deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21271
Published: 2021-01-26
Description: Tendermint Core is an open source Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine - written in any programming language - and securely replicates it on many machines. Tendermint Core v0.34.0 introduced a new way of handling evidence of misbehavior. As part of this, we added a new Timestamp field to Evidence structs. This timestamp would be calculated using the same algorithm that is used when a block is created and proposed. (This algorithm relies on the timestamp of the last commit from this specific block.) In Tendermint Core v0.34.0-v0.34.2, the consensus reactor is responsible for forming DuplicateVoteEvidence whenever double signs are observed. However, the current block is still “in flight” when it is being formed by the consensus reactor. It hasn’t been finalized through network consensus yet. This means that different nodes in the network may observe different “last commits” when assigning a timestamp to DuplicateVoteEvidence. In turn, different nodes could form DuplicateVoteEvidence objects at the same height but with different timestamps. One DuplicateVoteEvidence object (with one timestamp) will then eventually get finalized in the block, but this means that any DuplicateVoteEvidence with a different timestamp is considered invalid. Any node that formed invalid DuplicateVoteEvidence will continue to propose invalid evidence; its peers may see this, and choose to disconnect from this node. This bug means that double signs are DoS vectors in Tendermint Core v0.34.0-v0.34.2. Tendermint Core v0.34.3 is a security release which fixes this bug. As of v0.34.3, DuplicateVoteEvidence is no longer formed by the consensus reactor; rather, the consensus reactor passes the Votes themselves into the EvidencePool, which is now responsible for forming DuplicateVoteEvidence. The EvidencePool has timestamp info that should be consistent across the network, which means that DuplicateVoteEvidence formed in this reactor should have consistent timestamps. This release changes the API between the consensus and evidence reactors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/tendermint/tendermint/blob/v0.34.3/CHANGELOG.md#v0.34.3; https://github.com/tendermint/tendermint/commit/a2a6852ab99e4a0f9e79f0ea8c1726e262e25c76; https://github.com/tendermint/tendermint/security/advisories/GHSA-p658-8693-mhvg
CVE: CVE-2021-21278
Published: 2021-01-26
Description: RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.
CVSS Score: 8.6 (HIGH)
CWE: CWE-74
References: https://github.com/DIYgod/RSSHub/commit/7f1c43094e8a82e4d8f036ff7d42568fed00699d; https://github.com/DIYgod/RSSHub/security/advisories/GHSA-pgjj-866w-fc5c; https://www.npmjs.com/package/rsshub
CVE: CVE-2021-21283
Published: 2021-01-26
Description: Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through the m.trust() helper. This resulted in an HTML injection where <script> tags would not be executed. However it was possible to run javascript from other HTML attributes, enabling a cross-site scripting (XSS) attack to be performed. Since the exploit only happens with the first post of a pinned discussion, an attacker would need the ability to pin their own discussion, or be able to edit a discussion that was previously pinned. On forums where all pinned posts are authored by your staff, you can be relatively certain the vulnerability has not been exploited. Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content history, you cannot be certain if a malicious edit was reverted. The fix will be available in version v0.1.0-beta.16 with Flarum beta 16. The fix has already been back-ported to Flarum beta 15 as version v0.1.0-beta.15.1 of the Sticky extension. Forum administrators can disable the Sticky extension until they are able to apply the update. The vulnerability cannot be exploited while the extension is disabled.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://discuss.flarum.org/d/26042-security-update-to-flarum-sticky-010-beta151%29; https://github.com/flarum/sticky/commit/7ebd30462bd405c4c0570b93a6d48710e6c3db19; https://github.com/flarum/sticky/pull/24
CVE: CVE-2021-26271
Published: 2021-01-26
Description: It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-829
References: https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first; https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416; https://www.oracle.com//security-alerts/cpujul2021.html
CVE: CVE-2021-26272
Published: 2021-01-26
Description: It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-829
References: https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-first; https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416; https://www.oracle.com//security-alerts/cpujul2021.html
CVE: CVE-2021-3156
Published: 2021-01-26
Description: Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193, CWE-193
References: http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html; http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html; http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html
CVE: CVE-2021-3309
Published: 2021-01-26
Description: packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://github.com/wekan/wekan/issues/3482; https://github.com/wekan/wekan/pull/3483/commits/31f89121fecca5a761b05cc3a26d4f237e90b484; https://github.com/wekan/wekan/releases/tag/v4.87
CVE: CVE-2020-23774
Published: 2021-01-26
Description: A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zhonghaozhao/winmail/issues/2; https://github.com/zhonghaozhao/winmail/issues/2
CVE: CVE-2020-23776
Published: 2021-01-26
Description: A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/zhonghaozhao/winmail/issues/3; https://github.com/zhonghaozhao/winmail/issues/3
CVE: CVE-2021-1070
Published: 2021-01-26
Description: NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the apply_binaries.sh script used to install NVIDIA components into the root file system image, in which improper access control is applied, which may lead to an unprivileged user being able to modify system device tree files, leading to denial of service.
CVSS Score: 7.1 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5147; https://nvidia.custhelp.com/app/answers/detail/a_id/5147
CVE: CVE-2021-1071
Published: 2021-01-26
Description: NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains a vulnerability in the INA3221 driver in which improper access control may lead to unauthorized users gaining access to system power usage data, which may lead to information disclosure.
CVSS Score: 5.6 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5147; https://nvidia.custhelp.com/app/answers/detail/a_id/5147
CVE: CVE-2013-2512
Published: 2021-01-26
Description: The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://vapidlabs.com/advisory.php?v=34; http://vapidlabs.com/advisory.php?v=34
CVE: CVE-2021-3165
Published: 2021-01-26
Description: SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://orionhridoy.me; https://packetstormsecurity.com/files/160906/SmartAgent-3.1.0-Privilege-Escalation.html; https://www.smtagent.com/support
CVE: CVE-2021-3317
Published: 2021-01-26
Description: KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/161208/Klog-Server-2.4.1-Command-Injection.html; https://docs.unsafe-inline.com/0day/klog-server-authenticated-command-injection; http://packetstormsecurity.com/files/161208/Klog-Server-2.4.1-Command-Injection.html
CVE: CVE-2021-3272
Published: 2021-01-27
Description: jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/jasper-software/jasper/issues/259; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BZFU2F6UW4L2FJE65WJLWGUIELDWCL7/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HD2Y2LT4N5ZWCMKYCUIKB3XODNJLOW3J/
CVE: CVE-2020-36012
Published: 2021-01-27
Description: Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://bdtask.com; http://multi-store.com; https://kislay00.medium.com/m-store-multi-store-inventory-management-system-add-customer-stored-xss-875a376770ec
CVE: CVE-2020-4628
Published: 2021-01-27
Description: IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185369; https://www.ibm.com/support/pages/node/6408656; https://exchange.xforce.ibmcloud.com/vulnerabilities/185369
CVE: CVE-2020-4815
Published: 2021-01-27
Description: IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189639; https://www.ibm.com/support/pages/node/6408666; https://exchange.xforce.ibmcloud.com/vulnerabilities/189639
CVE: CVE-2020-4816
Published: 2021-01-27
Description: IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 189703.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189703; https://www.ibm.com/support/pages/node/6408658; https://exchange.xforce.ibmcloud.com/vulnerabilities/189703
CVE: CVE-2020-4820
Published: 2021-01-27
Description: IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189783; https://www.ibm.com/support/pages/node/6408664; https://exchange.xforce.ibmcloud.com/vulnerabilities/189783
CVE: CVE-2020-4967
Published: 2021-01-27
Description: IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system. IBM X-Force ID: 192425.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192425; https://www.ibm.com/support/pages/node/6408662; https://exchange.xforce.ibmcloud.com/vulnerabilities/192425
CVE: CVE-2020-16105
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16106
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16107
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16108
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16109
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16110
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16111
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16112
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16113
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16114
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16115
Published: 2021-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-23352
Published: 2021-01-27
Description: Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zb_user/plugin/passwordvisit/include.php:passwordvisit_input_password() uses loose comparison to authenticate, which can be bypassed via magic hash values.
CVSS Score: 7.5 (HIGH)
References: https://github.com/zblogcn/zblogphp/commit/a67607fc984f976d6b36b8870dffaabd9d6c9d5e; https://github.com/zblogcn/zblogphp/commit/a67607fc984f976d6b36b8870dffaabd9d6c9d5e
CVE: CVE-2020-23355
Published: 2021-01-27
Description: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash value 0e234 something can successfully authenticate.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Codiad/Codiad/issues/1121; https://github.com/Codiad/Codiad/issues/1121
CVE: CVE-2020-23356
Published: 2021-01-27
Description: dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
CVSS Score: 7.5 (HIGH)
References: https://github.com/dignajar/nibbleblog/pull/148; https://github.com/dignajar/nibbleblog/pull/148
CVE: CVE-2020-23359
Published: 2021-01-27
Description: WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-identical passwords can still bypass the check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-697
References: https://github.com/renlok/WeBid/issues/530; https://github.com/renlok/WeBid/issues/530
CVE: CVE-2020-23360
Published: 2021-01-27
Description: oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-697
References: https://github.com/osCommerce/oscommerce2/issues/658; https://github.com/osCommerce/oscommerce2/issues/658
CVE: CVE-2020-23361
Published: 2021-01-27
Description: phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/phpList/phplist3/issues/668; https://github.com/phpList/phplist3/issues/668
CVE: CVE-2021-25311
Published: 2021-01-27
Description: condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory, as demonstrated by creating a file under /etc that will later be executed by root.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0002.html; https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0002.html
CVE: CVE-2021-25312
Published: 2021-01-27
Description: HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0001.html; https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0001.html
CVE: CVE-2020-4189
Published: 2021-01-27
Description: IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system. IBM X-Force ID: 174850.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174850; https://www.ibm.com/support/pages/node/6408634; https://exchange.xforce.ibmcloud.com/vulnerabilities/174850
CVE: CVE-2020-4524
Published: 2021-01-27
Description: IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182434.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182434; https://www.ibm.com/support/pages/node/6408694; https://exchange.xforce.ibmcloud.com/vulnerabilities/182434
CVE: CVE-2020-4547
Published: 2021-01-27
Description: IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 183315.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183315; https://www.ibm.com/support/pages/node/6408694; https://exchange.xforce.ibmcloud.com/vulnerabilities/183315
CVE: CVE-2020-4786
Published: 2021-01-27
Description: IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 189221.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189221; https://www.ibm.com/support/pages/node/6408866; https://exchange.xforce.ibmcloud.com/vulnerabilities/189221
CVE: CVE-2020-4787
Published: 2021-01-27
Description: IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 189224.
CVSS Score: 2.3 (LOW)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189224; https://www.ibm.com/support/pages/node/6408864; https://exchange.xforce.ibmcloud.com/vulnerabilities/189224
CVE: CVE-2020-4789
Published: 2021-01-27
Description: IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 189302.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189302; https://www.ibm.com/support/pages/node/6408862; https://exchange.xforce.ibmcloud.com/vulnerabilities/189302
CVE: CVE-2020-4855
Published: 2021-01-27
Description: IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190457.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190457; https://www.ibm.com/support/pages/node/6408694; https://exchange.xforce.ibmcloud.com/vulnerabilities/190457