deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41130
Published: 2021-10-07
Description: Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-API-UserInfo", the application can use it to do authorization. But if there are two "X-Endpoint-API-UserInfo" headers from the client, ESPv1 only replaces the first one, the 2nd one will be passed to the application. An attacker can send two "X-Endpoint-API-UserInfo" headers, the second one with a fake JWT claim. Application may use the fake JWT claim to do the authorization. This impacts following ESPv1 usages: 1) Users have configured ESPv1 to do JWT authentication with Google ID Token as described in the referenced google endpoint document. 2) Users backend application is using the info in the "X-Endpoint-API-UserInfo" header to do the authorization. It has been fixed by v1.58.0. You need to patch it in the following ways: * If your docker image is using tag ":1", needs to re-start the container to pick up the new version. The tag ":1" will automatically point to the latest version. * If your docker image tag pings to a specific minor version, e.g. ":1.57". You need to update it to ":1.58" and re-start the container. There are no workaround for this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://cloud.google.com/endpoints/docs/openapi/authenticating-users-google-id; https://github.com/cloudendpoints/esp/commit/e310c4f91d229a072507f80c73811489b4cdff27; https://github.com/cloudendpoints/esp/releases/tag/v1.58.0
CVE: CVE-2021-42092
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://zammad.com/en/advisories/zaa-2021-16; https://zammad.com/en/advisories/zaa-2021-16
CVE: CVE-2021-42093
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers.
CVSS Score: 7.2 (HIGH)
References: https://zammad.com/en/advisories/zaa-2021-10; https://zammad.com/en/advisories/zaa-2021-10
CVE: CVE-2021-42094
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://zammad.com/en/advisories/zaa-2021-18; https://zammad.com/en/advisories/zaa-2021-18
CVE: CVE-2020-21865
Published: 2021-10-07
Description: ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/nnngu/ThinkPHP50-CMS/issues/1; https://github.com/nnngu/ThinkPHP50-CMS/issues/1
CVE: CVE-2021-42084
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://zammad.com/en/advisories/zaa-2021-11; https://zammad.com/en/advisories/zaa-2021-11
CVE: CVE-2021-42085
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://zammad.com/en/advisories/zaa-2021-17; https://zammad.com/en/advisories/zaa-2021-17
CVE: CVE-2021-42086
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request.
CVSS Score: 8.8 (HIGH)
References: https://zammad.com/en/advisories/zaa-2021-09; https://zammad.com/en/advisories/zaa-2021-09
CVE: CVE-2021-42087
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API.
CVSS Score: 4.9 (MEDIUM)
References: https://zammad.com/en/advisories/zaa-2021-15; https://zammad.com/en/advisories/zaa-2021-15
CVE: CVE-2021-42088
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://zammad.com/en/advisories/zaa-2021-12; https://zammad.com/en/advisories/zaa-2021-12
CVE: CVE-2021-42089
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://zammad.com/en/advisories/zaa-2021-13; https://zammad.com/en/advisories/zaa-2021-13
CVE: CVE-2021-42090
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://zammad.com/en/advisories/zaa-2021-14; https://zammad.com/en/advisories/zaa-2021-14
CVE: CVE-2021-42091
Published: 2021-10-07
Description: An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://zammad.com/en/advisories/zaa-2021-08; https://zammad.com/en/advisories/zaa-2021-08
CVE: CVE-2021-42095
Published: 2021-10-07
Description: Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar.
CVSS Score: 7.5 (HIGH)
References: https://www.netsarang.com/en/xshell-update-history/; https://www.netsarang.com/en/xshell-update-history/
CVE: CVE-2020-21725
Published: 2021-10-07
Description: OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the pid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/CoColizdf/CVE/issues/1; https://github.com/CoColizdf/CVE/issues/1
CVE: CVE-2020-21726
Published: 2021-10-07
Description: OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the cid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/CoColizdf/CVE/issues/2; https://github.com/CoColizdf/CVE/issues/2
CVE: CVE-2020-21729
Published: 2021-10-07
Description: JEECMS x1.1 contains a stored cross-site scripting (XSS) vulnerability in the component of /member-vipcenter.htm, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/CoColizdf/CVE/issues/3; https://github.com/CoColizdf/CVE/issues/3
CVE: CVE-2021-38298
Published: 2021-10-07
Description: Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://www.manageengine.com/products/ad-manager/release-notes.html#7110; https://www.manageengine.com/products/ad-manager/release-notes.html#7110
CVE: CVE-2021-41115
Published: 2021-10-07
Description: Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks; most simply, by configuring a quadratic-time regular expression in a linkifier, and sending messages that exploited it. A regular expression attempted to parse the user-provided regexes to verify that they were safe from ReDoS -- this was both insufficient, as well as _itself_ subject to ReDoS if the organization administrator entered a sufficiently complex invalid regex. Affected users should [upgrade to the just-released Zulip 4.7](https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-to-a-release), or [`main`](https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-from-a-git-repository).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-1333, CWE-1333
References: https://github.com/zulip/zulip/commit/e2d303c1bb5f538d17dc3d9134bc8858bdece781; https://github.com/zulip/zulip/security/advisories/GHSA-4h36-mqfq-42jg; https://securitylab.github.com/advisories/GHSL-2021-118-zulip-zulip/
CVE: CVE-2021-25270
Published: 2021-10-08
Description: A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901.
CVSS Score: 6.7 (MEDIUM)
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20211007-hmpa-lpe; https://www.sophos.com/en-us/security-advisories/sophos-sa-20211007-hmpa-lpe
CVE: CVE-2021-25271
Published: 2021-10-08
Description: A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318.
CVSS Score: 6.0 (MEDIUM)
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20211007-hmp-lpe; https://www.sophos.com/en-us/security-advisories/sophos-sa-20211007-hmp-lpe
CVE: CVE-2021-33603
Published: 2021-10-08
Description: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
CVSS Score: 5.5 (MEDIUM)
References: https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame; https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-33603; https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
CVE: CVE-2021-40832
Published: 2021-10-08
Description: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVRDL unpacking module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the Anti-Virus engine.
CVSS Score: 5.5 (MEDIUM)
References: https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame; https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-40832; https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
CVE: CVE-2021-41947
Published: 2021-10-08
Description: A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/intelliants/subrion/issues/887; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41947; https://github.com/intelliants/subrion/issues/887
CVE: CVE-2021-41133
Published: 2021-10-08
Description: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2021/10/26/9; https://github.com/flatpak/flatpak/commit/1330662f33a55e88bfe18e76de28b7922d91a999; https://github.com/flatpak/flatpak/commit/26b12484eb8a6219b9e7aa287b298a894b2f34ca
CVE: CVE-2021-35977
Published: 2021-10-08
Description: An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP discovery response messages. This could result in arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt; https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt
CVE: CVE-2021-35979
Published: 2021-10-08
Description: An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not perform authentication.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt; https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt
CVE: CVE-2021-36767
Published: 2021-10-08
Description: In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-916
References: https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt; https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-02.txt
CVE: CVE-2021-3312
Published: 2021-10-08
Description: An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/alkacon/opencms-core/issues/725; https://github.com/alkacon/opencms-core/releases; https://github.com/alkacon/opencms-core/issues/725
CVE: CVE-2021-41563
Published: 2021-10-08
Description: Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-5167-2defb-1.html; https://www.twcert.org.tw/tw/cp-132-5167-2defb-1.html
CVE: CVE-2021-41564
Published: 2021-10-08
Description: Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://www.twcert.org.tw/tw/cp-132-5168-52304-1.html; https://www.twcert.org.tw/tw/cp-132-5168-52304-1.html
CVE: CVE-2021-41565
Published: 2021-10-08
Description: TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-5169-327ef-1.html; https://www.twcert.org.tw/tw/cp-132-5169-327ef-1.html
CVE: CVE-2021-41566
Published: 2021-10-08
Description: The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.twcert.org.tw/tw/cp-132-5170-83472-1.html; https://www.twcert.org.tw/tw/cp-132-5170-83472-1.html
CVE: CVE-2021-41567
Published: 2021-10-08
Description: The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-5171-64439-1.html; https://www.twcert.org.tw/tw/cp-132-5171-64439-1.html
CVE: CVE-2021-41568
Published: 2021-10-08
Description: Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-306
References: https://www.twcert.org.tw/tw/cp-132-5172-b012c-1.html; https://www.twcert.org.tw/tw/cp-132-5172-b012c-1.html
CVE: CVE-2021-41825
Published: 2021-10-08
Description: Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://0xy37.medium.com/my-first-cve-cve-2021-41825-verint-workforce-optimization-html-injection-6dd450e7f2af; https://www.verint.com/engagement/our-offerings/solutions/workforce-optimization/; https://0xy37.medium.com/my-first-cve-cve-2021-41825-verint-workforce-optimization-html-injection-6dd450e7f2af
CVE: CVE-2021-41916
Published: 2021-10-08
Description: A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an authenticated admin user to visit an attacker's web page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/; https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/
CVE: CVE-2021-41917
Published: 2021-10-08
Description: webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in the clients section, due to incorrect sanitization of user-supplied data and achieve a Stored Cross-Site Scripting attack against the platform users and administrators. The affected endpoint is /clients/editclient.php, on the HTTP POST cn parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/; https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/
CVE: CVE-2021-41918
Published: 2021-10-08
Description: webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the application because it is related on how each URL is echoed back on every response page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/; https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/
CVE: CVE-2021-41919
Published: 2021-10-08
Description: webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This is working by adding or replacing a personal profile picture. The affected endpoint is /includes/upload.php on the HTTP POST data. This allows an attacker to exploit the platform by injecting code or malware and, under certain conditions, to execute code on remote user browsers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/; https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/
CVE: CVE-2021-41920
Published: 2021-10-08
Description: webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sor_cible, sor_champs, and sor_ordre HTTP POST parameters. This allows an attacker to access all the data in the database and obtain access to the webTareas application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/; https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/
CVE: CVE-2021-41974
Published: 2021-10-08
Description: Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285, CWE-306
References: https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.html; https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.html
CVE: CVE-2021-41975
Published: 2021-10-08
Description: TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285, CWE-306
References: https://www.twcert.org.tw/tw/cp-132-5174-6f1d5-1.html; https://www.twcert.org.tw/tw/cp-132-5174-6f1d5-1.html
CVE: CVE-2021-41976
Published: 2021-10-08
Description: Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book list without logging in.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-306
References: https://www.twcert.org.tw/tw/cp-132-5175-a2f8d-1.html; https://www.twcert.org.tw/tw/cp-132-5175-a2f8d-1.html
CVE: CVE-2021-20600
Published: 2021-10-08
Description: Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions "16" and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending a large number of packets in a short time while the module starting up. System reset is required for recovery.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: https://jvn.jp/vu/JVNVU94914666/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-21-280-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-015_en.pdf
CVE: CVE-2021-32029
Published: 2021-10-08
Description: A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1956883; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.postgresql.org/support/security/CVE-2021-32029/
CVE: CVE-2021-41802
Published: 2021-10-08
Description: HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.
CVSS Score: 2.9 (LOW)
CWE: CWE-732
References: https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-privilege-escalation/; https://security.gentoo.org/glsa/202207-01; https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-privilege-escalation/
CVE: CVE-2020-4654
Published: 2021-10-08
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information due to improper permission control. IBM X-Force ID: 186090.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186090; https://www.ibm.com/support/pages/node/6497245; https://exchange.xforce.ibmcloud.com/vulnerabilities/186090