deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27396
Published: 2021-05-12
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow, a different vulnerability than CVE-2021-27398. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13279)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-568/; https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf
CVE: CVE-2021-27397
Published: 2021-05-12
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13287)
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-569/; https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf
CVE: CVE-2021-27398
Published: 2021-05-12
Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow, a different vulnerability than CVE-2021-27396. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13290)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-570/; https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf
CVE: CVE-2021-31339
Published: 2021-05-12
Description: A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://cert-portal.siemens.com/productcert/pdf/ssa-854248.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-09; https://cert-portal.siemens.com/productcert/pdf/ssa-854248.pdf
CVE: CVE-2021-31341
Published: 2021-05-12
Description: Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://cert-portal.siemens.com/productcert/pdf/ssa-919955.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-05; https://cert-portal.siemens.com/productcert/pdf/ssa-919955.pdf
CVE: CVE-2020-27840
Published: 2021-05-12
Description: A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1941400; https://lists.debian.org/debian-lts-announce/2021/03/msg00036.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLZ74IF2N75VQSIHBL4B3P5WKWQCXSRY/
CVE: CVE-2021-20202
Published: 2021-05-12
Description: A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Score: 7.3 (HIGH)
CWE: CWE-377
References: https://bugzilla.redhat.com/show_bug.cgi?id=1922128; https://bugzilla.redhat.com/show_bug.cgi?id=1922128
CVE: CVE-2021-28649
Published: 2021-05-12
Description: An incorrect permission vulnerability in the product installer for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate privileges by placing arbitrary code on a specified folder and have that code be executed by an Administrator who is running a scan. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10310; https://www.zerodayinitiative.com/advisories/ZDI-21-474/; https://helpcenter.trendmicro.com/en-us/article/TMKA-10310
CVE: CVE-2021-31519
Published: 2021-05-12
Description: An incorrect permission vulnerability in the product installer folders for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate privileges by placing arbitrary code on a specified folder and have that code be executed by an Administrator who is running a scan. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10310; https://www.zerodayinitiative.com/advisories/ZDI-21-475/; https://helpcenter.trendmicro.com/en-us/article/TMKA-10310
CVE: CVE-2021-32607
Published: 2021-05-12
Description: An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/PrivateMessages/View.cshtml does not call HtmlUtils.SanitizeHtml on a private message.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.sonarsource.com/smartstorenet-malicious-message-leading-to-e-commerce-takeover/; https://github.com/smartstore/SmartStoreNET/commit/5b4e60ae7124df0898975cb8f994f9f23db1fae3; https://blog.sonarsource.com/smartstorenet-malicious-message-leading-to-e-commerce-takeover/
CVE: CVE-2021-32608
Published: 2021-05-12
Description: An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/Boards/Partials/_ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum post.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.sonarsource.com/smartstorenet-malicious-message-leading-to-e-commerce-takeover/; https://github.com/smartstore/SmartStoreNET/commit/ae03d45e23734555a2aef0b0c3d33c21e076c20f; https://blog.sonarsource.com/smartstorenet-malicious-message-leading-to-e-commerce-takeover/
CVE: CVE-2021-3457
Published: 2021-05-12
Description: An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=1940990; https://bugzilla.redhat.com/show_bug.cgi?id=1940990
CVE: CVE-2020-23790
Published: 2021-05-12
Description: An Arbitrary File Upload vulnerability was discovered in the Golo Laravel theme v 1.1.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://codecanyon.net/item/golo-city-guide-laravel-theme/25785389; https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-07-02-golo-business-listing-city-travel-guide-laravel-theme-v1-1-5.txt; https://codecanyon.net/item/golo-city-guide-laravel-theme/25785389
CVE: CVE-2021-32572
Published: 2021-05-12
Description: Speco Web Viewer through 2021-05-12 allows Directory Traversal via GET request for a URI with /.. at the beginning, as demonstrated by reading the /etc/passwd file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.jamescarroll.me/blog/specoweb-directory-traversal; https://www.specotech.com; https://www.jamescarroll.me/blog/specoweb-directory-traversal
CVE: CVE-2021-32611
Published: 2021-05-12
Description: A NULL pointer dereference vulnerability exists in eXcall_api.c in Antisip eXosip2 through 5.2.0 when handling certain 3xx redirect responses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://git.savannah.nongnu.org/cgit/exosip.git/commit/?id=f2ed389fe84613512cc560127883e51e6cf8c054; http://git.savannah.nongnu.org/cgit/exosip.git/commit/?id=f2ed389fe84613512cc560127883e51e6cf8c054
CVE: CVE-2020-19274
Published: 2021-05-12
Description: A Cross SIte Scripting (XSS) vulnerability exists in Dhcms 2017-09-18 in guestbook via the message board, which could let a remote malicious user execute arbitrary code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ShaoGongBra/dhcms/issues/3; https://github.com/ShaoGongBra/dhcms/issues/3
CVE: CVE-2021-30211
Published: 2021-05-12
Description: Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/Stored-XSS-KnowageSuite7-3-surname.md; https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/Stored-XSS-KnowageSuite7-3-surname.md
CVE: CVE-2021-30212
Published: 2021-05-12
Description: Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/Stored-XSS-KnowageSuite7-3-notes.md; https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/Stored-XSS-KnowageSuite7-3-notes.md
CVE: CVE-2021-30213
Published: 2021-05-12
Description: Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/XSS-KnowageSuite7-3_unauth.md; https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/XSS-KnowageSuite7-3_unauth.md
CVE: CVE-2021-30214
Published: 2021-05-12
Description: Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/CSTI-KnowageSuite7-3.md; https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/CSTI-KnowageSuite7-3.md
CVE: CVE-2020-18165
Published: 2021-05-12
Description: Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu".
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cumtyuanfeng/Laobancms/blob/master/vuln.md; https://github.com/Cumtyuanfeng/Laobancms/blob/master/vuln.md
CVE: CVE-2020-19275
Published: 2021-05-12
Description: An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will leak the physical path.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://cwe.mitre.org/data/definitions/209.html; https://github.com/ShaoGongBra/dhcms/issues/4; https://cwe.mitre.org/data/definitions/209.html
CVE: CVE-2021-29511
Published: 2021-05-12
Description: evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the `evm` crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`. There are no workarounds. Please upgrade your `evm` crate version.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-787
References: https://crates.io/crates/evm; https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd; https://github.com/rust-blockchain/evm/security/advisories/GHSA-4jwq-572w-4388
CVE: CVE-2020-28722
Published: 2021-05-12
Description: Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting (XSS) vulnerability that can lead to an account takeover via custom email templates.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.r29k.com/articles/bb/stored-xss-in-deskpro; https://www.r29k.com/articles/bb/stored-xss-in-deskpro
CVE: CVE-2021-23134
Published: 2021-05-12
Description: Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=c61760e6940d; https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html; https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
CVE: CVE-2021-23135
Published: 2021-05-12
Description: Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-497, CWE-209
References: https://github.com/argoproj/argo-cd/security/advisories/GHSA-fp89-h8pj-8894; https://github.com/argoproj/argo-cd/security/advisories/GHSA-fp89-h8pj-8894
CVE: CVE-2021-22155
Published: 2021-05-13
Description: An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to potentially gain access to the application in the context of the targeted user’s account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://support.blackberry.com/kb/articleDetail?articleNumber=000078926; https://support.blackberry.com/kb/articleDetail?articleNumber=000078926
CVE: CVE-2020-36197
Published: 2021-05-13
Description: An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.3.16 on QTS 4.5.2; versions prior to 5.2.10 on QTS 4.3.6; versions prior to 5.1.14 on QTS 4.3.3; versions prior to 5.3.16 on QuTS hero h4.5.2; versions prior to 5.3.16 on QuTScloud c4.5.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284, CWE-22
References: http://packetstormsecurity.com/files/162849/QNAP-MusicStation-MalwareRemover-File-Upload-Command-Injection.html; https://www.qnap.com/zh-tw/security-advisory/qsa-21-08; https://www.zerodayinitiative.com/advisories/ZDI-21-591/
CVE: CVE-2020-36198
Published: 2021-05-13
Description: A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect: QNAP Systems Inc. Malware Remover 3.x.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: http://packetstormsecurity.com/files/162849/QNAP-MusicStation-MalwareRemover-File-Upload-Command-Injection.html; https://www.qnap.com/zh-tw/security-advisory/qsa-21-16; https://www.zerodayinitiative.com/advisories/ZDI-21-592/
CVE: CVE-2021-28799
Published: 2021-05-13
Description: An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-285
References: https://www.qnap.com/en/security-advisory/QSA-21-13; https://www.qnap.com/en/security-advisory/QSA-21-13; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28799
CVE: CVE-2021-31215
Published: 2021-05-13
Description: SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.
CVSS Score: 8.8 (HIGH)
References: https://lists.debian.org/debian-lts-announce/2022/01/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ODMJQNY4FAV7G3DSKVIO5KY7Q7DKBPU/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRHTASFAU5FNB2MJOG67YID2ONQS5MCQ/
CVE: CVE-2021-20331
Published: 2021-05-13
Description: Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://jira.mongodb.org/browse/CSHARP-3521; https://jira.mongodb.org/browse/CSHARP-3521
CVE: CVE-2021-22152
Published: 2021-05-13
Description: A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially to prevent any new user connections.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.blackberry.com/kb/articleDetail?articleNumber=000078971; https://support.blackberry.com/kb/articleDetail?articleNumber=000078971
CVE: CVE-2021-22153
Published: 2021-05-13
Description: A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with the authority of the user.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1236
References: https://support.blackberry.com/kb/articleDetail?articleNumber=000078971; https://support.blackberry.com/kb/articleDetail?articleNumber=000078971
CVE: CVE-2021-22154
Published: 2021-05-13
Description: An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially gain access to a victim's web history.
CVSS Score: 5.3 (MEDIUM)
References: https://support.blackberry.com/kb/articleDetail?articleNumber=000078971; https://support.blackberry.com/kb/articleDetail?articleNumber=000078971
CVE: CVE-2020-12967
Published: 2021-05-13
Description: The lack of nested page table protection in the AMD SEV/SEV-ES feature could potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004
CVE: CVE-2021-26311
Published: 2021-05-13
Description: In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004
CVE: CVE-2021-25694
Published: 2021-05-13
Description: Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. An attacker could replace the .dll and redirect pixels elsewhere.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://advisory.teradici.com/security-advisories/80/; https://advisory.teradici.com/security-advisories/80/
CVE: CVE-2020-12526
Published: 2021-05-13
Description: TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically crafted requests to the running OPC UA server. After some of these requests the OPC UA server is no longer responsive to any client. This is without effect to the real-time functionality of IPCs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://cert.vde.com/en-us/advisories/vde-2020-051; https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2021-001.pdf; https://cert.vde.com/en-us/advisories/vde-2020-051
CVE: CVE-2020-14354
Published: 2021-05-13
Description: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-120, CWE-415, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1866838; https://c-ares.haxx.se/changelog.html; https://github.com/c-ares/c-ares/commit/1cc7e83c3bdfaafbc5919c95025592d8de3a170e
CVE: CVE-2020-27824
Published: 2021-05-13
Description: A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1905723; https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/
CVE: CVE-2021-20250
Published: 2021-05-13
Description: A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1929479; https://bugzilla.redhat.com/show_bug.cgi?id=1929479