deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-10145
Published: 2021-05-27
Description: The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-276
References: https://www.kb.cert.org/vuls/id/125331; https://www.kb.cert.org/vuls/id/125331
CVE: CVE-2020-15438
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15439
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15440
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15441
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15442
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15443
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15444
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15445
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15446
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15447
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15448
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15449
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15450
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15451
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15452
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15453
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15454
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15455
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15456
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15457
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15458
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15459
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15460
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15461
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15462
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15463
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15464
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-15465
Published: 2021-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2021-27852
Published: 2021-05-27
Description: Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.kb.cert.org/vuls/id/706695; https://www.kb.cert.org/vuls/id/706695; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27852
CVE: CVE-2021-33408
Published: 2021-05-27
Description: Local File Inclusion vulnerability in Ab Initio Control>Center before 4.0.2.6 allows remote attackers to retrieve arbitrary files. Fixed in v4.0.2.6 and v4.0.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://www.abinitio.com/en/security-advisories/ab-2021-001/; https://www.abinitio.com/en/security-advisories/ab-2021-001/
CVE: CVE-2021-32539
Published: 2021-05-28
Description: Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4755-bd590-1.html; https://www.twcert.org.tw/tw/cp-132-4755-bd590-1.html
CVE: CVE-2021-32540
Published: 2021-05-28
Description: Add announcement function in the 101EIP system does not filter special characters, which allows authenticated users to inject JavaScript and perform a stored XSS attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4756-981be-1.html; https://www.twcert.org.tw/tw/cp-132-4756-981be-1.html
CVE: CVE-2021-32541
Published: 2021-05-28
Description: The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can send a large number of valid usernames, and force those logged-in account to log out, causing the user to be unable to access the services
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344; https://www.twcert.org.tw/tw/cp-132-4757-893eb-1.html; https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
CVE: CVE-2021-32542
Published: 2021-05-28
Description: The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344; https://www.twcert.org.tw/tw/cp-132-4758-82b05-1.html; https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
CVE: CVE-2021-32543
Published: 2021-05-28
Description: The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344; https://www.twcert.org.tw/tw/cp-132-4759-92eab-1.html; https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
CVE: CVE-2020-25710
Published: 2021-05-28
Description: A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://bugzilla.redhat.com/show_bug.cgi?id=1899678; https://git.openldap.org/openldap/openldap/-/commit/ab3915154e69920d480205b4bf5ccb2b391a0a1f#a2feb6ed0257c21c6672793ee2f94eaadc10c72c; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2020-25715
Published: 2021-05-28
Description: A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1891016; https://bugzilla.redhat.com/show_bug.cgi?id=1891016
CVE: CVE-2020-27826
Published: 2021-05-28
Description: A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-250
References: https://bugzilla.redhat.com/show_bug.cgi?id=1905089; https://bugzilla.redhat.com/show_bug.cgi?id=1905089
CVE: CVE-2020-27847
Published: 2021-05-28
Description: A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-228
References: https://bugzilla.redhat.com/show_bug.cgi?id=1907732; https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5; https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
CVE: CVE-2020-35504
Published: 2021-05-28
Description: A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://www.openwall.com/lists/oss-security/2021/04/16/3; https://bugzilla.redhat.com/show_bug.cgi?id=1909766; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2020-35505
Published: 2021-05-28
Description: A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://www.openwall.com/lists/oss-security/2021/04/16/3; https://bugzilla.redhat.com/show_bug.cgi?id=1909769; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2020-35506
Published: 2021-05-28
Description: A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2021/04/16/3; https://bugzilla.redhat.com/show_bug.cgi?id=1909996; https://security.gentoo.org/glsa/202208-27
CVE: CVE-2021-20195
Published: 2021-05-28
Description: A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20, CWE-116
References: https://bugzilla.redhat.com/show_bug.cgi?id=1919143; https://bugzilla.redhat.com/show_bug.cgi?id=1919143
CVE: CVE-2021-20201
Published: 2021-05-28
Description: A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://blog.qualys.com/product-tech/2011/10/31/tls-renegotiation-and-denial-of-service-attacks; https://bugzilla.redhat.com/show_bug.cgi?id=1921846; https://security.gentoo.org/glsa/202208-10
CVE: CVE-2021-20236
Published: 2021-05-28
Description: A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1921976; https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8; https://bugzilla.redhat.com/show_bug.cgi?id=1921976
CVE: CVE-2021-20237
Published: 2021-05-28
Description: An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated attacker to send crafted PUB messages that consume excessive memory if the CURVE/ZAP authentication is disabled on the server, causing a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1921989; https://github.com/zeromq/libzmq/security/advisories/GHSA-4p5v-h92w-6wxw; https://bugzilla.redhat.com/show_bug.cgi?id=1921989
CVE: CVE-2021-20239
Published: 2021-05-28
Description: A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 3.3 (LOW)
CWE: CWE-822, CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1923636; https://bugzilla.redhat.com/show_bug.cgi?id=1923636
CVE: CVE-2021-20240
Published: 2021-05-28
Description: A flaw was found in gdk-pixbuf in versions before 2.42.0. An integer wraparound leading to an out of bounds write can occur when a crafted GIF image is loaded. An attacker may cause applications to crash or could potentially execute code on the victim system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://bugzilla.redhat.com/show_bug.cgi?id=1926787; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5H3GNVWMZTYZR3JBYCK57PF7PFMQBNP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BGZVCTH5O7WBJLYXZ2UOKLYNIFPVR55D/
CVE: CVE-2021-20278
Published: 2021-05-28
Description: An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290, CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=1937171; https://kiali.io/news/security-bulletins/kiali-security-002/; https://bugzilla.redhat.com/show_bug.cgi?id=1937171
CVE: CVE-2021-20292
Published: 2021-05-28
Description: There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker with a local account with a root privilege, can leverage this vulnerability to escalate privileges and execute code in the context of the kernel.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939686; https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html; https://bugzilla.redhat.com/show_bug.cgi?id=1939686
CVE: CVE-2021-33591
Published: 2021-05-28
Description: An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-489
References: https://cve.naver.com/detail/cve-2021-33591; https://cve.naver.com/detail/cve-2021-33591
CVE: CVE-2021-21734
Published: 2021-05-28
Description: Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON MDU device ZXA10 F821 V1.7.0P3T22, ZXA10 F822 V1.4.3T6, ZXA10 F819 V1.2.1T5, ZXA10 F832 V1.1.1T7, ZXA10 F839 V1.1.0T8, ZXA10 F809 V3.2.1T1, ZXA10 F822P V1.1.1T7, ZXA10 F832 V2.00.00.01
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015524; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015524
CVE: CVE-2021-27032
Published: 2021-05-28
Description: Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues. A malicious user with limited privileges could run any number of tools on a system to identify services that are configured with weak permissions and are running under elevated privileges. These weak permissions could allow all users on the operating system to modify the service configuration and take ownership of the service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://knowledge.autodesk.com/search-result/caas/downloads/content/autodesk-licensing-service-download.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0002%3B
CVE: CVE-2021-33620
Published: 2021-05-28
Description: Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2023/Oct/14; http://www.openwall.com/lists/oss-security/2023/10/11/3; http://www.squid-cache.org/Versions/v4/changesets/squid-4-1e05a85bd28c22c9ca5d3ac9f5e86d6269ec0a8c.patch
CVE: CVE-2010-3843
Published: 2021-05-28
Description: The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://article.gmane.org/gmane.comp.security.oss.general/3660; https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347; https://bugzilla.redhat.com/show_bug.cgi?id=643453
CVE: CVE-2020-1716
Published: 2021-05-28
Description: A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://bugzilla.redhat.com/show_bug.cgi?id=1795592; https://bugzilla.redhat.com/show_bug.cgi?id=1795592
CVE: CVE-2020-1729
Published: 2021-05-28
Description: A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=1802444; https://bugzilla.redhat.com/show_bug.cgi?id=1802444