deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-25738
Published: 2021-10-11
Description: Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-502
References: http://www.openwall.com/lists/oss-security/2022/08/23/2; https://github.com/kubernetes-client/java/issues/1698; https://groups.google.com/g/kubernetes-security-announce/c/K_pOK2WbAJk
CVE: CVE-2021-40188
Published: 2021-10-11
Description: PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as ".php, .php7, .phtml, .php5, ...". An attacker can upload a malicious file and execute code on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/PHPFusion/PHPFusion/issues/2372; https://github.com/PHPFusion/PHPFusion/issues/2372
CVE: CVE-2021-40189
Published: 2021-10-11
Description: PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an attacker can access and execute arbitrary code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/PHPFusion/PHPFusion/issues/2374; https://github.com/PHPFusion/PHPFusion/issues/2374
CVE: CVE-2021-40239
Published: 2021-10-11
Description: A Buffer Overflow vulnerability exists in the latest version of Miniftpd in the do_retr function in ftpproto.c
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Gabe-commiter/Miniftpd/issues/2; https://github.com/Gabe-commiter/Miniftpd/issues/2
CVE: CVE-2021-40617
Published: 2021-10-11
Description: An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2021-40617.md; https://github.com/OS4ED/openSIS-Classic/issues/192; https://github.com/OS4ED/openSIS-Classic/issues/192
CVE: CVE-2021-42252
Published: 2021-10-11
Description: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.
CVSS Score: 7.8 (HIGH)
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-42257
Published: 2021-10-11
Description: check_smart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device path (the /dev/bus substring and a number), aka an unanchored regular expression.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2021/10/14/2; https://bugzilla.suse.com/show_bug.cgi?id=1183057; https://nvd.nist.gov/vuln/detail/CVE-2021-42257
CVE: CVE-2021-42260
Published: 2021-10-11
Description: TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://lists.debian.org/debian-lts-announce/2022/04/msg00019.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00041.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/
CVE: CVE-2021-23448
Published: 2021-10-11
Description: All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321
References: https://github.com/jarradseers/config-handler/issues/1; https://snyk.io/vuln/SNYK-JS-CONFIGHANDLER-1564947; https://github.com/jarradseers/config-handler/issues/1
CVE: CVE-2021-42009
Published: 2021-10-12
Description: An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.openwall.com/lists/oss-security/2021/10/12/1; https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c31da2c97422febb%40%3Cdev.trafficcontrol.apache.org%3E; https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6cfa059d3f349d87%40%3Cannounce.apache.org%3E
CVE: CVE-2021-27395
Published: 2021-10-12
Description: A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf
CVE: CVE-2021-33722
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33723
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33724
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system contains an Arbitrary File Deletion vulnerability that possibly allows to delete an arbitrary file or directory under a user controlled path.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33725
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to delete arbitrary files or directories under a user controlled path and does not correctly check if the relative path is still within the intended target directory.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33726
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to download arbitrary files under a user controlled path and does not correctly check if the relative path is still within the intended target directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33727
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33728
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary code on the device with root privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33729
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker that is able to import firmware containers to an affected system could execute arbitrary commands in the local database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33730
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33731
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33732
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33733
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33734
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33735
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-33736
Published: 2021-10-12
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf
CVE: CVE-2021-37199
Published: 2021-10-12
Description: A vulnerability has been identified in SINUMERIK 808D (All versions), SINUMERIK 828D (All versions < V4.95). Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-178380.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-178380.pdf
CVE: CVE-2021-41546
Published: 2021-10-12
Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). Affected devices write crashdumps without checking if enough space is available on the filesystem. Once the crashdump fills the entire root filesystem, affected devices fail to boot successfully. An attacker can leverage this vulnerability to cause a permanent Denial-of-Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://cert-portal.siemens.com/productcert/pdf/ssa-173565.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-173565.pdf
CVE: CVE-2020-28145
Published: 2021-10-12
Description: Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://github.com/wuzhicms/wuzhicms/issues/191; https://www.cnvd.org.cn/flaw/show/2394661; https://github.com/wuzhicms/wuzhicms/issues/191
CVE: CVE-2021-21940
Published: 2021-10-12
Description: A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted network packet can lead to a heap buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1369; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1369
CVE: CVE-2021-21941
Published: 2021-10-12
Description: A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to remote code execution.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-368, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1370; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1370
CVE: CVE-2021-25634
Published: 2021-10-12
Description: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.debian.org/security/2021/dsa-4988; https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634; https://www.debian.org/security/2021/dsa-4988
CVE: CVE-2021-38452
Published: 2021-10-12
Description: A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03
CVE: CVE-2021-38454
Published: 2021-10-12
Description: A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-284, CWE-22
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03
CVE: CVE-2021-38456
Published: 2021-10-12
Description: A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through accounts using default passwords
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03
CVE: CVE-2021-38458
Published: 2021-10-12
Description: A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03
CVE: CVE-2021-38460
Published: 2021-10-12
Description: A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
CVSS Score: 7.5 (HIGH)
CWE: CWE-523, CWE-22
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03
CVE: CVE-2021-37726
Published: 2021-10-12
Description: A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf
CVE: CVE-2021-37727
Published: 2021-10-12
Description: A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf
CVE: CVE-2021-37730
Published: 2021-10-12
Description: A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf
CVE: CVE-2021-38178
Published: 2021-10-12
Description: The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data.
CVSS Score: 8.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3097887; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3097887
CVE: CVE-2021-38179
Published: 2021-10-12
Description: Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include User credentials.
CVSS Score: 4.9 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3074819; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3074819
CVE: CVE-2021-38180
Published: 2021-10-12
Description: SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://launchpad.support.sap.com/#/notes/3079427; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3079427
CVE: CVE-2021-38181
Published: 2021-10-12
Description: SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVSS Score: 7.5 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3080710; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3080710
CVE: CVE-2021-38183
Published: 2021-10-12
Description: SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in Cross-Site Scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3084937; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3084937
CVE: CVE-2021-40495
Published: 2021-10-12
Description: There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755. An unauthorized attacker can use the public SICF service /sap/public/bc/abap to reduce the performance of SAP NetWeaver Application Server ABAP and ABAP Platform.
CVSS Score: 5.3 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3099011; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3099011