deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27963
Published: 2022-03-31
Description: Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-428
References: https://github.com/ycdxsb/Vuln/tree/main/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xftp-CreateProcessW-Misuse-Binary-Hijack; https://www.netsarang.com/en/xftp-update-history/; https://github.com/ycdxsb/Vuln/tree/main/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xftp-CreateProcessW-Misuse-Binary-Hijack
CVE: CVE-2022-27964
Published: 2022-03-31
Description: Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-428
References: https://github.com/ycdxsb/Vuln/blob/main/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xmanager-CreateProcessW-Misuse-Binary-Hijack; https://www.netsarang.com/en/xmanager-update-history/; https://github.com/ycdxsb/Vuln/blob/main/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xmanager-CreateProcessW-Misuse-Binary-Hijack
CVE: CVE-2022-27965
Published: 2022-03-31
Description: Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-428
References: https://github.com/ycdxsb/Vuln/tree/main/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xlpd-CreateProcessW-Misuse-Binary-Hijack; https://www.netsarang.com/en/xlpd-update-history/; https://github.com/ycdxsb/Vuln/tree/main/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xlpd-CreateProcessW-Misuse-Binary-Hijack
CVE: CVE-2022-27966
Published: 2022-03-31
Description: Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-428
References: https://github.com/ycdxsb/Vuln/blob/main/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xshell-CreateProcessW-Misuse-Binary-Hijack; https://www.netsarang.com/en/xshell-update-history/; https://github.com/ycdxsb/Vuln/blob/main/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xshell-CreateProcessW-Misuse-Binary-Hijack
CVE: CVE-2022-24802
Published: 2022-04-01
Description: deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-915, CWE-1321
References: https://github.com/RebeccaStevens/deepmerge-ts/commit/b39f1a93d9e1c3541bd2fe159fd696a16dbe1c72; https://github.com/RebeccaStevens/deepmerge-ts/commit/d637db7e4fb2bfb113cb4bc1c85a125936d7081b; https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-r9w3-g83q-m6hq
CVE: CVE-2022-24803
Published: 2022-04-01
Description: Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://github.com/jirutka/asciidoctor-include-ext/commit/c7ea001a597c[PII_REDACTED]c51483dab7b87ae155; https://github.com/jirutka/asciidoctor-include-ext/commit/cbaccf3de533cbca224bf61d0b74e4b84d41d8ee; https://github.com/jirutka/asciidoctor-include-ext/security/advisories/GHSA-v222-6mr4-qj29
CVE: CVE-2021-1942
Published: 2022-04-01
Description: Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-1950
Published: 2022-04-01
Description: Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-30328
Published: 2022-04-01
Description: Possible assertion due to improper validation of invalid NR CSI-IM resource configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-30329
Published: 2022-04-01
Description: Possible assertion due to improper validation of TCI configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-30331
Published: 2022-04-01
Description: Possible buffer overflow due to improper data validation of external commands sent via DIAG interface in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-30332
Published: 2022-04-01
Description: Possible assertion due to improper validation of OTA configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-30333
Published: 2022-04-01
Description: Improper validation of buffer size input to the EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-35088
Published: 2022-04-01
Description: Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-35089
Published: 2022-04-01
Description: Possible buffer overflow due to lack of input IB amount validation while processing the user command in Snapdragon Auto
CVSS Score: 8.4 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-35103
Published: 2022-04-01
Description: Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-35105
Published: 2022-04-01
Description: Possible out of bounds access due to improper input validation during graphics profiling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-704
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-35106
Published: 2022-04-01
Description: Possible out of bound read due to improper length calculation of WMI message. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-35110
Published: 2022-04-01
Description: Possible buffer overflow to improper validation of hash segment of file while allocating memory in Snapdragon Connectivity, Snapdragon Mobile
CVSS Score: 8.1 (HIGH)
CWE: CWE-704
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-35115
Published: 2022-04-01
Description: Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2021-35117
Published: 2022-04-01
Description: An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2022-bulletin
CVE: CVE-2022-25017
Published: 2022-04-01
Description: Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://gist.github.com/zaee-k/390b2f8e50407e4b199df806baa7e4ef; https://gist.github.com/zaee-k/390b2f8e50407e4b199df806baa7e4ef
CVE: CVE-2022-21947
Published: 2022-04-01
Description: A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V.
CVSS Score: 8.3 (HIGH)
CWE: CWE-668, CWE-668
References: https://bugzilla.suse.com/show_bug.cgi?id=1197491; https://bugzilla.suse.com/show_bug.cgi?id=1197491
CVE: CVE-2021-46443
Published: 2022-04-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-24181
Published: 2022-04-01
Description: Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pkp/pkp-lib/issues/7649; https://github.com/pkp/pkp-lib/issues/7649
CVE: CVE-2021-44135
Published: 2022-04-01
Description: pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://huntr.dev/bounties/82f09b08-ceeb-4249-8855-b8bc718c4868/; https://huntr.dev/bounties/82f09b08-ceeb-4249-8855-b8bc718c4868/
CVE: CVE-2022-21235
Published: 2022-04-01
Description: The package github.com/masterminds/vcs before 1.13.3 are vulnerable to Command Injection via argument injection. When hg is executed, argument strings are passed to hg in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://github.com/Masterminds/vcs/pull/105; https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078; https://github.com/Masterminds/vcs/pull/105
CVE: CVE-2022-22327
Published: 2022-04-01
Description: IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 218859.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218859; https://www.ibm.com/support/pages/node/6568551; https://exchange.xforce.ibmcloud.com/vulnerabilities/218859
CVE: CVE-2022-22328
Published: 2022-04-01
Description: IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data. IBM X-Force ID: 218871.
CVSS Score: 6.2 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218871; https://www.ibm.com/support/pages/node/6568297; https://exchange.xforce.ibmcloud.com/vulnerabilities/218871
CVE: CVE-2022-22331
Published: 2022-04-01
Description: IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR). IBM X-Force ID: 219130.
CVSS Score: 7.1 (HIGH)
CWE: CWE-639
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/219130; https://www.ibm.com/support/pages/node/6568299; https://exchange.xforce.ibmcloud.com/vulnerabilities/219130
CVE: CVE-2022-22332
Published: 2022-04-01
Description: IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131.
CVSS Score: 7.5 (HIGH)
CWE: CWE-672
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/219131; https://www.ibm.com/support/pages/node/6568301; https://exchange.xforce.ibmcloud.com/vulnerabilities/219131
CVE: CVE-2022-22404
Published: 2022-04-01
Description: IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) may be vulnerable to denial of service due to excessive rate limiting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/222575; https://www.ibm.com/support/pages/node/6568359; https://exchange.xforce.ibmcloud.com/vulnerabilities/222575
CVE: CVE-2022-21223
Published: 2022-04-01
Description: The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://github.com/CocoaPods/cocoapods-downloader/pull/127; https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414280; https://github.com/CocoaPods/cocoapods-downloader/pull/127
CVE: CVE-2022-24440
Published: 2022-04-01
Description: The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://github.com/CocoaPods/cocoapods-downloader/pull/124; https://github.com/CocoaPods/cocoapods-downloader/pull/128; https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414278
CVE: CVE-2022-1207
Published: 2022-04-01
Description: Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://github.com/radareorg/radare2/commit/605785b65dd356d46d4487faa41dbf90943b8bc1; https://huntr.dev/bounties/7b979e76-ae54-4132-b455-0833e45195eb; https://github.com/radareorg/radare2/commit/605785b65dd356d46d4487faa41dbf90943b8bc1
CVE: CVE-2022-23155
Published: 2022-04-01
Description: Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerability. A malicious user with admin privileges can exploit this vulnerability in order to execute arbitrary code on the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.dell.com/support/kbdoc/000195918; https://www.dell.com/support/kbdoc/000195918
CVE: CVE-2022-23156
Published: 2022-04-01
Description: Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by providing invalid input in order to obtain a connection to WMS server.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-287
References: https://www.dell.com/support/kbdoc/000196005; https://www.dell.com/support/kbdoc/000196005
CVE: CVE-2022-23157
Published: 2022-04-01
Description: Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vulnerability in order to view sensitive information from the WMS Server.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.dell.com/support/kbdoc/000196005; https://www.dell.com/support/kbdoc/000196005
CVE: CVE-2022-23158
Published: 2022-04-01
Description: Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vulnerability and provide incorrect port information and get connected to valid WMS server
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-183, CWE-200
References: https://www.dell.com/support/kbdoc/000196005; https://www.dell.com/support/kbdoc/000196005
CVE: CVE-2022-24066
Published: 2022-04-01
Description: The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://gist.github.com/lirantal/a930d902294b833514e[PII_REDACTED]26b; https://github.com/steveukx/git-js/commit/2040de601c894363050fef9f28af367b169a56c5; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2434820
CVE: CVE-2022-24426
Published: 2022-04-01
Description: Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.dell.com/support/kbdoc/en-us/000197723/dsa-2022-074; https://www.dell.com/support/kbdoc/en-us/000197723/dsa-2022-074
CVE: CVE-2022-26562
Published: 2022-04-01
Description: An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or password is expired. It also exists in the predecessor Zarafa Collaboration Platform (ZCP) in provider/libserver/ECPamAuth.cpp of Zarafa >= 6.30 (introduced between 6.30.0 RC1e and 6.30.8 final).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-342b96903b; https://bugzilla.redhat.com/show_bug.cgi?id=2192126; https://github.com/Kopano-dev/kopano-core/blob/master/provider/libserver/ECKrbAuth.cpp#L137
CVE: CVE-2022-26565
Published: 2022-04-01
Description: A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Name text field when creating a new page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://bug.pocas.kr/2022/03/01/2022-03-05-CVE-2022-26565/; https://github.com/totaljs/cms/issues/35; https://bug.pocas.kr/2022/03/01/2022-03-05-CVE-2022-26565/
CVE: CVE-2022-27306
Published: 2022-04-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-14839
Published: 2022-04-01
Description: It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using some tool like burp suite etc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1748178; https://bugzilla.redhat.com/show_bug.cgi?id=1748178
CVE: CVE-2020-14479
Published: 2022-04-01
Description: Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01; https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01
CVE: CVE-2020-25691
Published: 2022-04-01
Description: A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://bugzilla.redhat.com/show_bug.cgi?id=1893725; https://bugzilla.redhat.com/show_bug.cgi?id=1893725
CVE: CVE-2021-20238
Published: 2022-04-01
Description: It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint (port 22623) provides ignition configuration used for bootstrapping Nodes and can include some sensitive data, e.g. registry pull secrets. There are two scenarios where this data can be accessed. The first is on Baremetal, OpenStack, Ovirt, Vsphere and KubeVirt deployments which do not have a separate internal API endpoint and allow access from outside the cluster to port 22623 from the standard OpenShift API Virtual IP address. The second is on cloud deployments when using unsupported network plugins, which do not create iptables rules that prevent to port 22623. In this scenario, the ignition config is exposed to all pods within the cluster and cannot be accessed externally.
CVSS Score: 3.7 (LOW)
CWE: CWE-287, CWE-306
References: https://bugzilla.redhat.com/show_bug.cgi?id=1926568; https://bugzilla.redhat.com/show_bug.cgi?id=1926568