deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37016
Published: 2021-11-23
Description: There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause Information Disclosure or Denial of Service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37017
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37018
Published: 2021-11-23
Description: There is a Data Processing Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37019
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37022
Published: 2021-11-23
Description: There is a Heap-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause root permission which can be escalated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37023
Published: 2021-11-23
Description: There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause media files which can be reads and writes in non-distributed directories on any device on the network..
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37024
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37025
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37026
Published: 2021-11-23
Description: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]; https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202108-[PII_REDACTED]
CVE: CVE-2021-37029
Published: 2021-11-23
Description: There is an Identity verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability.
CVSS Score: 5.3 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2021/8/; https://consumer.huawei.com/en/support/bulletin/2021/8/
CVE: CVE-2021-37030
Published: 2021-11-23
Description: There is an Improper permission vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2021/8/; https://consumer.huawei.com/en/support/bulletin/2021/8/
CVE: CVE-2021-37031
Published: 2021-11-23
Description: There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpectedly.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/8/; https://consumer.huawei.com/en/support/bulletin/2021/8/
CVE: CVE-2021-37032
Published: 2021-11-23
Description: There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to work.
CVSS Score: 5.3 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2021/8/; https://consumer.huawei.com/en/support/bulletin/2021/8/
CVE: CVE-2021-37033
Published: 2021-11-23
Description: There is an Injection attack vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://consumer.huawei.com/en/support/bulletin/2021/8/; https://consumer.huawei.com/en/support/bulletin/2021/8/
CVE: CVE-2021-37034
Published: 2021-11-23
Description: There is an Unstandardized field names in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/8/; https://consumer.huawei.com/en/support/bulletin/2021/8/
CVE: CVE-2021-37035
Published: 2021-11-23
Description: There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpectedly.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/8/; https://consumer.huawei.com/en/support/bulletin/2021/8/
CVE: CVE-2021-37102
Published: 2021-11-23
Description: There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system. Affected product versions include: FusionCompute 6.0.0, 6.3.0, 6.3.1, 6.5.0, 6.5.1, 8.0.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210922-01-cmd-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210922-01-cmd-en
CVE: CVE-2021-3672
Published: 2021-11-23
Description: A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1988342; https://c-ares.haxx.se/adv_20210810.html; https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE: CVE-2021-43019
Published: 2021-11-23
Description: Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability on the product installer. User interaction is required before product installation to abuse this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://helpx.adobe.com/security/products/creative-cloud/apsb21-111.html; https://helpx.adobe.com/security/products/creative-cloud/apsb21-111.html
CVE: CVE-2021-21561
Published: 2021-11-23
Description: Dell PowerScale OneFS version 8.1.2 contains a sensitive information exposure vulnerability. This would allow a malicious user with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE privileges to gain access to sensitive information in the log files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/000191265; https://www.dell.com/support/kbdoc/000191265
CVE: CVE-2021-24641
Published: 2021-11-23
Description: The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/972f8c5d-22b7-42de-a981-2e5acb72297b; https://wpscan.com/vulnerability/972f8c5d-22b7-42de-a981-2e5acb72297b
CVE: CVE-2021-24644
Published: 2021-11-23
Description: The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to a Local File Inclusion issue
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://wpscan.com/vulnerability/5a363eeb-9510-4535-97e2-9dfd3b10d511; https://wpscan.com/vulnerability/5a363eeb-9510-4535-97e2-9dfd3b10d511
CVE: CVE-2021-24668
Published: 2021-11-23
Description: The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/519205ff-2ff6-41e4-9e95-475ab2ce35b9; https://wpscan.com/vulnerability/519205ff-2ff6-41e4-9e95-475ab2ce35b9
CVE: CVE-2021-24700
Published: 2021-11-23
Description: The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1d489b05-296e-4268-8[PII_REDACTED]f9b41; https://wpscan.com/vulnerability/1d489b05-296e-4268-8[PII_REDACTED]f9b41
CVE: CVE-2021-24703
Published: 2021-11-23
Description: The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-732, CWE-352
References: https://wpscan.com/vulnerability/4ed8296e-1306-481f-9a22-723b051122c0; https://wpscan.com/vulnerability/4ed8296e-1306-481f-9a22-723b051122c0
CVE: CVE-2021-24713
Published: 2021-11-23
Description: The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4a90be69-41eb-43e9-962d-34316497b4df; https://wpscan.com/vulnerability/4a90be69-41eb-43e9-962d-34316497b4df
CVE: CVE-2021-24729
Published: 2021-11-23
Description: The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5d70818e-730d-40c9-a2db-652052a5fd5c; https://wpscan.com/vulnerability/5d70818e-730d-40c9-a2db-652052a5fd5c
CVE: CVE-2021-24812
Published: 2021-11-23
Description: The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6bc8fff1-ff10-4175-8a46-563f0f26f96a; https://wpscan.com/vulnerability/6bc8fff1-ff10-4175-8a46-563f0f26f96a
CVE: CVE-2021-24830
Published: 2021-11-23
Description: The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2616161/; https://wpscan.com/vulnerability/1c46373b-d43d-4d18-b0ae-3711fb0be0f9; https://plugins.trac.wordpress.org/changeset/2616161/
CVE: CVE-2021-24873
Published: 2021-11-23
Description: The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2615802/tutor; https://wpscan.com/vulnerability/19980b57-1954-4a29-b2c2-43eadf758ed3; https://plugins.trac.wordpress.org/changeset/2615802/tutor
CVE: CVE-2021-24875
Published: 2021-11-23
Description: The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/652efc4a-f931-4668-ae74-a58b288a5715; https://wpscan.com/vulnerability/652efc4a-f931-4668-ae74-a58b288a5715
CVE: CVE-2021-24877
Published: 2021-11-23
Description: The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/b09fe120-ab9b-44f2-b50d-3b4b299d6d15; https://wpscan.com/vulnerability/b09fe120-ab9b-44f2-b50d-3b4b299d6d15
CVE: CVE-2021-24882
Published: 2021-11-23
Description: The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6d71816c-8267-4b84-9087-191fbb976e72; https://wpscan.com/vulnerability/6d71816c-8267-4b84-9087-191fbb976e72
CVE: CVE-2021-24888
Published: 2021-11-23
Description: The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/19bffa71-705c-42fc-b2ca-bf62fabb70a0; https://wpscan.com/vulnerability/19bffa71-705c-42fc-b2ca-bf62fabb70a0
CVE: CVE-2021-24891
Published: 2021-11-23
Description: The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fbed0daa-007d-4f91-8d87-4bca7781de2d; https://www.jbelamor.com/xss-elementor-lightox.html; https://wpscan.com/vulnerability/fbed0daa-007d-4f91-8d87-4bca7781de2d
CVE: CVE-2021-24892
Published: 2021-11-23
Description: Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2; https://wpscan.com/vulnerability/364b0843-a990-4204-848a-60c928cc5bc0; https://github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2
CVE: CVE-2021-24894
Published: 2021-11-23
Description: The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-191, CWE-20
References: https://plugins.trac.wordpress.org/changeset/2618234; https://wpscan.com/vulnerability/79bb5acb-ea56-41a9-83a1-28a181ae41e2; https://plugins.trac.wordpress.org/changeset/2618234
CVE: CVE-2021-25986
Published: 2021-11-23
Description: In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/django-wiki/django-wiki/commit/9eaccc7519e4206a4d2f22640882f0737b2da9c5; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25986; https://github.com/django-wiki/django-wiki/commit/9eaccc7519e4206a4d2f22640882f0737b2da9c5
CVE: CVE-2021-31851
Published: 2021-11-23
Description: A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extraction of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10372; https://kc.mcafee.com/corporate/index?page=content&id=SB10372
CVE: CVE-2021-31852
Published: 2021-11-23
Description: A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extract of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10372; https://kc.mcafee.com/corporate/index?page=content&id=SB10372
CVE: CVE-2021-36299
Published: 2021-11-23
Description: Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://support.emc.com/kb/000191229; https://support.emc.com/kb/000191229
CVE: CVE-2021-36300
Published: 2021-11-23
Description: iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a specially crafted malicious request to crash the webserver or cause information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://support.emc.com/kb/000191229; https://support.emc.com/kb/000191229
CVE: CVE-2021-36301
Published: 2021-11-23
Description: Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control process execution and gain access to the underlying operating system.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://support.emc.com/kb/000191229; https://support.emc.com/kb/000191229
CVE: CVE-2021-36311
Published: 2021-11-23
Description: Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any local malicious user with networker user privileges may exploit this vulnerability to upload malicious file to unauthorized locations and execute it.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-285
References: https://www.dell.com/support/kbdoc/000192419; https://www.dell.com/support/kbdoc/000192419
CVE: CVE-2021-36312
Published: 2021-11-23
Description: Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowledge of the hard-coded credentials, may potentially exploit this vulnerability to gain unauthorized access to the system.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-259
References: https://www.dell.com/support/kbdoc/en-us/000193031/https-dellservices-lightning-force-com-one-one-app; https://www.dell.com/support/kbdoc/en-us/000193031/https-dellservices-lightning-force-com-one-one-app
CVE: CVE-2021-36313
Published: 2021-11-23
Description: Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker. This vulnerability is considered critical as it may be leveraged to completely compromise the vulnerable application as well as the underlying operating system. Dell recommends customers to upgrade at the earliest opportunity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-74, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000193031/https-dellservices-lightning-force-com-one-one-app; https://www.dell.com/support/kbdoc/en-us/000193031/https-dellservices-lightning-force-com-one-one-app
CVE: CVE-2021-36314
Published: 2021-11-23
Description: Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability. A remote unauthenticated attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary files on the end user system.
CVSS Score: 7.1 (HIGH)
References: https://www.dell.com/support/kbdoc/en-us/000193031/https-dellservices-lightning-force-com-one-one-app; https://www.dell.com/support/kbdoc/en-us/000193031/https-dellservices-lightning-force-com-one-one-app
CVE: CVE-2021-36332
Published: 2021-11-23
Description: Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability. A remote low privileged attacker, may potentially exploit this vulnerability, directing end user to arbitrary and potentially malicious websites.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://www.dell.com/support/kbdoc/en-us/000193031/https-dellservices-lightning-force-com-one-one-app; https://www.dell.com/support/kbdoc/en-us/000193031/https-dellservices-lightning-force-com-one-one-app