deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39221
Published: 2021-10-25
Description: Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Contacts application is upgraded to 4.0.3. As a workaround, one may use a browser that has support for Content-Security-Policy.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-434
References: https://github.com/nextcloud/contacts/pull/2407; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j6cx-mxqf-f9vc; https://github.com/nextcloud/contacts/pull/2407
CVE: CVE-2021-38258
Published: 2021-10-25
Description: NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostProcessCallback().
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://mcusec.github.io/vulnerabilities_details#nxp_usb; https://mcusec.github.io/vulnerabilities_details#nxp_usb
CVE: CVE-2021-38260
Published: 2021-10-25
Description: NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostParseDeviceConfigurationDescriptor().
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://mcusec.github.io/vulnerabilities_details#nxp_usb; https://mcusec.github.io/vulnerabilities_details#nxp_usb
CVE: CVE-2021-39223
Published: 2021-10-25
Description: Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the Richdocuments application is upgraded to 3.8.6 or 4.2.3. As a workaround, disable the Richdocuments application in the app settings.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/nextcloud/richdocuments/pull/1760; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rjcc-4cgj-6v93; https://hackerone.com/reports/1253460
CVE: CVE-2021-39224
Published: 2021-10-25
Description: Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the OfficeOnline application is upgraded to 1.1.1. As a workaround, one may disable the OfficeOnline application in the app settings.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://github.com/nextcloud/officeonline/pull/204; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56wm-r6jm-3v9h; https://github.com/nextcloud/officeonline/pull/204
CVE: CVE-2021-39225
Published: 2021-10-25
Description: Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639, CWE-862
References: https://github.com/nextcloud/deck/pull/3316; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72; https://hackerone.com/reports/1331728
CVE: CVE-2021-41105
Published: 2021-10-25
Description: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. When handling SRTP calls, FreeSWITCH prior to version 1.10.7 is susceptible to a DoS where calls can be terminated by remote attackers. This attack can be done continuously, thus denying encrypted calls during the attack. When a media port that is handling SRTP traffic is flooded with a specially crafted SRTP packet, the call is terminated leading to denial of service. This issue was reproduced when using the SDES key exchange mechanism in a SIP environment as well as when using the DTLS key exchange mechanism in a WebRTC environment. The call disconnection occurs due to line 6331 in the source file `switch_rtp.c`, which disconnects the call when the total number of SRTP errors reach a hard-coded threshold (100). By abusing this vulnerability, an attacker is able to disconnect any ongoing calls that are using SRTP. The attack does not require authentication or any special foothold in the caller's or the callee's network. This issue is patched in version 1.10.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2021/Oct/43; https://github.com/signalwire/freeswitch/releases/tag/v1.10.7; https://github.com/signalwire/freeswitch/security/advisories/GHSA-jh42-prph-gp36
CVE: CVE-2021-41145
Published: 2021-10-25
Description: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. FreeSWITCH prior to version 1.10.7 is susceptible to Denial of Service via SIP flooding. When flooding FreeSWITCH with SIP messages, it was observed that after a number of seconds the process was killed by the operating system due to memory exhaustion. By abusing this vulnerability, an attacker is able to crash any FreeSWITCH instance by flooding it with SIP messages, leading to Denial of Service. The attack does not require authentication and can be carried out over UDP, TCP or TLS. This issue was patched in version 1.10.7.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-401
References: https://github.com/signalwire/freeswitch/releases/tag/v1.10.7; https://github.com/signalwire/freeswitch/security/advisories/GHSA-jvpq-23v4-gp3m; https://github.com/signalwire/freeswitch/releases/tag/v1.10.7
CVE: CVE-2021-41177
Published: 2021-10-25
Description: Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.
CVSS Score: 8.1 (HIGH)
CWE: CWE-799
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fj39-4qx4-m3f2; https://github.com/nextcloud/server/pull/28728; https://hackerone.com/reports/1265709
CVE: CVE-2021-41178
Published: 2021-10-25
Description: Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishing attack, an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link to victims. The XSS risk here is mitigated due to the fact that Nextcloud employs a strict Content-Security-Policy disallowing execution of arbitrary JavaScript. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-434, CWE-22
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jp9c-vpr3-m5rf; https://github.com/nextcloud/server/pull/28726; https://hackerone.com/reports/1302155
CVE: CVE-2021-41179
Published: 2021-10-25
Description: Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-304
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7hvh-rc6f-px23; https://github.com/nextcloud/server/pull/28725; https://hackerone.com/reports/1322865
CVE: CVE-2021-41304
Published: 2021-10-26
Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72939; https://jira.atlassian.com/browse/JRASERVER-72939
CVE: CVE-2021-41305
Published: 2021-10-26
Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in Status Gadget. The affected versions are before version 8.13.12..
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://jira.atlassian.com/browse/JRASERVER-72813; https://jira.atlassian.com/browse/JRASERVER-72813
CVE: CVE-2021-41306
Published: 2021-10-26
Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://jira.atlassian.com/browse/JRASERVER-72915; https://jira.atlassian.com/browse/JRASERVER-72915
CVE: CVE-2021-41307
Published: 2021-10-26
Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://jira.atlassian.com/browse/JRASERVER-72916; https://jira.atlassian.com/browse/JRASERVER-72916
CVE: CVE-2021-41308
Published: 2021-10-26
Description: Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the `ReplicationSettings!default.jspa` endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://jira.atlassian.com/browse/JRASERVER-72940; https://jira.atlassian.com/browse/JRASERVER-72940
CVE: CVE-2021-20837
Published: 2021-10-26
Description: Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/164705/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.html; http://packetstormsecurity.com/files/164818/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.html; https://jvn.jp/en/jp/JVN41119755/index.html
CVE: CVE-2021-34583
Published: 2021-10-26
Description: Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=; https://www.tenable.com/security/research/tra-2021-47; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=
CVE: CVE-2021-34584
Published: 2021-10-26
Description: Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-126
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=; https://www.tenable.com/security/research/tra-2021-47; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=
CVE: CVE-2021-34585
Published: 2021-10-26
Description: In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=; https://www.tenable.com/security/research/tra-2021-47; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=
CVE: CVE-2021-34586
Published: 2021-10-26
Description: In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=; https://www.tenable.com/security/research/tra-2021-47; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=
CVE: CVE-2021-34593
Published: 2021-10-26
Description: In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html; http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html; http://seclists.org/fulldisclosure/2021/Oct/64
CVE: CVE-2021-34595
Published: 2021-10-26
Description: A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
CVSS Score: 8.1 (HIGH)
CWE: CWE-823, CWE-119
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16878&token=e5644ec405590e66aefa62304cb8632df9fc9e9c&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16878&token=e5644ec405590e66aefa62304cb8632df9fc9e9c&download=
CVE: CVE-2021-34596
Published: 2021-10-26
Description: A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-824
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16878&token=e5644ec405590e66aefa62304cb8632df9fc9e9c&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16878&token=e5644ec405590e66aefa62304cb8632df9fc9e9c&download=
CVE: CVE-2020-5669
Published: 2021-10-26
Description: Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN94245475/index.html; https://www.sixapart.jp/movabletype/news/2020/11/18-1101.html; https://jvn.jp/en/jp/JVN94245475/index.html
CVE: CVE-2021-40343
Published: 2021-10-26
Description: An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the root user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://synacktiv.com; https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdf
CVE: CVE-2021-40344
Published: 2021-10-26
Description: An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://synacktiv.com; https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdf
CVE: CVE-2021-40345
Published: 2021-10-26
Description: An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://github.com/ArianeBlow/NagiosXI-EmersonFI/blob/main/README.md; https://synacktiv.com
CVE: CVE-2021-42343
Published: 2021-10-26
Description: An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://docs.dask.org/en/latest/changelog.html; https://github.com/dask/dask/tags; https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxr
CVE: CVE-2021-41873
Published: 2021-10-26
Description: Penguin Aurora TV Box 41502 is a high-end network HD set-top box produced by Tencent Video and Skyworth Digital. An unauthorized access vulnerability exists in the Penguin Aurora Box. An attacker can use the vulnerability to gain unauthorized access to a specific link to remotely control the TV.
CVSS Score: 10.0 (CRITICAL)
References: https://www.cnvd.org.cn/flaw/show/2934166; https://www.cnvd.org.cn/flaw/show/2934166
CVE: CVE-2011-2195
Published: 2021-10-26
Description: A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed 'path' argument to execute arbitrary commands against the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://seclists.org/bugtraq/2011/Jun/34; https://seclists.org/bugtraq/2011/Jun/34
CVE: CVE-2011-4119
Published: 2021-10-26
Description: caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-377
References: http://gnats.netbsd.org/45558; https://seclists.org/oss-sec/2011/q4/249; https://vuxml.freebsd.org/freebsd/9dde9dac-08f4-11e1-af36-003067b2972c.html
CVE: CVE-2021-26607
Published: 2021-10-26
Description: An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36289; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36289
CVE: CVE-2021-26609
Published: 2021-10-26
Description: A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type parameter makes a SQL query using unfiltered data. This vulnerability allows a remote attacker to steal user information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36292; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36292
CVE: CVE-2021-37371
Published: 2021-10-26
Description: Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/164625/Online-Student-Admission-System-1.0-SQL-Injection-Shell-Upload.html; https://packetstormsecurity.com/files/164625/Online_Admission_System_CVEs-Gerard-Carbonell.pdf; https://www.sourcecodester.com/php/14874/online-student-admission-system.html
CVE: CVE-2021-37372
Published: 2021-10-26
Description: Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can upload malicious PHP files by updating their profile image to gain remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/164625/Online-Student-Admission-System-1.0-SQL-Injection-Shell-Upload.html; https://packetstormsecurity.com/files/164625/Online_Admission_System_CVEs-Gerard-Carbonell.pdf; https://www.sourcecodester.com/php/14874/online-student-admission-system.html
CVE: CVE-2021-41078
Published: 2021-10-26
Description: Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://github.com/nameko/nameko; https://github.com/nameko/nameko/security/advisories/GHSA-6p52-jr3q-c94g; https://github.com/nameko/nameko
CVE: CVE-2021-37363
Published: 2021-10-26
Description: An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.exploit-db.com/exploits/50449; https://www.gestionaleopen.org/; https://www.exploit-db.com/exploits/50449