deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-30540
Published: 2021-06-07
Description: Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1184147; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30542
Published: 2021-06-07
Description: Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1184954; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2021-30543
Published: 2021-06-07
Description: Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html; https://crbug.com/1203607; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/
CVE: CVE-2020-1750
Published: 2021-06-07
Description: A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An attacker could use this flaw to deny access to schedule new pods in the OpenShift cluster. This was fixed in openshift/machine-config-operator 4.4.3, openshift/machine-config-operator 4.3.25, openshift/machine-config-operator 4.2.36.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1808130; https://bugzilla.redhat.com/show_bug.cgi?id=1808130
CVE: CVE-2020-25716
Published: 2021-06-07
Description: A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-10783. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before cfme 5.11.10.1 are affected
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: https://bugzilla.redhat.com/show_bug.cgi?id=1898525; https://bugzilla.redhat.com/show_bug.cgi?id=1898525
CVE: CVE-2021-20259
Published: 2021-06-07
Description: A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions before foreman_fog_proxmox 0.13.1 are affected
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1932144; https://bugzilla.redhat.com/show_bug.cgi?id=1932144
CVE: CVE-2021-23391
Published: 2021-06-07
Description: This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://github.com/cliftonc/calipso; https://snyk.io/vuln/SNYK-JS-CALIPSO-1300555; https://github.com/cliftonc/calipso
CVE: CVE-2021-29504
Published: 2021-06-07
Description: WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-295
References: https://github.com/wp-cli/checksum-command/pull/86; https://github.com/wp-cli/config-command/pull/128; https://github.com/wp-cli/core-command/pull/186
CVE: CVE-2021-32670
Published: 2021-06-07
Description: Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://datasette.io/plugins/datasette-auth-passwords; https://github.com/simonw/datasette/issues/1360; https://github.com/simonw/datasette/security/advisories/GHSA-xw7c-jx9m-xh5g
CVE: CVE-2021-32671
Published: 2021-06-07
Description: Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 (our last beta before v1.0.0) and was not noticed or documented. This allowed for any user to type malicious HTML markup within certain user input fields and have this execute on client browsers. The example which led to the discovery of this vulnerability was in the forum search box. Entering faux-malicious HTML markup, such as <script>alert('test')</script> resulted in an alert box appearing on the forum. This attack could also be modified to perform AJAX requests on behalf of a user, possibly deleting discussions, modifying their settings or profile, or even modifying settings on the Admin panel if the attack was targetted towards a privileged user. All Flarum communities that run flarum v1.0.0 or v1.0.1 are impacted. The vulnerability has been fixed and published as flarum/core v1.0.2. All communities running Flarum v1.0 have to upgrade as soon as possible to v1.0.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/flarum/core/commit/440bed81b8019dff00642c8f493b4909d505a28a; https://github.com/flarum/core/security/advisories/GHSA-5qjq-69w6-fg57; https://packagist.org/packages/flarum/core
CVE: CVE-2021-3277
Published: 2021-06-07
Description: Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://asaf.me/2021/01/21/nagios-xi-5-7-5-remote-code-execution/; https://asaf.me/2021/01/21/nagios-xi-5-7-5-remote-code-execution/
CVE: CVE-2021-26078
Published: 2021-06-07
Description: The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163289/Atlassian-Jira-Server-Data-Center-8.16.0-Cross-Site-Scripting.html; https://jira.atlassian.com/browse/JRASERVER-72392; http://packetstormsecurity.com/files/163289/Atlassian-Jira-Server-Data-Center-8.16.0-Cross-Site-Scripting.html
CVE: CVE-2021-26079
Published: 2021-06-07
Description: The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72396; https://jira.atlassian.com/browse/JRASERVER-72396
CVE: CVE-2021-26080
Published: 2021-06-07
Description: EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72432; https://jira.atlassian.com/browse/JRASERVER-72432
CVE: CVE-2021-28810
Published: 2021-06-08
Description: If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-17; https://www.qnap.com/zh-tw/security-advisory/qsa-21-17
CVE: CVE-2021-28811
Published: 2021-06-08
Description: If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-77
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-17; https://www.qnap.com/zh-tw/security-advisory/qsa-21-17
CVE: CVE-2021-23392
Published: 2021-06-08
Description: The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/locutusjs/locutus/commit/eb863321990e7e5514aa14f68b8d9978ece9e65e; https://github.com/locutusjs/locutus/pull/446; https://snyk.io/vuln/SNYK-JS-LOCUTUS-1090597
CVE: CVE-2021-31738
Published: 2021-06-08
Description: Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-024.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-024.txt
CVE: CVE-2021-33560
Published: 2021-06-08
Description: Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203, CWE-325
References: https://dev.gnupg.org/T5305; https://dev.gnupg.org/T5328; https://dev.gnupg.org/T5466
CVE: CVE-2021-22116
Published: 2021-06-08
Description: RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html; https://tanzu.vmware.com/security/cve-2021-22116; https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
CVE: CVE-2021-23169
Published: 2021-06-08
Description: A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947612; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KYNJSMVA6YJY5NMKDZ5SAISKZG2KCKC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXFLD4ZAXKAIWO6ZPBCQEEDZB5IG676K/
CVE: CVE-2021-23215
Published: 2021-06-08
Description: An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947586; https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE: CVE-2021-26260
Published: 2021-06-08
Description: An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947582; https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE: CVE-2021-26945
Published: 2021-06-08
Description: An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947591; https://bugzilla.redhat.com/show_bug.cgi?id=1947591
CVE: CVE-2021-3564
Published: 2021-06-08
Description: A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415, CWE-415
References: http://www.openwall.com/lists/oss-security/2021/05/25/1; http://www.openwall.com/lists/oss-security/2021/06/01/2; https://bugzilla.redhat.com/show_bug.cgi?id=1964139
CVE: CVE-2020-26515
Published: 2021-06-08
Description: An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the application contains the encrypted user's credentials. However, due to a bug in the application code, those credentials are encrypted using a NULL encryption key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-522
References: https://intland.com/codebeamer/application-lifecycle-management/; https://www.compass-security.com/fileadmin/Research/Advisories/2021-09_CSNC-2020-010-codebeamer_ALM_Insecure-RememberMe.txt; https://intland.com/codebeamer/application-lifecycle-management/
CVE: CVE-2020-26516
Published: 2021-06-08
Description: A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and can therefore be entirely predicted allowing attackers to cause the victim's browser to execute undesired actions in the web application through crafted requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://intland.com/codebeamer/application-lifecycle-management/; https://www.compass-security.com/fileadmin/Research/Advisories/2021-08_CSNC-2020-009-codebeamer_ALM_Missing-CSRF.txt; https://intland.com/codebeamer/application-lifecycle-management/
CVE: CVE-2020-26517
Published: 2021-06-08
Description: A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project (Authn users), using the users import functionality (Admin only), and changing the login text in the application configuration (Admin only).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://intland.com/codebeamer/application-lifecycle-management/; https://www.compass-security.com/fileadmin/Research/Advisories/2021-10_CSNC-2020-012-codebeamer_ALM_XSS.txt; https://intland.com/codebeamer/application-lifecycle-management/
CVE: CVE-2021-22212
Published: 2021-06-08
Description: ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the '#'. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-327
References: https://bugzilla.redhat.com/show_bug.cgi?id=1955859; https://gitlab.com/NTPsec/ntpsec/-/issues/699; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22212.json
CVE: CVE-2021-32106
Published: 2021-06-08
Description: In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/icecoder/ICEcoder; https://groups.google.com/g/icecoder/c/xcAc8_1UPxQ; https://prophaze.com/cve/icecoder-8-0-multipe-results-php-replace-cross-site-scripting/
CVE: CVE-2021-22548
Published: 2021-06-08
Description: An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter is later copied out, it allows for reading of memory regions from the trusted region. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-788
References: https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c; https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
CVE: CVE-2021-22549
Published: 2021-06-08
Description: An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-823, CWE-668
References: https://github.com/google/asylo/commit/ecfcd0008b6f8f63c6fa3cc1b62fcd4a52f2c0ad; https://github.com/google/asylo/commit/ecfcd0008b6f8f63c6fa3cc1b62fcd4a52f2c0ad
CVE: CVE-2021-22550
Published: 2021-06-08
Description: An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-823, CWE-668
References: https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c; https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c
CVE: CVE-2021-30357
Published: 2021-06-08
Description: SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://supportcontent.checkpoint.com/solutions?id=sk173513; https://supportcontent.checkpoint.com/solutions?id=sk173513
CVE: CVE-2021-22214
Published: 2021-06-08
Description: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22214.json; https://gitlab.com/gitlab-org/gitlab/-/issues/322926; https://hackerone.com/reports/1110131
CVE: CVE-2021-33175
Published: 2021-06-08
Description: EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs. These inputs cause the message broker to consume large amounts of memory, resulting in the application being terminated by the operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-770
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-rabbitmq-emqx-vernemq; https://www.synopsys.com/blogs/software-security/cyrc-advisory-rabbitmq-emqx-vernemq
CVE: CVE-2021-33176
Published: 2021-06-08
Description: VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs. These inputs cause the message broker to consume large amounts of memory, resulting in the application being terminated by the operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-770
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-rabbitmq-emqx-vernemq; https://www.synopsys.com/blogs/software-security/cyrc-advisory-rabbitmq-emqx-vernemq
CVE: CVE-2021-33190
Published: 2021-06-08
Description: In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limit. At the same time, the default account and password are fixed.Ultimately these factors lead to the issue of security risks. This issue is fixed in APISIX Dashboard 2.6.1
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: http://www.openwall.com/lists/oss-security/2021/06/08/4; https://lists.apache.org/thread.html/re736aea55e8fd2478f0739c0c38a9375c4204fc1f0bd1ea687f57049%40%3Cdev.apisix.apache.org%3E; https://lists.apache.org/thread.html/re736aea55e8fd2478f0739c0c38a9375c4204fc1f0bd1ea687f57049%40%3Cdev.apisix.apache.org%3E
CVE: CVE-2021-34280
Published: 2021-06-08
Description: Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a Remote Code Execution. To exploit the vulnerability, someone must open a crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://github.com/dlehgus1023/CVE/tree/master/CVE-2021-34280; https://github.com/dlehgus1023/CVE/tree/master/CVE-2021-34280