deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-25142
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webstartflash function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-25834
Published: 2021-02-08
Description: Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294
References: https://github.com/cosmos/ethermint/issues/686; https://github.com/cosmos/ethermint/issues/686
CVE: CVE-2021-25835
Published: 2021-02-08
Description: Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg content and chainIDEpoch, which enables "cross-chain transaction replay" attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294
References: https://github.com/cosmos/ethermint/issues/687; https://github.com/cosmos/ethermint/pull/692; https://github.com/cosmos/ethermint/issues/687
CVE: CVE-2021-25836
Published: 2021-02-08
Description: Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. The bytecode set in a FAILED transaction wrongfully remains in memory(stateObject.code) and is further written to persistent store at the Endblock stage, which may be utilized to build honeypot contracts.
CVSS Score: 7.5 (HIGH)
References: https://github.com/cosmos/ethermint/issues/667#issuecomment-759284303; https://github.com/cosmos/ethermint/issues/667#issuecomment-759284303
CVE: CVE-2021-25837
Published: 2021-02-08
Description: Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cache data will be discarded at EndBlock, it is still valid in the current block, which enables many possible attacks such as an "arbitrary mint token".
CVSS Score: 7.5 (HIGH)
References: https://github.com/cosmos/ethermint/issues/667#issuecomment-759284107; https://github.com/cosmos/ethermint/issues/667#issuecomment-759284107
CVE: CVE-2020-7782
Published: 2021-02-08
Description: This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/krzysztof-o/spritesheet.js/blob/master/lib/generator.js%23L32; https://snyk.io/vuln/SNYK-JS-SPRITESHEETJS-1048333; https://www.npmjs.com/package/spritesheet-js
CVE: CVE-2020-7785
Published: 2021-02-08
Description: This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/fortruce/node-ps/blob/master/lib/index.js%23L72; https://snyk.io/vuln/SNYK-JS-NODEPS-1048335; https://www.npmjs.com/package/node-ps
CVE: CVE-2020-7786
Published: 2021-02-08
Description: This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-MACFROMIP-1048336; https://www.npmjs.com/package/macfromip; https://snyk.io/vuln/SNYK-JS-MACFROMIP-1048336
CVE: CVE-2021-25168
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webupdatecomponent function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-25169
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetservicecfg function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-25170
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetremoteimageinfo function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-25171
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetlicensecfg function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-26570
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webifc_setadconfig function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://www.zerodayinitiative.com/advisories/ZDI-21-340/; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-26571
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-26572
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-21240
Published: 2021-02-08
Description: httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/httplib2/httplib2/commit/bd9ee252c8f[PII_REDACTED]09e22c0d705e98d26bc; https://github.com/httplib2/httplib2/pull/182; https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m
CVE: CVE-2021-21288
Published: 2021-02-08
Description: CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08; https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08; https://github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa025831caa304d1a665c0
CVE: CVE-2021-21290
Published: 2021-02-08
Description: Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-378, CWE-379, CWE-668
References: https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec; https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2; https://lists.apache.org/thread.html/r0053443ce19ff125981559f8c51cf66e3ab4350f47812b8cf0733a05%40%3Cdev.kafka.apache.org%3E
CVE: CVE-2021-21305
Published: 2021-02-08
Description: CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.
CVSS Score: 7.4 (HIGH)
CWE: CWE-74, CWE-94
References: https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08; https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08; https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7
CVE: CVE-2021-25172
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so websetdefaultlangcfg function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-26573
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgeneratesslcfg function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-26574
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletevideofile function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-26575
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletesolvideofile function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-26577
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so uploadsshkey function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2021-26905
Published: 2021-02-08
Description: 1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://app-updates.agilebits.com/product_history/SCIM; https://support.1password.com/kb/202102/; https://app-updates.agilebits.com/product_history/SCIM
CVE: CVE-2021-26910
Published: 2021-02-08
Description: Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: http://www.openwall.com/lists/oss-security/2021/02/09/1; https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d[PII_REDACTED]b; https://github.com/netblue30/firejail/releases/tag/0.9.64.4
CVE: CVE-2020-24944
Published: 2021-02-08
Description: picoquic (before 3rd of July 2020) allows attackers to cause a denial of service (infinite loop) via a crafted QUIC frame, related to the picoquic_decode_frames and picoquic_decode_stream_frame functions and epoch==3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/private-octopus/picoquic/issues/969; https://github.com/private-octopus/picoquic/issues/969
CVE: CVE-2020-36148
Published: 2021-02-08
Description: Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/hoene/libmysofa/issues/138; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/; https://github.com/hoene/libmysofa/issues/138
CVE: CVE-2020-36149
Published: 2021-02-08
Description: Incorrect handling of input data in changeAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/hoene/libmysofa/issues/137; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/; https://github.com/hoene/libmysofa/issues/137
CVE: CVE-2020-36150
Published: 2021-02-08
Description: Incorrect handling of input data in loudness function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and access to unallocated memory block.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/hoene/libmysofa/issues/135; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/; https://github.com/hoene/libmysofa/issues/135
CVE: CVE-2020-36151
Published: 2021-02-08
Description: Incorrect handling of input data in mysofa_resampler_reset_mem function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and overwriting large memory block.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/hoene/libmysofa/issues/134; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/; https://github.com/hoene/libmysofa/issues/134
CVE: CVE-2020-36152
Published: 2021-02-08
Description: Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/hoene/libmysofa/issues/136; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/; https://github.com/hoene/libmysofa/issues/136
CVE: CVE-2021-26220
Published: 2021-02-08
Description: The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://sourceforge.net/p/ezxml/bugs/23/; https://sourceforge.net/p/ezxml/bugs/23/
CVE: CVE-2021-26221
Published: 2021-02-08
Description: The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://sourceforge.net/p/ezxml/bugs/21/; https://sourceforge.net/p/ezxml/bugs/21/
CVE: CVE-2021-26222
Published: 2021-02-08
Description: The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://sourceforge.net/p/ezxml/bugs/22/; https://sourceforge.net/p/ezxml/bugs/22/
CVE: CVE-2021-26528
Published: 2021-02-08
Description: The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://github.com/cesanta/mongoose/issues/1201; https://github.com/cesanta/mongoose/issues/1201
CVE: CVE-2021-26529
Published: 2021-02-08
Description: The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://github.com/cesanta/mongoose/issues/1203; https://github.com/cesanta/mongoose/issues/1203
CVE: CVE-2021-26530
Published: 2021-02-08
Description: The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://github.com/cesanta/mongoose/issues/1204; https://github.com/cesanta/mongoose/issues/1204
CVE: CVE-2021-26576
Published: 2021-02-08
Description: The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so uploadsshkey function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
CVE: CVE-2020-13947
Published: 2021-02-08
Description: An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://activemq.apache.org/security-advisories.data/CVE-2020-13947-announcement.txt; https://lists.apache.org/thread.html/r021c490028f61c8b6f7e38efb98e61693b0cbb6b99b02238c6fc7d66%40%3Ccommits.activemq.apache.org%3E; https://lists.apache.org/thread.html/ra66791f1f2b59fa651a81cec5202acdfbf34c2154fc0ff200301cc1c%40%3Cdev.activemq.apache.org%3E
CVE: CVE-2020-8578
Published: 2021-02-08
Description: Clustered Data ONTAP versions prior to 9.3P20 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSupport bundles even when the –remove-private-data parameter is set to true.
CVSS Score: 3.3 (LOW)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/
CVE: CVE-2020-8587
Published: 2021-02-08
Description: OnCommand System Manager 9.x versions prior to 9.3P20 and 9.4 prior to 9.4P3 are susceptible to a vulnerability that could allow HTTP clients to cache sensitive responses making them accessible to an attacker who has access to the system where the client runs.
CVSS Score: 5.5 (MEDIUM)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/
CVE: CVE-2020-8590
Published: 2021-02-08
Description: Clustered Data ONTAP versions prior to 9.1P18 and 9.3P12 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSupport bundles even when the –remove-private-data parameter is set to true.
CVSS Score: 3.3 (LOW)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/
CVE: CVE-2021-21306
Published: 2021-02-08
Description: Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is fixed in version 2.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/markedjs/marked/commit/7293251c438e3ee968970f7609f1a27f9007bccd; https://github.com/markedjs/marked/issues/1927; https://github.com/markedjs/marked/pull/1864
CVE: CVE-2021-22502
Published: 2021-02-08
Description: Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html; https://softwaresupport.softwaregrp.com/doc/KM03775947; https://www.zerodayinitiative.com/advisories/ZDI-21-153/
CVE: CVE-2021-25913
Published: 2021-02-08
Description: Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/IonicaBizau/set-or-get.js/commit/82ede5cccb2e8d13e4f62599203a4389f6d8e936; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25913; https://github.com/IonicaBizau/set-or-get.js/commit/82ede5cccb2e8d13e4f62599203a4389f6d8e936