deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28812
Published: 2021-06-03
Description: A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78, CWE-1286, CWE-77
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-21; https://www.qnap.com/zh-tw/security-advisory/qsa-21-21
CVE: CVE-2021-33805
Published: 2021-06-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-10906. Reason: This candidate is a duplicate of CVE-2018-10906. Notes: All CVE users should reference CVE-2018-10906 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-31831
Published: 2021-06-03
Description: Incorrect access to deleted scripts vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to gain access to signed SQL scripts which have been marked as deleted or expired within the administrative console. This access was only available through the REST API.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10359; https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE: CVE-2021-22130
Published: 2021-06-03
Description: A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 may allow an authenticated, remote attacker to perform a Denial of Service attack by running the `diagnose sys cpuset` with a large cpuset mask value. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://fortiguard.com/advisory/FG-IR-21-006; https://fortiguard.com/advisory/FG-IR-21-006
CVE: CVE-2021-26584
Published: 2021-06-03
Description: A security vulnerability in HPE OneView for VMware vCenter (OV4VC) could be exploited remotely to allow Cross-Site Scripting. HPE has released the following software update to resolve the vulnerability in HPE OneView for VMware vCenter (OV4VC).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04151en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04151en_us
CVE: CVE-2021-28847
Published: 2021-06-03
Description: MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls.
CVSS Score: 7.5 (HIGH)
References: https://mobaxterm.mobatek.net/download-home-edition.html; https://mobaxterm.mobatek.net/preview.html; https://mobaxterm.mobatek.net/download-home-edition.html
CVE: CVE-2021-31830
Published: 2021-06-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to embed JavaScript code when configuring the name of a database to be monitored. This would be triggered when any authorized user logs into the DBSec interface and opens the properties configuration page for this database.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10359; https://kc.mcafee.com/corporate/index?page=content&id=SB10359
CVE: CVE-2021-32923
Published: 2021-06-03
Description: HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
CVSS Score: 7.4 (HIGH)
CWE: CWE-613
References: https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603; https://security.gentoo.org/glsa/202207-01; https://www.hashicorp.com/blog/category/vault/
CVE: CVE-2021-28848
Published: 2021-06-03
Description: Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon processing a title change.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/mintty/mintty/commit/bd[PII_REDACTED]0b6996760aaccb66e68e782762b9; https://github.com/mintty/mintty/compare/3.4.4...3.4.5; https://mintty.github.io/
CVE: CVE-2021-33806
Published: 2021-06-03
Description: The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of its use of Java serialization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://bdew.net; https://github.com/bdew-minecraft/bdlib/commit/447210530ceec72fb3374efecb0930ed359d2297; https://vuln.ryotak.me/advisories/46
CVE: CVE-2021-3569
Published: 2021-06-03
Description: A stack corruption bug was found in libtpms in versions before 0.7.2 and before 0.8.0 while decrypting data using RSA. This flaw could result in a SIGBUS (bad memory access) and termination of swtpm. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1964358; https://bugzilla.redhat.com/show_bug.cgi?id=1964358
CVE: CVE-2021-32926
Published: 2021-06-03
Description: When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate, new password hash and replace it with an illegitimate hash. The user would no longer be able to authenticate to the controller (Micro800: All versions, MicroLogix 1400: Version 21 and later) causing a denial-of-service condition
CVSS Score: 7.5 (HIGH)
CWE: CWE-300
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-145-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-145-02
CVE: CVE-2020-21003
Published: 2021-06-03
Description: Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Computer2200/-/issues/3; https://github.com/Computer2200/-/issues/3
CVE: CVE-2020-21005
Published: 2021-06-03
Description: WellCMS 2.0 beta3 is vulnerable to File Upload. A user can log in to the CMS background and upload a picture. Because the upload file type is controllable, the user can modify the upload file type to get webshell.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: http://www.wellcms.cn/read-27.html&&; https://github.com/Computer2200/-/issues/4; http://www.wellcms.cn/read-27.html&&
CVE: CVE-2021-20380
Published: 2021-06-03
Description: IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain sensitive information from HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 195712.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195712; https://www.ibm.com/support/pages/node/6457941; https://exchange.xforce.ibmcloud.com/vulnerabilities/195712
CVE: CVE-2021-24023
Published: 2021-06-03
Description: An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access via a malicious payload in the "diagnose" command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/advisory/FG-IR-21-033; https://fortiguard.com/advisory/FG-IR-21-033
CVE: CVE-2021-32460
Published: 2021-06-03
Description: The Trend Micro Maximum Security 2021 (v17) consumer product is vulnerable to an improper access control vulnerability in the installer which could allow a local attacker to escalate privileges on a target machine. Please note than an attacker must already have local user privileges and access on the machine to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10336; https://www.zerodayinitiative.com/advisories/ZDI-21-603/; https://helpcenter.trendmicro.com/en-us/article/TMKA-10336
CVE: CVE-2020-28469
Published: 2021-06-03
Description: This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/gulpjs/glob-parent/blob/6ce8d11f2f1ed8e80a9526b1dc8cf3aa71f43474/index.js%23L9; https://github.com/gulpjs/glob-parent/pull/36; https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2
CVE: CVE-2021-22308
Published: 2021-06-03
Description: There is a Business Logic Errors vulnerability in Huawei Smartphone. The malicious apps installed on the device can keep taking screenshots in the background. This issue does not cause system errors, but may cause personal information leakage.
CVSS Score: 3.3 (LOW)
References: https://consumer.huawei.com/en/support/bulletin/2021/2/; https://consumer.huawei.com/en/support/bulletin/2021/2/
CVE: CVE-2021-22313
Published: 2021-06-03
Description: There is a Security Function vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impair data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/2/; https://consumer.huawei.com/en/support/bulletin/2021/2/
CVE: CVE-2021-22316
Published: 2021-06-03
Description: There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Attackers with physical access to the device can thereby exploit this vulnerability. A successful exploitation of this vulnerability can compromise the device's data security and functional availability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2021/2/; https://consumer.huawei.com/en/support/bulletin/2021/2/
CVE: CVE-2021-22317
Published: 2021-06-03
Description: There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impair data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/2/; https://consumer.huawei.com/en/support/bulletin/2021/2/
CVE: CVE-2021-22322
Published: 2021-06-03
Description: There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impair data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2021/3/; https://consumer.huawei.com/en/support/bulletin/2021/3/
CVE: CVE-2021-22324
Published: 2021-06-03
Description: There is a Credentials Management Errors vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impair data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/3/; https://consumer.huawei.com/en/support/bulletin/2021/3/
CVE: CVE-2021-22325
Published: 2021-06-03
Description: There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may result in video streams being intercepted during transmission.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://consumer.huawei.com/en/support/bulletin/2021/3/; https://consumer.huawei.com/en/support/bulletin/2021/3/
CVE: CVE-2021-22336
Published: 2021-06-03
Description: There is an Improper Control of Generation of Code vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause denial of security services on a rooted device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://consumer.huawei.com/en/support/bulletin/2021/4/; https://consumer.huawei.com/en/support/bulletin/2021/4/
CVE: CVE-2021-32660
Published: 2021-06-03
Description: Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@backstage/tehdocs-common` prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77, CWE-434
References: https://github.com/backstage/backstage/commit/aad98c544e59369901fe9e0a85f6357644dceb5c; https://github.com/backstage/backstage/releases/tag/release-2021-06-03; https://github.com/backstage/backstage/security/advisories/GHSA-pwhf-39xg-4rxw
CVE: CVE-2021-33815
Published: 2021-06-03
Description: dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked.
CVSS Score: 8.8 (HIGH)
CWE: CWE-129
References: https://github.com/FFmpeg/FFmpeg/commit/26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777; https://security.gentoo.org/glsa/202312-14; https://github.com/FFmpeg/FFmpeg/commit/26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777
CVE: CVE-2021-32661
Published: 2021-06-03
Description: Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77, CWE-434
References: https://github.com/backstage/backstage/commit/aad98c544e59369901fe9e0a85f6357644dceb5c; https://github.com/backstage/backstage/releases/tag/release-2021-06-03; https://github.com/backstage/backstage/security/advisories/GHSA-gg96-f8wr-p89f
CVE: CVE-2019-14584
Published: 2021-06-03
Description: Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1889486; https://bugzilla.redhat.com/show_bug.cgi?id=1889486
CVE: CVE-2021-22333
Published: 2021-06-03
Description: There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause code to execute, thus obtaining system permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://consumer.huawei.com/en/support/bulletin/2021/4/; https://consumer.huawei.com/en/support/bulletin/2021/4/
CVE: CVE-2021-22334
Published: 2021-06-03
Description: There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause app redirections.
CVSS Score: 7.4 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/4/; https://consumer.huawei.com/en/support/bulletin/2021/4/
CVE: CVE-2021-22335
Published: 2021-06-03
Description: There is a Memory Buffer Improper Operation Limit vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause exceptions in image processing.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2021/4/; https://consumer.huawei.com/en/support/bulletin/2021/4/
CVE: CVE-2021-22337
Published: 2021-06-03
Description: There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause leaking of user click data.
CVSS Score: 5.3 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2021/4/; https://consumer.huawei.com/en/support/bulletin/2021/4/
CVE: CVE-2021-25947
Published: 2021-06-03
Description: Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25947; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25947
CVE: CVE-2021-3469
Published: 2021-06-03
Description: Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=1943630; https://bugzilla.redhat.com/show_bug.cgi?id=1943630
CVE: CVE-2020-35970
Published: 2021-06-03
Description: An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/yzmcms/yzmcms/issues/53; https://github.com/yzmcms/yzmcms/issues/53
CVE: CVE-2020-35971
Published: 2021-06-03
Description: A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user_config_edit.html page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yzmcms/yzmcms/issues/54; https://github.com/yzmcms/yzmcms/issues/54
CVE: CVE-2020-35972
Published: 2021-06-03
Description: An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/yzmcms/yzmcms/issues/55; https://github.com/yzmcms/yzmcms/issues/55
CVE: CVE-2020-35973
Published: 2021-06-03
Description: An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/BLL-l/vulnerability_wiki/blob/main/zzcms/user_manage_xss.md; https://github.com/BLL-l/vulnerability_wiki/blob/main/zzcms/user_manage_xss.md
CVE: CVE-2021-32665
Published: 2021-06-03
Description: wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversation could be incorrectly set to "unverified. This occurs when: - Self user is added to a new conversation - Self user is added to an existing conversation - All the participants in the conversation were previously marked as verified. The vulnerability is patched in wire-ios version 3.8.1. As a workaround, one can unverify & verify a device in the conversation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://github.com/wireapp/wire-ios-data-model/commit/bf9db85886b12a20c8374f55b7c4a610e8ae9220; https://github.com/wireapp/wire-ios/security/advisories/GHSA-mc65-7w99-c6qv; https://github.com/wireapp/wire-ios-data-model/commit/bf9db85886b12a20c8374f55b7c4a610e8ae9220
CVE: CVE-2021-32662
Published: 2021-06-03
Description: Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/techdocs-common` versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API. This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API. The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/backstage/backstage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208; https://github.com/backstage/backstage/releases/tag/release-2021-05-27; https://github.com/backstage/backstage/security/advisories/GHSA-pgf8-28gg-vpr6
CVE: CVE-2021-32666
Published: 2021-06-03
Description: wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that can cause a denial of service between users. If a user has an invalid assetID for their profile picture and it contains the " character, it will cause the iOS client to crash. The vulnerability is patched in wire-ios version 3.8.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/wireapp/wire-ios-data-model/commit/35af3f632085f51a2ce7f608fdaeffd1a69ad89f; https://github.com/wireapp/wire-ios/security/advisories/GHSA-2x9x-vh27-h4rv; https://github.com/wireapp/wire-ios-data-model/commit/35af3f632085f51a2ce7f608fdaeffd1a69ad89f
CVE: CVE-2020-36004
Published: 2021-06-03
Description: AppCMS 2.0.101 in /admin/download_frame.php has a SQL injection vulnerability which allows attackers to obtain sensitive database information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/source-trace/appcms/issues/2; https://github.com/source-trace/appcms/issues/2
CVE: CVE-2020-36005
Published: 2021-06-03
Description: AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/source-trace/appcms/issues/3; https://github.com/source-trace/appcms/issues/3
CVE: CVE-2020-36006
Published: 2021-06-03
Description: AppCMS 2.0.101 in /admin/info.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/source-trace/appcms/issues/4; https://github.com/source-trace/appcms/issues/4
CVE: CVE-2020-36007
Published: 2021-06-03
Description: AppCMS 2.0.101 in /admin/template/tpl_app.php has a cross site scripting attack vulnerability which allows the attacker to obtain sensitive information of other users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/appcms/issues/7; https://github.com/source-trace/appcms/issues/7
CVE: CVE-2020-36008
Published: 2021-06-03
Description: OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability.
CVSS Score: 8.1 (HIGH)
References: https://github.com/SomeBottle/OBottle/issues/7; https://github.com/SomeBottle/OBottle/issues/7
CVE: CVE-2020-36009
Published: 2021-06-03
Description: OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://github.com/SomeBottle/OBottle/issues/6; https://github.com/SomeBottle/OBottle/issues/6