Published: 2021-05-26
Description: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to system information when interacting directly with a driver installed by Vijeo Designer or EcoStruxure Machine Expert
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02
CVE: CVE-2021-22731
Published: 2021-05-26
Description: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-01
CVE: CVE-2021-22732
Published: 2021-05-26
Description: Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a code execution issue when an attacker loads unauthorized code on the web server.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04
CVE: CVE-2021-22733
Published: 2021-05-26
Description: Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause shell access when unauthorized code is loaded into the system folder.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04