deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-25902
Published: 2021-03-02
Description: Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will execute on the class room, which leads to stealing cookies from users who join the class. NOTE: Third-parties dispute the validity of this entry as a possible false positive during research
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Lawyer-1/Turki/blob/main/CVE-2020-25902.md; https://www.blackboard.com/teaching-learning/collaboration-web-conferencing/blackboard-collaborate; https://github.com/Lawyer-1/Turki/blob/main/CVE-2020-25902.md
CVE: CVE-2021-21513
Published: 2021-03-02
Description: Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server (DWS) enabled configuration contains an authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain admin access on the affected system.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.dell.com/support/kbdoc/en-us/000183670/dsa-2021-040-dell-emc-openmanage-server-administrator-omsa-security-update-for-multiple-vulnerabilities; https://www.tenable.com/security/research/tra-2021-07; https://www.dell.com/support/kbdoc/en-us/000183670/dsa-2021-040-dell-emc-openmanage-server-administrator-omsa-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-21514
Published: 2021-03-02
Description: Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privileges could potentially exploit this vulnerability to view arbitrary files on the target system by sending a specially crafted URL request.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000183670/dsa-2021-040-dell-emc-openmanage-server-administrator-omsa-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000183670/dsa-2021-040-dell-emc-openmanage-server-administrator-omsa-security-update-for-multiple-vulnerabilities
CVE: CVE-2020-23518
Published: 2021-03-02
Description: Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/47289; https://www.exploit-db.com/exploits/47289
CVE: CVE-2020-4719
Published: 2021-03-02
Description: The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user with admin authorization to create DNS query strings that are not hostnames. IBM X-Force ID: 187861.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-706
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187861; https://www.ibm.com/support/pages/node/6417137; https://exchange.xforce.ibmcloud.com/vulnerabilities/187861
CVE: CVE-2020-4725
Published: 2021-03-02
Description: IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially crafted HTTP request to the APM UI, which could mislead another user. IBM X-Force ID: 187974.
CVSS Score: 3.5 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187974; https://www.ibm.com/support/pages/node/6417137; https://exchange.xforce.ibmcloud.com/vulnerabilities/187974
CVE: CVE-2020-4726
Published: 2021-03-02
Description: The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 187975.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187975; https://www.ibm.com/support/pages/node/6417137; https://exchange.xforce.ibmcloud.com/vulnerabilities/187975
CVE: CVE-2021-25330
Published: 2021-03-02
Description: Calling of non-existent provider in MobileWips application prior to SMR Feb-2021 Release 1 allows unauthorized actions including denial of service attack by hijacking the provider.
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2021-3384
Published: 2021-03-02
Description: A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tables management, which would temporarily prevent the system to contact new hosts via IPv4 or IPv6. This affects versions 2.0.0 to 2.7.7, 2.8.0 to 2.16.0, 3.0.0 to 3.7.16, 3.8.0 to 3.11.4, and 4.0.0 to 4.1.5. Fixed in versions 2.7.8, 3.7.17, 3.11.5, and 4.2.0.
CVSS Score: 5.3 (MEDIUM)
References: https://advisories.stormshield.eu/2020-049/; https://advisories.stormshield.eu/2020-049/
CVE: CVE-2020-28657
Published: 2021-03-02
Description: In bPanel 2.0, the administrative ajax endpoints (aka ajax/aj_*.php) are accessible without authentication and allow SQL injections, which could lead to platform compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/blackarrowsec/advisories/tree/master/2020/CVE-2020-28657; https://github.com/blackarrowsec/advisories/tree/master/2020/CVE-2020-28657
CVE: CVE-2021-22187
Published: 2021-03-02
Description: An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22187.json; https://gitlab.com/gitlab-org/gitlab/-/issues/300452; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22187.json
CVE: CVE-2021-22294
Published: 2021-03-02
Description: A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerability to issue commands repeatedly, exhausting system service resources.
CVSS Score: 3.3 (LOW)
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2021/2021-03.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2021/2021-03.md
CVE: CVE-2021-22296
Published: 2021-03-02
Description: A component of HarmonyOS 2.0 has a DoS vulnerability. Local attackers may exploit this vulnerability to mount a file system to the target device, causing DoS of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://device.harmonyos.com/cn/console/safetyDetail?id=9145efa5d9064d94a7fc3968b6054d83&pageSize=10&pageIndex=1; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2021/2021-03.md; https://www.tenable.com/cve/CVE-2021-22296
CVE: CVE-2021-27885
Published: 2021-03-02
Description: usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/161651/e107-CMS-2.3.0-Cross-Site-Request-Forgery.html; https://github.com/e107inc/e107/commit/d9efdb9b5f424b4996c276e754a380a5e251f472; https://github.com/e107inc/e107/releases
CVE: CVE-2021-21255
Published: 2021-03-02
Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-862, CWE-639
References: https://github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dc; https://github.com/glpi-project/glpi/security/advisories/GHSA-v3m5-r3mx-ff9j; https://github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dc
CVE: CVE-2021-21258
Published: 2021-03-02
Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/commit/e7802fc051696de1f76108ea8dc3bd4e2c880f15; https://github.com/glpi-project/glpi/security/advisories/GHSA-j4xj-4qmc-mmmx; https://github.com/glpi-project/glpi/commit/e7802fc051696de1f76108ea8dc3bd4e2c880f15
CVE: CVE-2020-12527
Published: 2021-03-02
Description: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access validation allows a logged in user to shutdown or reboot devices in his account without having corresponding permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://cert.vde.com/en/advisories/VDE-2021-003; https://cert.vde.com/en/advisories/VDE-2022-039; https://cert.vde.com/en/advisories/VDE-2021-003
CVE: CVE-2020-12528
Published: 2021-03-02
Description: An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access validation allows a logged in user to kill web2go sessions in the account he should not have access to.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://cert.vde.com/de-de/advisories/vde-2021-003
CVE: CVE-2020-12529
Published: 2021-03-02
Description: An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP access check, allowing an attacker to scan for open ports.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://cert.vde.com/de-de/advisories/vde-2021-003
CVE: CVE-2020-12530
Published: 2021-03-02
Description: An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://cert.vde.com/de-de/advisories/vde-2021-003
CVE: CVE-2021-26412
Published: 2021-03-03
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 9.1 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26412; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26412
CVE: CVE-2021-26854
Published: 2021-03-03
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26854; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26854
CVE: CVE-2021-26855
Published: 2021-03-03
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918, CWE-918
References: http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html; http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html; http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html
CVE: CVE-2021-26857
Published: 2021-03-03
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26857
CVE: CVE-2021-26858
Published: 2021-03-03
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26858
CVE: CVE-2021-27065
Published: 2021-03-03
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html; http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27065
CVE: CVE-2021-27078
Published: 2021-03-03
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 9.1 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27078; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27078
CVE: CVE-2021-21352
Published: 2021-03-03
Description: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess user tokens and, once successful, change user passwords, including that of a system administrator. This vulnerability is pathced in version 1.19.24.5415 (started to use more secure tokens) with an additional improvement in 1.19.24.5416 (limited an available window for brute force token guessing).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-330
References: https://github.com/anuko/timetracker/commit/40f3d9345adc20e6f28eb9f59e2489aff87fecf5; https://github.com/anuko/timetracker/security/advisories/GHSA-43c9-rx4h-4gqq; https://www.anuko.com/time-tracker/index.htm
CVE: CVE-2021-21353
Published: 2021-03-03
Description: Pug is an npm package which is a high-performance template engine.  In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1.  This advisory applies to multiple pug packages including "pug", "pug-code-gen".  pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-74, CWE-94
References: https://github.com/pugjs/pug/commit/991e78f7c4220b2f8da042877c6f0ef5a4683be0; https://github.com/pugjs/pug/issues/3312; https://github.com/pugjs/pug/pull/3314
CVE: CVE-2020-10519
Published: 2021-03-03
Description: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7, 2.21.15, and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24; https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15; https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7
CVE: CVE-2021-22861
Published: 2021-03-03
Description: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24; https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15; https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7
CVE: CVE-2021-22862
Published: 2021-03-03
Description: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1; https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1
CVE: CVE-2021-22863
Published: 2021-03-03
Description: An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24; https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15; https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7
CVE: CVE-2021-2138
Published: 2021-03-03
Description: Vulnerability in the Oracle Cloud Infrastructure Data Science Notebook Sessions. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Cloud Infrastructure Data Science Notebook Sessions executes to compromise Oracle Cloud Infrastructure Data Science Notebook Sessions. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Cloud Infrastructure Data Science Notebook Sessions accessible data as well as unauthorized read access to a subset of Oracle Cloud Infrastructure Data Science Notebook Sessions accessible data. All affected customers were notified of CVE-2021-2138 by Oracle. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
CVSS Score: 4.6 (MEDIUM)
References: https://support.oracle.com; https://support.oracle.com
CVE: CVE-2021-27921
Published: 2021-03-03
Description: Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/
CVE: CVE-2021-27922
Published: 2021-03-03
Description: Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/
CVE: CVE-2021-27923
Published: 2021-03-03
Description: Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/
CVE: CVE-2021-23347
Published: 2021-03-03
Description: The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/argoproj/argo-cd/pull/5563; https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291; https://github.com/argoproj/argo-cd/pull/5563
CVE: CVE-2021-25315
Published: 2021-03-03
Description: CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://bugzilla.suse.com/show_bug.cgi?id=1182382; https://bugzilla.suse.com/show_bug.cgi?id=1182382
CVE: CVE-2020-15937
Published: 2021-03-03
Description: An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-20-068; https://fortiguard.com/advisory/FG-IR-20-068