deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27622
Published: 2021-06-09
Description: SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CDrawRaster::LoadImageFromMemory() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3021050; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3021050
CVE: CVE-2021-27623
Published: 2021-06-09
Description: SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CXmlUtility::CheckLength() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3021050; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3021050
CVE: CVE-2021-27624
Published: 2021-06-09
Description: SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CiXMLIStreamRawBuffer::readRaw () which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3021050; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3021050
CVE: CVE-2021-27625
Published: 2021-06-09
Description: SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method IgsData::freeMemory() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3021050; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3021050
CVE: CVE-2021-27626
Published: 2021-06-09
Description: SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CMiniXMLParser::Parse() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3021050; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3021050
CVE: CVE-2021-27627
Published: 2021-06-09
Description: SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method ChartInterpreter::DoIt() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3021050; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3021050
CVE: CVE-2021-27628
Published: 2021-06-09
Description: SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method DpRTmPrepareReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3021197; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3021197
CVE: CVE-2021-27629
Published: 2021-06-09
Description: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EncPSetUnsupported() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://launchpad.support.sap.com/#/notes/3020104; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3020104
CVE: CVE-2021-27630
Published: 2021-06-09
Description: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EnqConvUniToSrvReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://launchpad.support.sap.com/#/notes/3020104; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3020104
CVE: CVE-2021-27631
Published: 2021-06-09
Description: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EnqConvUniToSrvReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://launchpad.support.sap.com/#/notes/3020104; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3020104
CVE: CVE-2021-27632
Published: 2021-06-09
Description: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EnqConvUniToSrvReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://launchpad.support.sap.com/#/notes/3020104; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3020104
CVE: CVE-2021-27633
Published: 2021-06-09
Description: SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCPIC() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3020209; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3020209
CVE: CVE-2021-27634
Published: 2021-06-09
Description: SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCpicDtCreate () causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://launchpad.support.sap.com/#/notes/3020209; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3020209
CVE: CVE-2021-27635
Published: 2021-06-09
Description: SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted XML file in the application because of missing XML Validation, this vulnerability enables attacker to fully compromise confidentiality by allowing them to read any file on the filesystem or fully compromise availability by causing the system to crash. The attack cannot be used to change any data so that there is no compromise as to integrity.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://packetstormsecurity.com/files/164592/SAP-JAVA-NetWeaver-System-Connections-XML-Injection.html; http://seclists.org/fulldisclosure/2021/Oct/28; https://launchpad.support.sap.com/#/notes/3053066
CVE: CVE-2021-27637
Published: 2021-06-09
Description: Under certain conditions SAP Enable Now (SAP Workforce Performance Builder - Manager), versions - 1.0, 10 allows an attacker to access information which would otherwise be restricted leading to information disclosure.
CVSS Score: 4.6 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3049879; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3049879
CVE: CVE-2021-27638
Published: 2021-06-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3059999; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3059999
CVE: CVE-2021-27639
Published: 2021-06-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3059999; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3059999
CVE: CVE-2021-27640
Published: 2021-06-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3059999; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3059999
CVE: CVE-2021-27641
Published: 2021-06-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3059999; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3059999
CVE: CVE-2021-27642
Published: 2021-06-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3059999; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3059999
CVE: CVE-2021-27643
Published: 2021-06-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3059999; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3059999
CVE: CVE-2021-31832
Published: 2021-06-09
Description: Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScript code into the alert configuration text field. This JavaScript will be executed when an end user triggers a DLP policy on their machine.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10360; https://kc.mcafee.com/corporate/index?page=content&id=SB10360
CVE: CVE-2021-31837
Published: 2021-06-09
Description: Memory corruption vulnerability in the driver file component in McAfee GetSusp prior to 4.0.0 could allow a program being investigated on the local machine to trigger a buffer overflow in GetSusp, leading to the execution of arbitrary code, potentially triggering a BSOD.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10363; https://kc.mcafee.com/corporate/index?page=content&id=SB10363
CVE: CVE-2021-33659
Published: 2021-06-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3059999; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3059999
CVE: CVE-2021-33660
Published: 2021-06-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3059999; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3059999
CVE: CVE-2021-33661
Published: 2021-06-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3059999; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3059999
CVE: CVE-2021-33662
Published: 2021-06-09
Description: Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which would otherwise be restricted.
CVSS Score: 4.4 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3058382; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3058382
CVE: CVE-2021-33663
Published: 2021-06-09
Description: SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83,7.84, allows an unauthorized attacker to insert cleartext commands due to improper restriction of I/O buffering into encrypted SMTP sessions over the network which can partially impact the integrity of the application.
CVSS Score: 5.3 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3030604; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3030604
CVE: CVE-2021-33664
Published: 2021-06-09
Description: SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3025604; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3025604
CVE: CVE-2021-33665
Published: 2021-06-09
Description: SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81,7.84, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3028370; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/3028370
CVE: CVE-2021-33666
Published: 2021-06-09
Description: When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2985562; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999; https://launchpad.support.sap.com/#/notes/2985562
CVE: CVE-2021-33669
Published: 2021-06-09
Description: Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a successful exploitation user interaction from another user is required and could lead to complete impact of confidentiality integrity and availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://github.com/SAP/mobilesdk-certificateprovider/security/advisories/GHSA-r2j9-h6q9-cq8g; https://github.com/SAP/mobilesdk-certificateprovider/security/advisories/GHSA-r2j9-h6q9-cq8g
CVE: CVE-2020-15381
Published: 2021-06-09
Description: Brocade SANnav before version 2.1.1 contains an Improper Authentication vulnerability that allows cleartext transmission of authentication credentials of the jmx server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1483; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1483
CVE: CVE-2020-15382
Published: 2021-06-09
Description: Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at install-time.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1484; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1484
CVE: CVE-2020-15383
Published: 2021-06-09
Description: Running security scans against the SAN switch can cause config and secnotify processes within the firmware before Brocade Fabric OS v9.0.0, v8.2.2d and v8.2.1e to consume all memory leading to denial of service impacts possibly including a switch panic.
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1496; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-27384
Published: 2021-06-09
Description: The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to the improper permissions, with the 'F' flag (Full Control) for 'Everyone' group, making the entire directory 'Guild Wars 2' and its files and sub-dirs world-writable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/FreySolarEye/CVE/blob/master/Guild%20Wars%202%20-%20Local%20Privilege%20Escalation; https://github.com/FreySolarEye/CVE/blob/master/Guild%20Wars%202%20-%20Local%20Privilege%20Escalation
CVE: CVE-2021-23847
Published: 2021-06-09
Description: A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP7.3 family with firmware 7.70, 7.72, and 7.80 prior to B128 are affected by this vulnerability. Versions 7.62 or lower and INTEOX cameras are not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-306
References: https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html