deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-11235
Published: 2021-06-09
Description: Buffer overflow might occur while parsing unified command due to lack of check of input data received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11238
Published: 2021-06-09
Description: Possible Buffer over-read in ARP/NS parsing due to lack of check of packet length received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11239
Published: 2021-06-09
Description: Use after free issue when importing a DMA buffer by using the CPU address of the buffer due to attachment is not cleaned up properly in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11240
Published: 2021-06-09
Description: Memory corruption due to ioctl command size was incorrectly set to the size of a pointer and not enough storage is allocated for the copy of the user argument in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-131
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11241
Published: 2021-06-09
Description: Out of bound read will happen if EAPOL Key length is less than expected while processing NAN shared key descriptor attribute in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11250
Published: 2021-06-09
Description: Use after free due to race condition when reopening the device driver repeatedly in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11256
Published: 2021-06-09
Description: Memory corruption due to lack of check of validation of pointer to buffer passed to trustzone in Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11257
Published: 2021-06-09
Description: Memory corruption due to lack of validation of pointer arguments passed to TrustZone BSP in Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11258
Published: 2021-06-09
Description: Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11259
Published: 2021-06-09
Description: Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11260
Published: 2021-06-09
Description: An improper free of uninitialized memory can occur in DIAG services in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-908
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11261
Published: 2021-06-09
Description: Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11261
CVE: CVE-2020-11262
Published: 2021-06-09
Description: A race between command submission and destroying the context can cause an invalid context being added to the list leads to use after free issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11265
Published: 2021-06-09
Description: Information disclosure issue due to lack of validation of pointer arguments passed to TZ BSP in Snapdragon Wired Infrastructure and Networking
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11266
Published: 2021-06-09
Description: Image address is dereferenced before validating its range which can cause potential QSEE information leakage in Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin
CVE: CVE-2020-11176
Published: 2021-06-09
Description: While processing server certificate from IPSec server, certificate validation for subject alternative name API can cause heap overflow which can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
CVE: CVE-2020-11267
Published: 2021-06-09
Description: Stack out-of-bounds write occurs while setting up a cipher device if the provided IV length exceeds the max limit value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
CVE: CVE-2020-11291
Published: 2021-06-09
Description: Possible buffer overflow while updating ikev2 parameters for delete payloads received during informational exchange due to lack of check of input validation for certain parameters received from the ePDG server in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
CVE: CVE-2020-11292
Published: 2021-06-09
Description: Possible buffer overflow in voice service due to lack of input validation of parameters in QMI Voice API in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
CVE: CVE-2020-11298
Published: 2021-06-09
Description: While waiting for a response to a callback or listener request, non-secure clients can change permissions to shared memory buffers used by HLOS Invoke Call to secure kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
CVE: CVE-2020-11304
Published: 2021-06-09
Description: Possible out of bound read in DRM due to improper buffer length check. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
CVE: CVE-2020-11306
Published: 2021-06-09
Description: Possible integer overflow in RPMB counter due to lack of length check on user provided data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
CVE: CVE-2021-1900
Published: 2021-06-09
Description: Possible use after free in Display due to race condition while creating an external display in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-362, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
CVE: CVE-2021-1937
Published: 2021-06-09
Description: Reachable assertion is possible while processing peer association WLAN message from host and nonstandard incoming packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
CVE: CVE-2021-34364
Published: 2021-06-09
Description: The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to, in general, address XSS and other concerns.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sindresorhus/refined-github/releases/tag/21.6.8; https://vuln.ryotak.me/advisories/47; https://github.com/sindresorhus/refined-github/releases/tag/21.6.8
CVE: CVE-2021-26313
Published: 2021-06-09
Description: Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003
CVE: CVE-2021-26314
Published: 2021-06-09
Description: Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-208, CWE-203
References: http://www.openwall.com/lists/oss-security/2021/06/09/2; http://www.openwall.com/lists/oss-security/2021/06/10/1; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV/
CVE: CVE-2021-33829
Published: 2021-06-09
Description: A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser; https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
CVE: CVE-2021-33841
Published: 2021-06-09
Description: SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/circutor-sge-plc1000-os-command-injection; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/circutor-sge-plc1000-os-command-injection
CVE: CVE-2021-33842
Published: 2021-06-09
Description: Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located.
CVSS Score: 8.8 (HIGH)
CWE: CWE-565, CWE-565
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/circutor-sge-plc1000-improper-authentication; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/circutor-sge-plc1000-improper-authentication
CVE: CVE-2021-34369
Published: 2021-06-09
Description: portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to obtain sensitive information via a modified contactSeqNumber value. NOTE: the vendor states "the information that is being queried is authorized for an authenticated user of that application, so we consider this not applicable.
CVSS Score: 6.5 (MEDIUM)
References: http://packetstormsecurity.com/files/163116/Accela-Civic-Platform-21.1-Insecure-Direct-Object-Reference.html; https://gist.github.com/0xx7/58943bb6e9ef77a09d3c7eb00dcafdc7; http://packetstormsecurity.com/files/163116/Accela-Civic-Platform-21.1-Insecure-Direct-Object-Reference.html
CVE: CVE-2021-34370
Published: 2021-06-09
Description: Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163115/Accela-Civic-Platform-21.1-Cross-Site-Scripting-Open-Redirection.html; https://gist.github.com/0xx7/7e9f1b725f7ff98b9239d3cb027b7dc8; http://packetstormsecurity.com/files/163115/Accela-Civic-Platform-21.1-Cross-Site-Scripting-Open-Redirection.html
CVE: CVE-2021-3532
Published: 2021-06-09
Description: Rejected reason: This CVE is marked as INVALID and not a bug
CVE: CVE-2021-3533
Published: 2021-06-09
Description: Rejected reason: This vulnerability does not meet the criteria for a security vulnerability
CVE: CVE-2021-33668
Published: 2021-06-09
Description: Due to improper input sanitization, specially crafted LDAP queries can be injected by an unauthenticated user. This could partially impact the confidentiality of the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://github.com/SAP/scimono/security/advisories/GHSA-wg9g-w4fg-3qqc; https://github.com/SAP/scimono/security/advisories/GHSA-wg9g-w4fg-3qqc
CVE: CVE-2021-21473
Published: 2021-06-09
Description: SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver ABAP Platform.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html; http://seclists.org/fulldisclosure/2022/May/42; https://launchpad.support.sap.com/#/notes/3002517
CVE: CVE-2021-21490
Published: 2021-06-09
Description: SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in reflected cross site scripting vulnerability, through which a malicious user can access data relating to the current session and use it to impersonate a user and access all information with the same rights as the target user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3004043; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3004043
CVE: CVE-2021-27597
Published: 2021-06-09
Description: SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method memmove() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://launchpad.support.sap.com/#/notes/3020209; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3020209
CVE: CVE-2021-27606
Published: 2021-06-09
Description: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EncOAMParamStore() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://launchpad.support.sap.com/#/notes/3020104; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3020104
CVE: CVE-2021-27607
Published: 2021-06-09
Description: SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThSncIn() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://launchpad.support.sap.com/#/notes/3021197; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3021197
CVE: CVE-2021-27615
Published: 2021-06-09
Description: SAP Manufacturing Execution versions - 15.1, 1.5.2, 15.3, 15.4, does not contain some HTTP security headers in their HTTP response. The lack of these headers in response can be exploited by the attacker to execute Cross-Site Scripting (XSS) attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3030961; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3030961
CVE: CVE-2021-27620
Published: 2021-06-09
Description: SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method Ups::AddPart() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3021050; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3021050
CVE: CVE-2021-27621
Published: 2021-06-09
Description: Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows attackers to access restricted information by entering malicious server name.
CVSS Score: 4.9 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3023299; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3023299