deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-4765
Published: 2021-05-19
Description: IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188902.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188902; https://www.ibm.com/support/pages/node/6454019; https://exchange.xforce.ibmcloud.com/vulnerabilities/188902
CVE: CVE-2021-20374
Published: 2021-05-19
Description: IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195522.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195522; https://www.ibm.com/support/pages/node/6454205; https://exchange.xforce.ibmcloud.com/vulnerabilities/195522
CVE: CVE-2021-20528
Published: 2021-05-19
Description: IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198761.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198761; https://www.ibm.com/support/pages/node/6454215; https://exchange.xforce.ibmcloud.com/vulnerabilities/198761
CVE: CVE-2021-20529
Published: 2021-05-19
Description: IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID: 198763.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198763; https://www.ibm.com/support/pages/node/6454209; https://exchange.xforce.ibmcloud.com/vulnerabilities/198763
CVE: CVE-2021-27924
Published: 2021-05-19
Description: An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the impersonation of a user if the log files are obtained by an attacker before a session cookie expires.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.couchbase.com/downloads; https://www.couchbase.com/resources/security#SecurityAlerts; https://www.couchbase.com/downloads
CVE: CVE-2021-29503
Published: 2021-05-19
Description: HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section of the note, resulting in the frontend rendering the script tag as part of the `<head>` section. Unless your instance prevents guests from editing notes, this vulnerability allows unauthenticated attackers to inject JavaScript into notes that allow guest edits. If your instance prevents guests from editing notes, this vulnerability allows authenticated attackers to inject JavaScript into any note pages they have write-access to. This vulnerability is patched in version 1.8.2. As a workaround, one can disable guest edits until the next update.
CVSS Score: 8.1 (HIGH)
CWE: CWE-80, CWE-79
References: https://github.com/hedgedoc/hedgedoc/commit/01dad5821ee28377ebe640c6c72c3e0bb0d51ea7; https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2; https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gjg7-4j2h-94fq
CVE: CVE-2021-29622
Published: 2021-05-19
Description: Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601
References: https://github.com/prometheus/prometheus/releases/tag/v2.26.1; https://github.com/prometheus/prometheus/releases/tag/v2.27.1; https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7
CVE: CVE-2021-29624
Published: 2021-05-19
Description: fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-565, CWE-352
References: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html; https://github.com/fastify/csrf/pull/2; https://github.com/fastify/fastify-csrf/pull/51
CVE: CVE-2021-29625
Published: 2021-05-19
Description: Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/vrana/adminer/commit/4043092ec2c0de2258d60a99d0c5958637d051a7; https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc; https://sourceforge.net/p/adminer/bugs-and-features/797/
CVE: CVE-2021-20718
Published: 2021-05-20
Description: mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/zmartzone/mod_auth_openidc; https://jvn.jp/en/jp/JVN49704918/index.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HJK366TLFEOIYWTHQSZO24MSDPBXHJU/
CVE: CVE-2021-20719
Published: 2021-05-20
Description: RFNTPS firmware versions System_01000004 and earlier, and Web_01000004 and earlier allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN13076220/index.html; https://www.nippon-antenna.co.jp/ja/news/news/news[PII_REDACTED]390204428.html; https://jvn.jp/en/jp/JVN13076220/index.html
CVE: CVE-2021-20720
Published: 2021-05-20
Description: SQL injection vulnerability in the KonaWiki2 versions prior to 2.2.4 allows remote attackers to execute arbitrary SQL commands and to obtain/alter the information stored in the database via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://jvn.jp/en/jp/JVN34232719/index.html; https://kujirahand.com/konawiki/; https://jvn.jp/en/jp/JVN34232719/index.html
CVE: CVE-2021-20721
Published: 2021-05-20
Description: KonaWiki2 versions prior to 2.2.4 allows a remote attacker to upload arbitrary files via unspecified vectors. If the file contains PHP scripts, arbitrary code may be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://jvn.jp/en/jp/JVN34232719/index.html; https://kujirahand.com/konawiki/; https://jvn.jp/en/jp/JVN34232719/index.html
CVE: CVE-2020-15522
Published: 2021-05-20
Description: Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://github.com/bcgit/bc-csharp/wiki/CVE-2020-15522; https://github.com/bcgit/bc-java/wiki/CVE-2020-15522; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-27457
Published: 2021-05-20
Description: A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for storage of sensitive data, which may allow an attacker to more easily obtain credentials used for access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-327
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01
CVE: CVE-2021-27459
Published: 2021-05-20
Description: A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The webserver of the affected products allows unvalidated files to be uploaded, which an attacker could utilize to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01
CVE: CVE-2021-27461
Published: 2021-05-20
Description: A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected webserver applications allow access to stored data that can be obtained by using specially crafted URLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01
CVE: CVE-2021-27463
Published: 2021-05-20
Description: A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications utilize persistent cookies where the session cookie attribute is not properly invalidated, allowing an attacker to intercept the cookies and gain access to sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-539
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01
CVE: CVE-2021-27465
Published: 2021-05-20
Description: A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications do not validate webpage input, which could allow an attacker to inject arbitrary HTML code into a webpage. This would allow an attacker to modify the page and display incorrect or undesirable data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01
CVE: CVE-2021-27467
Published: 2021-05-20
Description: A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s web interface allows an attacker to route click or keystroke to another page provided by the attacker to gain unauthorized access to sensitive information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01
CVE: CVE-2021-29659
Published: 2021-05-20
Description: ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could cause higher than average load on the instance.
CVSS Score: 6.5 (MEDIUM)
References: https://doc.owncloud.com/server/admin_manual/release_notes.html; https://owncloud.com/security-advisories/cve-2021-29659/; https://doc.owncloud.com/server/admin_manual/release_notes.html
CVE: CVE-2021-3426
Published: 2021-05-20
Description: There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200, CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=1935913; https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html; https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
CVE: CVE-2021-3480
Published: 2021-05-20
Description: A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1944640; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVQCDRQRFHXVR3Z3FQYM3UMC7QZUDDRJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXMOMPTZTGOVFOZUUNXHOVCAYIPST74W/
CVE: CVE-2021-3536
Published: 2021-05-20
Description: A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1948001; https://bugzilla.redhat.com/show_bug.cgi?id=1948001
CVE: CVE-2020-24395
Published: 2021-05-20
Description: The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-026.txt; https://www.syss.de/pentest-blog/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-026.txt
CVE: CVE-2020-24396
Published: 2021-05-20
Description: homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to use the support server as a SOCKS proxy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://cwe.mitre.org/data/definitions/522.html; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-027.txt; https://www.syss.de/pentest-blog/
CVE: CVE-2021-25930
Published: 2021-05-20
Description: In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84; https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25930
CVE: CVE-2021-27434
Published: 2021-05-20
Description: Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vulnerable to an uncontrolled recursion, which may allow an attacker to trigger a stack overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-674
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-133-04; https://us-cert.cisa.gov/ics/advisories/icsa-21-133-04
CVE: CVE-2021-28111
Published: 2021-05-20
Description: Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://static.draeger.com/security; https://static.draeger.com/security/download/PSA-21-120-1-X-Dock-Product-Security-Advisory.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-604/
CVE: CVE-2021-28112
Published: 2021-05-20
Description: Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an authenticated attacker.
CVSS Score: 8.8 (HIGH)
References: https://static.draeger.com/security; https://static.draeger.com/security/download/PSA-21-120-1-X-Dock-Product-Security-Advisory.pdf; https://static.draeger.com/security
CVE: CVE-2021-3438
Published: 2021-05-20
Description: A potential buffer overflow in the software drivers for certain HP LaserJet products and Samsung product printers could lead to an escalation of privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hp.com/us-en/document/ish_3[PII_REDACTED]905-16; https://support.hp.com/us-en/document/ish_3[PII_REDACTED]905-16
CVE: CVE-2020-21053
Published: 2021-05-20
Description: Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "query_string" variable in app\devices\device_imports.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fusionpbx/fusionpbx/commit/2ce613f1e9fe8ffab7a4cb9d[PII_REDACTED]85335; https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-xss-22/; https://github.com/fusionpbx/fusionpbx/commit/2ce613f1e9fe8ffab7a4cb9d[PII_REDACTED]85335
CVE: CVE-2020-4850
Published: 2021-05-20
Description: IBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote attacker to obtain sensitive information, caused by the leftover files after configuration. IBM X-Force ID: 190298.
CVSS Score: 7.5 (HIGH)
CWE: CWE-116
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190298; https://www.ibm.com/support/pages/node/6454787; https://exchange.xforce.ibmcloud.com/vulnerabilities/190298
CVE: CVE-2021-25929
Published: 2021-05-20
Description: In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/OpenNMS/opennms/commit/66c1f626bf38a7d1a9530b4d68598269ee5245a2; https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25929
CVE: CVE-2021-25931
Published: 2021-05-20
Description: In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84; https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25931
CVE: CVE-2021-25933
Published: 2021-05-20
Description: In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01%2C; https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c; https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10e
CVE: CVE-2021-29682
Published: 2021-05-20
Description: IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199997
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199997; https://www.ibm.com/support/pages/node/6454587; https://exchange.xforce.ibmcloud.com/vulnerabilities/199997
CVE: CVE-2021-29683
Published: 2021-05-20
Description: IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 199998.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199998; https://www.ibm.com/support/pages/node/6454587; https://exchange.xforce.ibmcloud.com/vulnerabilities/199998
CVE: CVE-2021-29686
Published: 2021-05-20
Description: IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have access to. IBM X-Force ID: 200015
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200015; https://www.ibm.com/support/pages/node/6454587; https://exchange.xforce.ibmcloud.com/vulnerabilities/200015
CVE: CVE-2021-29687
Published: 2021-05-20
Description: IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 200018
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200018; https://www.ibm.com/support/pages/node/6454605; https://exchange.xforce.ibmcloud.com/vulnerabilities/200018
CVE: CVE-2021-29688
Published: 2021-05-20
Description: IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 200102.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200102; https://www.ibm.com/support/pages/node/6454587; https://www.ibm.com/support/pages/node/6454605