deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-13938
Published: 2021-06-10
Description: Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2021/06/10/3; https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE: CVE-2020-13950
Published: 2021-06-10
Description: Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2021/06/10/4; https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E
CVE: CVE-2020-35452
Published: 2021-06-10
Description: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2021/06/10/5; https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E
CVE: CVE-2021-26690
Published: 2021-06-10
Description: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2021/06/10/6; https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E
CVE: CVE-2021-26691
Published: 2021-06-10
Description: In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2021/06/10/7; https://lists.apache.org/thread.html/r50cae1b71f1e[PII_REDACTED]b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E
CVE: CVE-2021-30641
Published: 2021-06-10
Description: Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
CVSS Score: 5.3 (MEDIUM)
References: http://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2021/06/10/8; https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd[PII_REDACTED]7e02f434cb10%40%3Cannounce.httpd.apache.org%3E
CVE: CVE-2021-34363
Published: 2021-06-10
Description: The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092; https://github.com/nvbn/thefuck/releases/tag/3.31; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4MEDDLBFVRUQHPYIBJ4MFM3M4NUJUXL5/
CVE: CVE-2021-34539
Published: 2021-06-10
Description: An issue was discovered in CubeCoders AMP before 2.1.1.8. A lack of validation of the Java Version setting means that an unintended executable path can be set. The result is that high-privileged users can trigger code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-668
References: https://github.com/CubeCoders/AMP/issues/464; https://github.com/CubeCoders/AMP/issues/464
CVE: CVE-2019-25046
Published: 2021-06-10
Description: The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cerberusftp.com/products/releasenotes/; https://www.cerberusftp.com/xss-vulnerability-when-previewing-svg-content/; https://www.cerberusftp.com/products/releasenotes/
CVE: CVE-2021-20081
Published: 2021-06-10
Description: Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges.
CVSS Score: 7.2 (HIGH)
References: https://www.tenable.com/security/research/tra-2021-22; https://www.tenable.com/security/research/tra-2021-22
CVE: CVE-2021-20293
Published: 2021-06-10
Description: A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1942819; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1942819
CVE: CVE-2021-21735
Published: 2021-06-10
Description: A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924
CVE: CVE-2021-21736
Published: 2021-06-10
Description: A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E
CVSS Score: 7.2 (HIGH)
CWE: CWE-276
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015964; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015964
CVE: CVE-2021-25322
Published: 2021-06-10
Description: A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior versions. openSUSE Factory python-HyperKitty versions prior to 1.3.4-5.1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-61
References: https://bugzilla.suse.com/show_bug.cgi?id=1182373; https://bugzilla.suse.com/show_bug.cgi?id=1182373
CVE: CVE-2021-25948
Published: 2021-06-10
Description: Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/doowb/expand-hash/blob/556913f6c2f05848110b5b8261cfc78e5ce3dc77/index.js#L19; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25948; https://github.com/doowb/expand-hash/blob/556913f6c2f05848110b5b8261cfc78e5ce3dc77/index.js#L19
CVE: CVE-2021-25949
Published: 2021-06-10
Description: Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/doowb/set-getter/blob/5bc2750fe1c3db9651d936131be[PII_REDACTED]8d/index.js#L56; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25949; https://github.com/doowb/set-getter/blob/5bc2750fe1c3db9651d936131be[PII_REDACTED]8d/index.js#L56
CVE: CVE-2021-31997
Published: 2021-06-10
Description: A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin to root. This issue affects: openSUSE Leap 15.2 python-postorius version 1.3.2-lp152.1.2 and prior versions. openSUSE Factory python-postorius version 1.3.4-2.1 and prior versions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=1182407; https://bugzilla.suse.com/show_bug.cgi?id=1182407
CVE: CVE-2021-31998
Published: 2021-06-10
Description: A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-276
References: https://bugzilla.suse.com/show_bug.cgi?id=1182321; https://bugzilla.suse.com/show_bug.cgi?id=1182321
CVE: CVE-2021-3039
Published: 2021-06-10
Description: An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role of the authenticated user is logged to a debug log file. Authenticated Operator role and Auditor role users with access to the debug log files can use this secret to gain Administrator role access for their active session in Prisma Cloud Compute. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. This issue impacts all Prisma Cloud Compute versions earlier than Prisma Cloud Compute 21.04.412.
CVSS Score: 3.8 (LOW)
CWE: CWE-532, CWE-532
References: https://security.paloaltonetworks.com/CVE-2021-3039; https://security.paloaltonetworks.com/CVE-2021-3039
CVE: CVE-2021-3040
Published: 2021-06-10
Description: An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impacted.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://security.paloaltonetworks.com/CVE-2021-3040; https://security.paloaltonetworks.com/CVE-2021-3040
CVE: CVE-2021-3041
Published: 2021-06-10
Description: A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory or to manipulate key registry values. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.11; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.8; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.3; All versions of Cortex XDR agent 7.2 without content update release 171 or a later version.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://security.paloaltonetworks.com/CVE-2021-3041; https://security.paloaltonetworks.com/CVE-2021-3041
CVE: CVE-2021-31929
Published: 2021-06-10
Description: Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as fraud prevention, coupon groups, email templates, or referrals.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://www.annexcloud.com/; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-24662
Published: 2021-06-10
Description: SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) <3.1.0 allows XSS. This was fixed in TLM RP 3.1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://www.accenture.com; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2021-21661
Published: 2021-06-10
Description: Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/06/10/14; https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-2370; http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE: CVE-2021-21662
Published: 2021-06-10
Description: A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/06/10/14; https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-1981; http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE: CVE-2021-21663
Published: 2021-06-10
Description: A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/06/10/14; https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-1982; http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE: CVE-2021-21664
Published: 2021-06-10
Description: An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2021/06/10/14; https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-1982; http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE: CVE-2021-21665
Published: 2021-06-10
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2021/06/10/14; https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-1982; http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE: CVE-2021-21666
Published: 2021-06-10
Description: Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2021/06/10/14; https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-2367; http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE: CVE-2021-23023
Published: 2021-06-10
Description: On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://support.f5.com/csp/article/K33757590; https://support.f5.com/csp/article/K33757590
CVE: CVE-2021-23024
Published: 2021-06-10
Description: On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/163264/F5-BIG-IQ-VE-8.0.0-2923215-Remote-Root.html; https://support.f5.com/csp/article/K06024431; http://packetstormsecurity.com/files/163264/F5-BIG-IQ-VE-8.0.0-2923215-Remote-Root.html
CVE: CVE-2021-31538
Published: 2021-06-10
Description: LANCOM R&S Unified Firewall (UF) devices running LCOS FX 10.5 allow Relative Path Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-010.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-010.txt
CVE: CVE-2021-31658
Published: 2021-06-10
Description: TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is affected by an Array index error. The interface that provides the "device description" function only judges the length of the received data, and does not filter special characters. This vulnerability will cause the application to crash, and all device configuration information will be erased.
CVSS Score: 8.1 (HIGH)
CWE: CWE-129
References: http://tp-link.com; https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-31658; http://tp-link.com
CVE: CVE-2021-31659
Published: 2021-06-10
Description: TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery (CSRF). All configuration information is placed in the URL, without any additional token authentication information. A malicious link opened by the switch administrator may cause the password of the switch to be modified and the configuration file to be tampered with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://tp-link.com; https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-31659; http://tp-link.com
CVE: CVE-2021-31927
Published: 2021-06-10
Description: An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://www.annexcloud.com/; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2021-31928
Published: 2021-06-10
Description: Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator. It was fixed in v2021.1.0.2.
CVSS Score: 8.8 (HIGH)
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://www.annexcloud.com/; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2021-34547
Published: 2021-06-10
Description: PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/likhihcv/PRTG_Network_Monitor_20.1.55.1775_CSRF; https://github.com/likhihcv/PRTG_Network_Monitor_20.1.55.1775_CSRF
CVE: CVE-2021-34555
Published: 2021-06-10
Description: OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a multi-value From header field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/trusteddomainproject/OpenDMARC/issues/179; https://github.com/trusteddomainproject/OpenDMARC/pull/178; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MAT4ZSWPQ5SUTMYCXRXI5SMTWL4AG7E/
CVE: CVE-2020-24663
Published: 2021-06-10
Description: Trace Financial CRESTBridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://www.accenture.com; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-24667
Published: 2021-06-10
Description: Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://www.accenture.com; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-24668
Published: 2021-06-10
Description: Trace Financial Crest Bridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://www.accenture.com; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-24671
Published: 2021-06-10
Description: Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://www.accenture.com; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-25467
Published: 2021-06-10
Description: A null pointer dereference was discovered lzo_decompress_buf in stream.c in Irzip 0.621 which allows an attacker to cause a denial of service (DOS) via a crafted compressed file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugs.launchpad.net/ubuntu/+source/lrzip/+bug/1893641; https://github.com/ckolivas/lrzip/issues/163; https://lists.debian.org/debian-lts-announce/2022/04/msg00012.html
CVE: CVE-2021-23022
Published: 2021-06-10
Description: On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://support.f5.com/csp/article/K08503505; https://support.f5.com/csp/article/K08503505
CVE: CVE-2021-27345
Published: 2021-06-10
Description: A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/ckolivas/lrzip/issues/164; https://lists.debian.org/debian-lts-announce/2022/04/msg00012.html; https://github.com/ckolivas/lrzip/issues/164
CVE: CVE-2021-27347
Published: 2021-06-10
Description: Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/ckolivas/lrzip/issues/165; https://lists.debian.org/debian-lts-announce/2022/04/msg00012.html; https://github.com/ckolivas/lrzip/issues/165
CVE: CVE-2021-33031
Published: 2021-06-10
Description: In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email address if the attacker knows details of the victim such as the exact roles and group roles, ID, and remote authentication ID settings. These must be sent in a modified save API request. It was fixed in 6.3.0.03.
CVSS Score: 3.1 (LOW)
CWE: CWE-862
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://labcup.net/privacy-data-security/; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md