deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-38150
Published: 2021-09-14
Description: When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client versions - 7.0, 7.70, will allow him to read extremely sensitive data, such as credentials. This would allow the attacker to compromise the corresponding backend for which the credentials are valid.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://launchpad.support.sap.com/#/notes/3060621; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405; https://launchpad.support.sap.com/#/notes/3060621
CVE: CVE-2021-38162
Published: 2021-09-14
Description: SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.
CVSS Score: 8.9 (HIGH)
CWE: CWE-444, CWE-444
References: http://packetstormsecurity.com/files/166964/SAP-Web-Dispatcher-HTTP-Request-Smuggling.html; http://seclists.org/fulldisclosure/2022/May/3; https://launchpad.support.sap.com/#/notes/3080567
CVE: CVE-2021-38163
Published: 2021-09-14
Description: SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://launchpad.support.sap.com/#/notes/3084487; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405; https://launchpad.support.sap.com/#/notes/3084487
CVE: CVE-2021-38164
Published: 2021-09-14
Description: SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4CORE, 100, 101, 102, 103, 104, 105, allows a registered attacker to invoke certain functions that would otherwise be restricted to specific users. These functions are normally exposed over the network and once exploited the attacker may be able to view and modify financial accounting data that only a specific user should have access to.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://launchpad.support.sap.com/#/notes/3068582; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405; https://launchpad.support.sap.com/#/notes/3068582
CVE: CVE-2021-38174
Published: 2021-09-14
Description: When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 6.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3087791; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405; https://launchpad.support.sap.com/#/notes/3087791
CVE: CVE-2021-38175
Published: 2021-09-14
Description: SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather or change information in the current system without user interaction. The attack would not lead to an impact on the availability of the system, but there would be an impact on integrity and confidentiality.
CVSS Score: 6.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3082500; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405; https://launchpad.support.sap.com/#/notes/3082500
CVE: CVE-2021-38176
Published: 2021-09-14
Description: Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://launchpad.support.sap.com/#/notes/3089831; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405; https://launchpad.support.sap.com/#/notes/3089831
CVE: CVE-2021-38177
Published: 2021-09-14
Description: SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP requests over the network, this causes the SAP application to crash and has high impact on the availability of the SAP system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://packetstormsecurity.com/files/165749/SAP-CommonCryptoLib-Null-Pointer-Dereference.html; http://seclists.org/fulldisclosure/2022/Jan/74; https://launchpad.support.sap.com/#/notes/3051787
CVE: CVE-2021-23048
Published: 2021-09-14
Description: On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when GPRS Tunneling Protocol (GTP) iRules commands or a GTP profile is configured on a virtual server, undisclosed GTP messages can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K19012930; https://support.f5.com/csp/article/K19012930
CVE: CVE-2021-23049
Published: 2021-09-14
Description: On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel (TMM) memory utilization resulting in an out-of-memory condition and a denial-of-service (DoS). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K65397301; https://support.f5.com/csp/article/K65397301
CVE: CVE-2021-23050
Published: 2021-09-14
Description: On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://support.f5.com/csp/article/K44553214; https://support.f5.com/csp/article/K44553214
CVE: CVE-2021-23051
Published: 2021-09-14
Description: On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP on Amazon Web Services (AWS) systems, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This is due to an incomplete fix for CVE-2020-5862. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K01153535; https://support.f5.com/csp/article/K01153535
CVE: CVE-2021-23052
Published: 2021-09-14
Description: On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious user to build an open redirect URI. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://support.f5.com/csp/article/K32734107; https://support.f5.com/csp/article/K32734107
CVE: CVE-2021-23053
Published: 2021-09-14
Description: On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of disk space due to lack of row limit on undisclosed tables in the MYSQL database. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://support.f5.com/csp/article/K36942191; https://support.f5.com/csp/article/K36942191
CVE: CVE-2021-20508
Published: 2021-09-14
Description: IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199322.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199322; https://www.ibm.com/support/pages/node/6488459; https://exchange.xforce.ibmcloud.com/vulnerabilities/199322
CVE: CVE-2021-20569
Published: 2021-09-14
Description: IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation. IBM X-Force ID: 199243.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199243; https://www.ibm.com/support/pages/node/6488459; https://exchange.xforce.ibmcloud.com/vulnerabilities/199243
CVE: CVE-2021-20582
Published: 2021-09-14
Description: IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 199328.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199328; https://www.ibm.com/support/pages/node/6488459; https://exchange.xforce.ibmcloud.com/vulnerabilities/199328
CVE: CVE-2021-23041
Published: 2021-09-14
Description: On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.f5.com/csp/article/K42526507; https://support.f5.com/csp/article/K42526507
CVE: CVE-2021-23047
Published: 2021-09-14
Description: On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 11.6.x, when BIG-IP APM performs Online Certificate Status Protocol (OCSP) verification of a certificate that contains Authority Information Access (AIA), undisclosed requests may cause an increase in memory use. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K79428827; https://support.f5.com/csp/article/K79428827
CVE: CVE-2021-29841
Published: 2021-09-14
Description: IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205045.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/205045; https://www.ibm.com/support/pages/node/6488407; https://exchange.xforce.ibmcloud.com/vulnerabilities/205045
CVE: CVE-2021-23040
Published: 2021-09-14
Description: On BIG-IP AFM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This issue is exposed only when BIG-IP AFM is provisioned. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://support.f5.com/csp/article/K94255403; https://support.f5.com/csp/article/K94255403
CVE: CVE-2021-23042
Published: 2021-09-14
Description: On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is configured on a virtual server, undisclosed requests can cause a significant increase in system resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K93231374; https://support.f5.com/csp/article/K93231374
CVE: CVE-2021-23043
Published: 2021-09-14
Description: On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to access arbitrary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://support.f5.com/csp/article/K63163637; https://support.f5.com/csp/article/K63163637
CVE: CVE-2021-23046
Published: 2021-09-14
Description: On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from Access Guided Configuration (AGC), secure properties are logged in restnoded logs. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://support.f5.com/csp/article/K70652532; https://support.f5.com/csp/article/K70652532
CVE: CVE-2020-21048
Published: 2021-09-14
Description: An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.
CVSS Score: 6.5 (MEDIUM)
References: https://bitbucket.org/netbsd/pkgsrc/commits/6f0c011cbfccdffa635d04c84433b1a02687adad; https://github.com/saitoha/libsixel/blob/master/ChangeLog; https://github.com/saitoha/libsixel/commit/cb373ab6614c910407c5e5a93ab935144e62b037
CVE: CVE-2020-21049
Published: 2021-09-14
Description: An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bitbucket.org/netbsd/pkgsrc/commits/970a81d31ec7498e04d09b6b7771cef35f63cd28; https://github.com/saitoha/libsixel/blob/master/ChangeLog; https://github.com/saitoha/libsixel/commit/0b1e0b3f7b44233f84e5c9f512f8c90d6bbbe33d
CVE: CVE-2020-21050
Published: 2021-09-14
Description: Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bitbucket.org/netbsd/pkgsrc/commits/a27113e21179cbfbfae0c35f6a9edd6aa498faae; https://cwe.mitre.org/data/definitions/121.html; https://github.com/saitoha/libsixel/blob/master/ChangeLog
CVE: CVE-2020-21081
Published: 2021-09-14
Description: A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/magicblack/maccms8/issues/2; https://github.com/magicblack/maccms8/issues/2
CVE: CVE-2020-21082
Published: 2021-09-14
Description: A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and user cookies via crafted payloads in the text fields for Chinese and English names.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/magicblack/maccms8/issues/2; https://github.com/magicblack/maccms8/issues/2
CVE: CVE-2021-23044
Published: 2021-09-14
Description: On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when the Intel QuickAssist Technology (QAT) compression driver is used on affected BIG-IP hardware and BIG-IP Virtual Edition (VE) platforms, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K35408374; https://support.f5.com/csp/article/K35408374
CVE: CVE-2021-41077
Published: 2021-09-14
Description: The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior (if .travis.yml has been created locally by a customer, and added to git) is for a Travis service to perform builds in a way that prevents public access to customer-specific secret environment data such as signing keys, access credentials, and API tokens. However, during the stated 8-day interval, secret data could be revealed to an unauthorized actor who forked a public repository and printed files during a build process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://blog.travis-ci.com/2021-09-13-bulletin; https://news.ycombinator.com/item?id=28523350; https://news.ycombinator.com/item?id=28524727
CVE: CVE-2021-23045
Published: 2021-09-14
Description: On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when an SCTP profile with multiple paths is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K94941221; https://support.f5.com/csp/article/K94941221
CVE: CVE-2021-23032
Published: 2021-09-14
Description: On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a BIG-IP DNS system is configured with non-default Wide IP and pool settings, undisclosed DNS responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K45407662; https://support.f5.com/csp/article/K45407662
CVE: CVE-2021-23033
Published: 2021-09-14
Description: On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K05314769; https://support.f5.com/csp/article/K05314769
CVE: CVE-2021-23034
Published: 2021-09-14
Description: On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-668
References: https://support.f5.com/csp/article/K30523121; https://support.f5.com/csp/article/K30523121
CVE: CVE-2021-23035
Published: 2021-09-14
Description: On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K70415522; https://support.f5.com/csp/article/K70415522
CVE: CVE-2021-23037
Published: 2021-09-14
Description: On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://support.f5.com/csp/article/K21435974; https://support.f5.com/csp/article/K21435974
CVE: CVE-2021-23038
Published: 2021-09-14
Description: On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://support.f5.com/csp/article/K61643620; https://support.f5.com/csp/article/K61643620
CVE: CVE-2021-23039
Published: 2021-09-14
Description: On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.2.8, and all versions of 13.1.x and 12.1.x, when IPSec is configured on a BIG-IP system, undisclosed requests from an authorized remote (IPSec) peer, which already has a negotiated Security Association, can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K66782293; https://support.f5.com/csp/article/K66782293
CVE: CVE-2021-35493
Published: 2021-09-14
Description: The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO WebFOCUS Client: versions 8207.27.0 and below, TIBCO WebFOCUS Installer: versions 8207.27.0 and below, and TIBCO WebFOCUS Reporting Server: versions 8207.27.0 and below.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/09/tibco-security-advisory-september-14-2021-tibco-webfocus-2021-35493; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-39391
Published: 2021-09-14
Description: Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/beego/beego; https://github.com/beego/beego/issues/4727; https://github.com/beego/beego