deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24181
Published: 2021-04-05
Description: The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/d5a00322-7098-4f8d-8e5e-157b63449c17; https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/; https://wpscan.com/vulnerability/d5a00322-7098-4f8d-8e5e-157b63449c17
CVE: CVE-2021-24182
Published: 2021-04-05
Description: The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/f74dfc52-46ba-41e3-994b-23115a22984f; https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/; https://wpscan.com/vulnerability/f74dfc52-46ba-41e3-994b-23115a22984f
CVE: CVE-2021-24183
Published: 2021-04-05
Description: The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/9b8da6b7-f1d6-4a7d-a621-4ca01e4b7496; https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/; https://wpscan.com/vulnerability/9b8da6b7-f1d6-4a7d-a621-4ca01e4b7496
CVE: CVE-2021-24184
Published: 2021-04-05
Description: Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://wpscan.com/vulnerability/5e85917c-7a58-49cb-b8b3-05aa18ffff3e; https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/; https://wpscan.com/vulnerability/5e85917c-7a58-49cb-b8b3-05aa18ffff3e
CVE: CVE-2021-24185
Published: 2021-04-05
Description: The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/0cba5349-e916-43f0-a1fe-62cf73e352a2; https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/; https://wpscan.com/vulnerability/0cba5349-e916-43f0-a1fe-62cf73e352a2
CVE: CVE-2021-24186
Published: 2021-04-05
Description: The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/5f5c0c6c-6f76-4366-b590-0aab557f8c60; https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/; https://wpscan.com/vulnerability/5f5c0c6c-6f76-4366-b590-0aab557f8c60
CVE: CVE-2021-24187
Published: 2021-04-05
Description: The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/c234700e-61dd-46a0-90fb-609e704269a9; https://wpscan.com/vulnerability/c234700e-61dd-46a0-90fb-609e704269a9
CVE: CVE-2021-24196
Published: 2021-04-05
Description: The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://purinechu.github.io/posts/social_slider_widget_reflected_xss/; https://wpscan.com/vulnerability/bb20d732-a5e4-4140-ab51-b2aa1a53db12; https://purinechu.github.io/posts/social_slider_widget_reflected_xss/
CVE: CVE-2021-24201
Published: 2021-04-05
Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/9647f516-b130-4cc8-85fb-2e69b034ced0; https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/; https://wpscan.com/vulnerability/9647f516-b130-4cc8-85fb-2e69b034ced0
CVE: CVE-2021-24202
Published: 2021-04-05
Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb; https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/; https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb
CVE: CVE-2021-24203
Published: 2021-04-05
Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/aa152ad0-5b3d-4d1f-88f4-6899a546e72e; https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/; https://wpscan.com/vulnerability/aa152ad0-5b3d-4d1f-88f4-6899a546e72e
CVE: CVE-2021-24204
Published: 2021-04-05
Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/772e172f-c8b4-4a6a-9eb9-9663295cfedf; https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/; https://wpscan.com/vulnerability/772e172f-c8b4-4a6a-9eb9-9663295cfedf
CVE: CVE-2021-24205
Published: 2021-04-05
Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/ef23df6d-e265-44f6-bb94-1005b16d34d9; https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/; https://wpscan.com/vulnerability/ef23df6d-e265-44f6-bb94-1005b16d34d9
CVE: CVE-2021-24206
Published: 2021-04-05
Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/2f66efd9-7d55-4f33-9109-3cb583a0c309; https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/; https://wpscan.com/vulnerability/2f66efd9-7d55-4f33-9109-3cb583a0c309
CVE: CVE-2021-24207
Published: 2021-04-05
Description: By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-269
References: https://wpscan.com/vulnerability/21e7a46f-e9a3-4b20-b44a-a5b6ce7b7ce6; https://www.themeum.com/wp-page-builder-updated-v1-2-4/; https://wpscan.com/vulnerability/21e7a46f-e9a3-4b20-b44a-a5b6ce7b7ce6
CVE: CVE-2021-24208
Published: 2021-04-05
Description: The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets (though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side validation but not server side validation), all of which are added via the “page_builder_data” parameter when performing the “wppb_page_save” AJAX action. It is also possible to insert malicious JavaScript via the “wppb_page_css” parameter (this can be done by closing out the style tag and opening a script tag) when performing the “wppb_page_save” AJAX action.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/c20e243d-b0de-4ae5-9a0d-b9d02c9b8141; https://www.themeum.com/wp-page-builder-updated-v1-2-4/; https://wpscan.com/vulnerability/c20e243d-b0de-4ae5-9a0d-b9d02c9b8141
CVE: CVE-2021-24209
Published: 2021-04-05
Description: The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset/2496238/wp-super-cache; https://wpscan.com/vulnerability/733d8a02-0d44-4b78-bbb2-37e447acd2f3; https://plugins.trac.wordpress.org/changeset/2496238/wp-super-cache
CVE: CVE-2021-24210
Published: 2021-04-05
Description: There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/) that says that the php involved in the request only go to whitelisted pages but it's possible to redirect the victim to any domain.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://plugins.trac.wordpress.org/changeset/2497610/; https://wpscan.com/vulnerability/9b3c5412-8699-49e8-b60c-20d2085857fb; https://plugins.trac.wordpress.org/changeset/2497610/
CVE: CVE-2021-24211
Published: 2021-04-05
Description: The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/37e0a033-3dee-476d-ae86-68354e8f0b1c; https://wpscan.com/vulnerability/37e0a033-3dee-476d-ae86-68354e8f0b1c
CVE: CVE-2021-24212
Published: 2021-04-05
Description: The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://dzv365zjfbd8v.cloudfront.net/changelogs/woocommerce-help-scout/changelog.txt; https://wpscan.com/vulnerability/cf9305e8-f5bc-45c3-82db-0ef00fd46129; http://dzv365zjfbd8v.cloudfront.net/changelogs/woocommerce-help-scout/changelog.txt
CVE: CVE-2020-19595
Published: 2021-04-05
Description: Buffer overflow vulnerability in Core FTP Server v2 Build 697, via a crafted username.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.0x90.zone/binary/reverse/exploitation/2020/08/16/CoreFTPServerRCE.html; https://www.0x90.zone/binary/reverse/exploitation/2020/08/16/CoreFTPServerRCE.html
CVE: CVE-2020-19596
Published: 2021-04-05
Description: Buffer overflow vulnerability in Core FTP Server v1.2 Build 583, via a crafted username.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.0x90.zone/binary/reverse/exploitation/2020/08/16/CoreFTPServerRCE.html; https://www.0x90.zone/binary/reverse/exploitation/2020/08/16/CoreFTPServerRCE.html
CVE: CVE-2020-17453
Published: 2021-04-05
Description: WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/JHHAX/CVE-2020-17453-PoC; https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1132/; https://twitter.com/JacksonHHax/status/[PII_REDACTED]78519813
CVE: CVE-2021-20305
Published: 2021-04-05
Description: A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-327, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1942533; https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/
CVE: CVE-2021-20307
Published: 2021-04-05
Description: Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134, CWE-134
References: https://bugzilla.redhat.com/show_bug.cgi?id=1946284; https://lists.debian.org/debian-lts-announce/2021/04/msg00010.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FVJRXUOBN56ZWP6QQ3NTA6DIFZMDZAEQ/
CVE: CVE-2021-20308
Published: 2021-04-05
Description: Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1946289; https://github.com/michaelrsweet/htmldoc/issues/423; https://lists.debian.org/debian-lts-announce/2021/07/msg00000.html
CVE: CVE-2021-30141
Published: 2021-04-05
Description: Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an attempted access to an array offset on a value of type null, and excessive memory consumption. NOTE: the vendor states "the feature still requires a valid authentication cookie even if the route is accessible to non-logged users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/friendica/friendica/issues/10110; https://github.com/friendica/friendica/pull/10113/commits/acbcc56754121ba080eac5b6fdf69e64ed7fe453; https://github.com/friendica/friendica/issues/10110
CVE: CVE-2021-28175
Published: 2021-04-06
Description: The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4543-98220-1.html
CVE: CVE-2021-28176
Published: 2021-04-06
Description: The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4544-0a409-1.html
CVE: CVE-2021-28177
Published: 2021-04-06
Description: The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4547-88e43-1.html
CVE: CVE-2021-28178
Published: 2021-04-06
Description: The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4548-7a2c6-1.html
CVE: CVE-2021-28179
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4549-c97ba-1.html
CVE: CVE-2021-28180
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4550-5ee8c-1.html
CVE: CVE-2021-28181
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4551-5dd2f-1.html
CVE: CVE-2021-28182
Published: 2021-04-06
Description: The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4552-5b2c4-1.html
CVE: CVE-2021-28183
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (Web License configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4553-06ae2-1.html
CVE: CVE-2021-28184
Published: 2021-04-06
Description: The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4554-10a74-1.html
CVE: CVE-2021-28185
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4555-3c7c3-1.html
CVE: CVE-2021-28186
Published: 2021-04-06
Description: The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asus.com/content/ASUS-Product-Security-Advisory/; https://www.asus.com/tw/support/callus/; https://www.twcert.org.tw/tw/cp-132-4556-ece3d-1.html