deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33838
Published: 2021-06-04
Description: Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://github.com/mame82/misc/blob/master/luca_traceIds.md; https://luca-app.de/securityoverview/properties/objectives.html; https://www.ccc.de/de/updates/2021/luca-app-ccc-fordert-bundesnotbremse
CVE: CVE-2021-33839
Published: 2021-06-04
Description: Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/mame82/misc/blob/master/luca_traceIds.md; https://luca-app.de/securityoverview/properties/objectives.html; https://twitter.com/patrick_hennig/status/[PII_REDACTED]57061125
CVE: CVE-2021-33840
Published: 2021-06-04
Description: The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Number data lacks a digital signature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://gitlab.com/lucaapp/web/-/issues/1#note_560963608; https://luca-app.de/securityoverview/processes/guest_registration.html#verifying-the-contact-data; https://gitlab.com/lucaapp/web/-/issues/1#note_560963608
CVE: CVE-2021-3489
Published: 2021-06-04
Description: The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-787
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=4b81ccebaeee885ab1aa1438133f2991e3a2b6ea; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://ubuntu.com/security/notices/USN-4949-1
CVE: CVE-2021-3490
Published: 2021-06-04
Description: The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787, CWE-125, CWE-787
References: http://packetstormsecurity.com/files/164015/Linux-eBPF-ALU32-32-bit-Invalid-Bounds-Tracking-Local-Privilege-Escalation.html; https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-3491
Published: 2021-06-04
Description: The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
CVSS Score: 7.8 (HIGH)
CWE: CWE-131, CWE-787
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1f82808877bb10d3deee7cf3374a4eb3fb582db; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://ubuntu.com/security/notices/USN-4949-1
CVE: CVE-2020-15077
Published: 2021-06-04
Description: OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-305, CWE-287
References: https://openvpn.net/security-advisory/access-server-security-update-cve-2020-15077/; https://openvpn.net/vpn-server-resources/release-notes/; https://openvpn.net/security-advisory/access-server-security-update-cve-2020-15077/
CVE: CVE-2020-36382
Published: 2021-06-04
Description: OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-617
References: https://openvpn.net/security-advisory/access-server-security-update-cve-2020-15077-cve-2020-36382/; https://openvpn.net/vpn-server-resources/release-notes/; https://openvpn.net/security-advisory/access-server-security-update-cve-2020-15077-cve-2020-36382/
CVE: CVE-2021-26994
Published: 2021-06-04
Description: Clustered Data ONTAP versions prior to 9.7P13 and 9.8P3 are susceptible to a vulnerability which could allow single workloads to cause a Denial of Service (DoS) on a cluster node.
CVSS Score: 6.5 (MEDIUM)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/
CVE: CVE-2020-7469
Published: 2021-06-04
Description: In FreeBSD 12.2-STABLE before r367402, 11.4-STABLE before r368202, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 the handler for a routing option caches a pointer into the packet buffer holding the ICMPv6 message. However, when processing subsequent options the packet buffer may be freed, rendering the cached pointer invalid. The network stack may later dereference the pointer, potentially triggering a use-after-free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:31.icmp6.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:31.icmp6.asc
CVE: CVE-2021-3565
Published: 2021-06-04
Description: A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-665, CWE-798
References: https://bugzilla.redhat.com/show_bug.cgi?id=1964427; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ESY6HRYUKR5ZG2K5QAJQC5S6HMKZMFK7/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XK5M7I66PBXSN663TSLAZ3V6TWWFCV7C/
CVE: CVE-2020-27301
Published: 2021-06-04
Description: A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "AES_UnWRAP" function, when an attacker in Wi-Fi range sends a crafted "Encrypted GTK" value as part of the WPA2 4-way-handshake.
CVSS Score: 8.0 (HIGH)
CWE: CWE-787
References: https://www.vdoo.com/blog/realtek-wifi-vulnerabilities-zero-day; https://www.vdoo.com/blog/realtek-wifi-vulnerabilities-zero-day
CVE: CVE-2020-27302
Published: 2021-06-04
Description: A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "memcpy" function, when an attacker in Wi-Fi range sends a crafted "Encrypted GTK" value as part of the WPA2 4-way-handshake.
CVSS Score: 8.0 (HIGH)
CWE: CWE-787
References: https://www.vdoo.com/blog/realtek-wifi-vulnerabilities-zero-day; https://www.vdoo.com/blog/realtek-wifi-vulnerabilities-zero-day
CVE: CVE-2021-22516
Published: 2021-06-04
Description: Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0. The vulnerability could lead to sensitive information being in a log file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://www.microfocus.com/documentation/secure-api-manager/2-0/release-notes-secure-api-manager-201/release-notes-secure-api-manager-201.html; https://www.microfocus.com/documentation/secure-api-manager/2-0/release-notes-secure-api-manager-201/release-notes-secure-api-manager-201.html
CVE: CVE-2021-30475
Published: 2021-06-04
Description: aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://aomedia.googlesource.com/aom/+/12adc723acf02633595a4d8da[PII_REDACTED]f46c0; https://bugs.chromium.org/p/aomedia/issues/detail?id=2999; https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html
CVE: CVE-2021-27657
Published: 2021-06-04
Description: Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01; https://us-cert.gov/ics/advisories; https://www.johnsoncontrols.com/cyber-solutions/security-advisories
CVE: CVE-2021-28091
Published: 2021-06-04
Description: Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: http://listes.entrouvert.com/arc/lasso/; https://git.entrouvert.org/lasso.git/commit/?id=076a37d7f0eb[PII_REDACTED]1da2d355683693cde9; https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0
CVE: CVE-2021-33054
Published: 2021-06-04
Description: SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html; https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md; https://lists.debian.org/debian-lts-announce/2021/07/msg00007.html
CVE: CVE-2020-36139
Published: 2021-06-04
Description: BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the 'fileurl' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html; https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html
CVE: CVE-2020-36140
Published: 2021-06-04
Description: BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content (Locally/Remotely).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html; https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html
CVE: CVE-2020-36141
Published: 2021-06-04
Description: BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html; https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html
CVE: CVE-2020-36142
Published: 2021-06-04
Description: BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html; https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html
CVE: CVE-2021-1502
Published: 2021-06-04
Description: A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. The vulnerability is due to insufficient validation of values within Webex recording files formatted as either Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit the vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-dOJ2jOJ; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-dOJ2jOJ
CVE: CVE-2021-1503
Published: 2021-06-04
Description: A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. This vulnerability is due to insufficient validation of values in Webex recording files that are in either Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-rCFDeVj2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-rCFDeVj2
CVE: CVE-2021-1517
Published: 2021-06-04
Description: A vulnerability in the multimedia viewer feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to bypass security protections. This vulnerability is due to unsafe handling of shared content within the multimedia viewer feature. An attacker could exploit this vulnerability by sharing a file through the multimedia viewer feature. A successful exploit could allow the attacker to bypass security protections and prevent warning dialogs from appearing before files are offered to other users.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-693
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-multimedia-26DpqVRO; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-multimedia-26DpqVRO
CVE: CVE-2021-1525
Published: 2021-06-04
Description: A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attacker could exploit this vulnerability by persuading a user to follow a specially crafted URL that is designed to cause Cisco Webex Meetings to include a remote file in the web UI. A successful exploit could allow the attacker to cause the application to offer a remote file to a user, which could allow the attacker to conduct further phishing or spoofing attacks.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-redirect-XuZFU3PH; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-redirect-XuZFU3PH
CVE: CVE-2021-1526
Published: 2021-06-04
Description: A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. This vulnerability is due to insufficient validation of values in Webex recording files that are in Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-kOf8zVT; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-kOf8zVT
CVE: CVE-2021-1527
Published: 2021-06-04
Description: A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to cause the affected software to terminate or to gain access to memory state information that is related to the vulnerable application. The vulnerability is due to insufficient validation of values in Webex recording files that are stored in Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a malicious WRF file to a user as a link or email attachment and then persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to crash the affected software and view memory state information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-kxtkFbnR; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-kxtkFbnR
CVE: CVE-2021-1528
Published: 2021-06-04
Description: A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access to privileged processes. An attacker could exploit this vulnerability by invoking a privileged process in the affected system. A successful exploit could allow the attacker to perform actions with the privileges of the root user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-fuErCWwF; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-fuErCWwF
CVE: CVE-2021-1536
Published: 2021-06-04
Description: A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system, which can cause a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of another user account.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-427
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-dll-inject-XNmcSGTU; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-dll-inject-XNmcSGTU
CVE: CVE-2021-1537
Published: 2021-06-04
Description: A vulnerability in the installer software of Cisco ThousandEyes Recorder could allow an unauthenticated, local attacker to access sensitive information that is contained in the ThousandEyes Recorder installer software. This vulnerability exists because sensitive information is included in the application installer. An attacker could exploit this vulnerability by downloading the installer and extracting its contents. A successful exploit could allow the attacker to access sensitive information that is included in the application installer.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-522
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-recorder-infodis-mx3ETTBM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-recorder-infodis-mx3ETTBM
CVE: CVE-2021-1538
Published: 2021-06-04
Description: A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to execute arbitrary code. This vulnerability is due to insufficient sanitization of configuration entries. An attacker could exploit this vulnerability by logging in as a super admin and entering crafted input to configuration options on the CSPC configuration dashboard. A successful exploit could allow the attacker to execute remote code as root.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-CIV-kDuBfNfu; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-CIV-kDuBfNfu
CVE: CVE-2021-1539
Published: 2021-06-04
Description: Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr5k-autho-bypass-mJDF5S7n; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr5k-autho-bypass-mJDF5S7n
CVE: CVE-2021-1540
Published: 2021-06-04
Description: Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr5k-autho-bypass-mJDF5S7n; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr5k-autho-bypass-mJDF5S7n
CVE: CVE-2021-1544
Published: 2021-06-04
Description: A vulnerability in logging mechanisms of Cisco Webex Meetings client software could allow an authenticated, local attacker to gain access to sensitive information. This vulnerability is due to unsafe logging of application actions. An attacker could exploit this vulnerability by logging onto the local system and accessing files containing the logged details. A successful exploit could allow the attacker to gain access to sensitive information, including meeting data and recorded meeting transcriptions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-497
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-8fpBnKOz; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-8fpBnKOz