deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-11273
Published: 2021-05-07
Description: Histogram type KPI was teardown with the assumption of the existence of histogram binning info and will lead to null pointer access when histogram binning info is missing due to lack of null check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2020-11274
Published: 2021-05-07
Description: Denial of service in MODEM due to assert to the invalid configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2020-11279
Published: 2021-05-07
Description: Memory corruption while processing crafted SDES packets due to improper length check in sdes packets recieved in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2020-11284
Published: 2021-05-07
Description: Locked memory can be unlocked and modified by non secure boot loader through improper system call sequence making the memory region untrusted source of input for secure boot loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-667
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2020-11285
Published: 2021-05-07
Description: Buffer over-read while unpacking the RTCP packet we may read extra byte if wrong length is provided in RTCP packets in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2020-11288
Published: 2021-05-07
Description: Out of bound write can occur in playready while processing command due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2020-11289
Published: 2021-05-07
Description: Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2020-11293
Published: 2021-05-07
Description: Out of bound read can happen in Widevine TA while copying data to buffer from user data due to lack of check of buffer length received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2020-11294
Published: 2021-05-07
Description: Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2020-11295
Published: 2021-05-07
Description: Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2021-1891
Published: 2021-05-07
Description: A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2021-1895
Published: 2021-05-07
Description: Possible integer overflow due to improper length check while flashing an image in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2021-1905
Published: 2021-05-07
Description: Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1905
CVE: CVE-2021-1906
Published: 2021-05-07
Description: Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 6.2 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1906
CVE: CVE-2021-1910
Published: 2021-05-07
Description: Double free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.3 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2021-1915
Published: 2021-05-07
Description: Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2021-1925
Published: 2021-05-07
Description: Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2021-1927
Published: 2021-05-07
Description: Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin
CVE: CVE-2021-30170
Published: 2021-05-07
Description: Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html; https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html
CVE: CVE-2021-30171
Published: 2021-05-07
Description: Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html; https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html
CVE: CVE-2021-30172
Published: 2021-05-07
Description: Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additionally access and manipulate customer’s information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4711-04469-1.html; https://www.twcert.org.tw/tw/cp-132-4711-04469-1.html
CVE: CVE-2021-30173
Published: 2021-05-07
Description: Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36
References: https://www.twcert.org.tw/tw/cp-132-4712-7ade4-1.html; https://www.twcert.org.tw/tw/cp-132-4712-7ade4-1.html
CVE: CVE-2020-36124
Published: 2021-05-07
Description: Pax Technology PAXSTORE v7.0.8_[PII_REDACTED]1508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access the platform as any desired user (clients and administrators).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/; https://marketing.paxtechnology.com/about-pax; https://www.whatspos.com/
CVE: CVE-2020-36125
Published: 2021-05-07
Description: Pax Technology PAXSTORE v7.0.8_[PII_REDACTED]1508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypassed remotely by an authenticated attacker through requesting the endpoint directly.
CVSS Score: 7.1 (HIGH)
CWE: CWE-306
References: https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/; https://marketing.paxtechnology.com/about-pax; https://www.whatspos.com/
CVE: CVE-2020-36126
Published: 2021-05-07
Description: Pax Technology PAXSTORE v7.0.8_[PII_REDACTED]1508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketplace endpoints allow an authenticated user to read and write data not owned by them, including third-party users, application and payment terminals, where an attacker can impersonate any user which may lead to the unauthorized disclosure, modification, or destruction of information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/; https://marketing.paxtechnology.com/about-pax; https://www.whatspos.com/
CVE: CVE-2020-36127
Published: 2021-05-07
Description: Pax Technology PAXSTORE v7.0.8_[PII_REDACTED]1508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an administrator will not have access to the current p12 certificate and password. When accessing this functionality, the administrator has the option to replace the current certificate and it is not possible to view the certificate password (p12) already deployed on the platform. The replacement p12 certificate returns to users in base64 with its password, which can be accessed by non-administrator users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/; https://marketing.paxtechnology.com/about-pax; https://www.whatspos.com/
CVE: CVE-2020-36128
Published: 2021-05-07
Description: Pax Technology PAXSTORE v7.0.8_[PII_REDACTED]1508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token (called X-Terminal-Token) to access the marketplace. This allows the store to identify the terminal and make available the applications distributed by its reseller. By intercepting HTTPS traffic from the application store, it is possible to collect the request responsible for assigning the X-Terminal-Token to the terminal, which makes it possible to craft an X-Terminal-Token pretending to be another device. An attacker can use this behavior to authenticate its own payment terminal in the application store through token impersonation.
CVSS Score: 8.2 (HIGH)
CWE: CWE-290
References: https://blog.pridesec.com.br/p/4c972078-5f01-419e-8bea-cf31ff2e3670/; https://marketing.paxtechnology.com/about-pax; https://www.whatspos.com/
CVE: CVE-2020-14009
Published: 2021-05-07
Description: Proofpoint Enterprise Protection (PPS/PoD) before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipart structures are not properly handled.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-354
References: https://www.proofpoint.com/us/security/security-advisories; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0006; https://www.proofpoint.com/us/security/security-advisories
CVE: CVE-2021-21984
Published: 2021-05-07
Description: VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://www.vmware.com/security/advisories/VMSA-2021-0007.html; https://www.vmware.com/security/advisories/VMSA-2021-0007.html
CVE: CVE-2021-26122
Published: 2021-05-07
Description: LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.dgc.org/responsible_disclosure_20210421_livinglogic_xss; https://www.xist4c.com; https://www.dgc.org/responsible_disclosure_20210421_livinglogic_xss
CVE: CVE-2021-26123
Published: 2021-05-07
Description: LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.dgc.org/responsible_disclosure_20210421_livinglogic_xss; https://www.xist4c.com; https://www.dgc.org/responsible_disclosure_20210421_livinglogic_xss
CVE: CVE-2021-3502
Published: 2021-05-07
Description: A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://bugzilla.redhat.com/show_bug.cgi?id=1946914; https://github.com/lathiat/avahi/issues/338; https://bugzilla.redhat.com/show_bug.cgi?id=1946914
CVE: CVE-2021-22675
Published: 2021-05-07
Description: The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attacker to remotely execute code on SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
CVSS Score: 7.2 (HIGH)
CWE: CWE-190
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01
CVE: CVE-2021-22679
Published: 2021-05-07
Description: The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01
CVE: CVE-2021-22671
Published: 2021-05-07
Description: Multiple integer overflow issues exist while processing long domain names, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01
CVE: CVE-2021-22673
Published: 2021-05-07
Description: The affected product is vulnerable to stack-based buffer overflow while processing over-the-air firmware updates from the CDN server, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
CVSS Score: 8.0 (HIGH)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01
CVE: CVE-2021-21419
Published: 2021-05-07
Description: Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WJFSBPLCNSZNHYQC4QDRDFRTEZRMD2L/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5JZP4LZOSP7CUAM3GIRW6PIAWKH5VGB/
CVE: CVE-2021-27437
Published: 2021-05-07
Description: The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM (versions prior to 9.0.1).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-124-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-124-01
CVE: CVE-2021-29488
Published: 2021-05-07
Description: SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround, limit downloads to NZBs without PAR2 files, deny write permissions to the SABnzbd process outside areas it must access to perform its job, or update to a fixed version.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-23
References: https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-jwj3-wrvf-v3rp; https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-jwj3-wrvf-v3rp
CVE: CVE-2021-32259
Published: 2021-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA
CVE: CVE-2020-4901
Published: 2021-05-07
Description: IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network to obtain sensitive information or cause a denial of service through username enumeration. IBM X-Force ID: 190992.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190992; https://www.ibm.com/support/pages/node/6450435; https://exchange.xforce.ibmcloud.com/vulnerabilities/190992
CVE: CVE-2021-22677
Published: 2021-05-07
Description: An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-service condition or code execution on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-119-01
CVE: CVE-2021-29495
Published: 2021-05-07
Description: Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyMode = CVerifyPeer" as documented.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://github.com/nim-lang/security/security/advisories/GHSA-9vqv-2jj9-7mqr; https://github.com/nim-lang/security/security/advisories/GHSA-9vqv-2jj9-7mqr