deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-25022
Published: 2021-02-27
Description: An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a payload over an event alias, because the application calls Runtime.getRuntime().exec() without validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://suid.ch/research/CVE-2019-25022.html; https://suid.ch/research/CVE-2019-25022.html
CVE: CVE-2019-25023
Published: 2021-02-27
Description: An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is used for the internal application logs, an attacker can inject wrong IP addresses into these logs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://suid.ch/research/CVE-2019-25023.html; https://suid.ch/research/CVE-2019-25023.html
CVE: CVE-2020-28243
Published: 2021-02-27
Description: An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://github.com/stealthcopter/CVE-2020-28243; https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html; https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
CVE: CVE-2020-28972
Published: 2021-02-27
Description: In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
CVE: CVE-2020-35662
Published: 2021-02-27
Description: In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
CVE: CVE-2021-25281
Published: 2021-02-27
Description: An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/162058/SaltStack-Salt-API-Unauthenticated-Remote-Command-Execution.html; https://github.com/saltstack/salt/releases; https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
CVE: CVE-2021-25282
Published: 2021-02-27
Description: An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.com/files/162058/SaltStack-Salt-API-Unauthenticated-Remote-Command-Execution.html; https://github.com/saltstack/salt/releases; https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
CVE: CVE-2021-25283
Published: 2021-02-27
Description: An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/saltstack/salt/releases; https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
CVE: CVE-2021-25284
Published: 2021-02-27
Description: An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522, CWE-532
References: https://github.com/saltstack/salt/releases; https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html; https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
CVE: CVE-2021-3144
Published: 2021-02-27
Description: In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-613
References: https://github.com/saltstack/salt/releases; https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
CVE: CVE-2021-3148
Published: 2021-02-27
Description: An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/saltstack/salt/releases; https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
CVE: CVE-2021-3151
Published: 2021-02-27
Description: i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__MONITORING__CONFIG__ADDRESS, or SM2__C__MONITORING__CONFIG__ADDRESS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162815/i-doit-1.15.2-Cross-Site-Scripting.html; https://www.i-doit.org/news/; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-056
CVE: CVE-2021-3197
Published: 2021-02-27
Description: An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/saltstack/salt/releases; https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html; https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
CVE: CVE-2021-27132
Published: 2021-02-27
Description: SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://sercomm.com; https://cybertuz.com/blog/post/crlf-injection-CVE-2021-27132; http://sercomm.com
CVE: CVE-2021-27225
Published: 2021-03-01
Description: In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite notebooks in projects that they are not authorized to access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://doc.dataiku.com/dss/8.0/security/advisories/cve-2021-27225.html; https://doc.dataiku.com/dss/latest/; https://doc.dataiku.com/dss/8.0/security/advisories/cve-2021-27225.html
CVE: CVE-2021-25122
Published: 2021-03-01
Description: When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: http://www.openwall.com/lists/oss-security/2021/03/01/1; https://lists.apache.org/thread.html/r7b95bc[PII_REDACTED]01f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/r7b95bc[PII_REDACTED]01f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
CVE: CVE-2021-25329
Published: 2021-03-01
Description: The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
CVSS Score: 7.0 (HIGH)
References: http://www.openwall.com/lists/oss-security/2021/03/01/2; https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E; https://lists.apache.org/thread.html/r732b2ca289dc02df2de820e8775559abd6c207f159e39f559547a085%40%3Cusers.tomcat.apache.org%3E
CVE: CVE-2020-7929
Published: 2021-03-01
Description: A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-185
References: https://jira.mongodb.org/browse/SERVER-51083; https://jira.mongodb.org/browse/SERVER-51083
CVE: CVE-2020-9479
Published: 2021-03-01
Description: When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://lists.apache.org/thread.html/r4cc9cc9c54573babf821c31d5d410fb260d1cd416dc1b225d587be9b%40%3Cdev.asterixdb.apache.org%3E; https://www.openwall.com/lists/oss-security/2020/08/08/2; https://lists.apache.org/thread.html/r4cc9cc9c54573babf821c31d5d410fb260d1cd416dc1b225d587be9b%40%3Cdev.asterixdb.apache.org%3E
CVE: CVE-2021-25829
Published: 2021-03-01
Description: An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.
CVSS Score: 7.5 (HIGH)
References: https://github.com/ONLYOFFICE/DocumentServer; https://github.com/ONLYOFFICE/core; https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Comments.h#L299
CVE: CVE-2021-25830
Published: 2021-03-01
Description: A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/ONLYOFFICE/DocumentServer; https://github.com/ONLYOFFICE/core; https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918
CVE: CVE-2021-25831
Published: 2021-03-01
Description: A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacker can obtain remote code execution on DocumentServer.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/ONLYOFFICE/DocumentServer; https://github.com/ONLYOFFICE/core; https://github.com/ONLYOFFICE/core/blob/v5.6.4.13/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1918
CVE: CVE-2021-25832
Published: 2021-03-01
Description: A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using this vulnerability, an attacker is able to gain remote code executions on DocumentServer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ONLYOFFICE/DocumentServer; https://github.com/ONLYOFFICE/core; https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L424
CVE: CVE-2021-25833
Published: 2021-03-01
Description: A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain remote code execution on DocumentServer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/ONLYOFFICE/DocumentServer; https://github.com/ONLYOFFICE/server; https://github.com/ONLYOFFICE/server/blob/v5.6.0.21/DocService/sources/converterservice.js#L200
CVE: CVE-2018-25004
Published: 2021-03-01
Description: A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://jira.mongodb.org/browse/SERVER-38275; https://jira.mongodb.org/browse/SERVER-38275
CVE: CVE-2020-36240
Published: 2021-03-01
Description: The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/CWD-5685; https://jira.atlassian.com/browse/CWD-5685
CVE: CVE-2021-22114
Published: 2021-03-01
Description: Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://tanzu.vmware.com/security/cve-2021-22114; https://tanzu.vmware.com/security/cve-2021-22114
CVE: CVE-2021-25914
Published: 2021-03-01
Description: Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/FireBlinkLTD/object-collider/commit/321f75a7f8e7b3393e5b7dd6dd9ab26ede5906e5; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25914; https://github.com/FireBlinkLTD/object-collider/commit/321f75a7f8e7b3393e5b7dd6dd9ab26ede5906e5
CVE: CVE-2021-21515
Published: 2021-03-01
Description: Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. A remote low privileged attacker may potentially exploit this vulnerability, to hijack user sessions or to trick a victim application user to unknowingly send arbitrary requests to the server.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000183430/dsa-2021-043-dell-emc-sourceone-java-script-xss-stored-vulnerability; https://www.dell.com/support/kbdoc/en-us/000183430/dsa-2021-043-dell-emc-sourceone-java-script-xss-stored-vulnerability
CVE: CVE-2021-21517
Published: 2021-03-01
Description: SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes user-supplied DTD input without sufficient validation. A remote unauthenticated attacker can potentially exploit this vulnerability to read system files as a non-root user and may be able to temporarily disrupt the ESRS service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.dell.com/support/kbdoc/en-us/000183576/dsa-2021-045-dell-emc-srs-policy-manager-security-update-for-external-entity-injection-vulnerability; https://www.dell.com/support/kbdoc/en-us/000183576/dsa-2021-045-dell-emc-srs-policy-manager-security-update-for-external-entity-injection-vulnerability
CVE: CVE-2021-27317
Published: 2021-03-01
Description: Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the comment parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/161574/Doctor-Appointment-System-1.0-Cross-Site-Scripting.html; https://www.sourcecodester.com/php/14182/doctor-appointment-system.html; http://packetstormsecurity.com/files/161574/Doctor-Appointment-System-1.0-Cross-Site-Scripting.html
CVE: CVE-2021-27318
Published: 2021-03-01
Description: Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the lastname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/161574/Doctor-Appointment-System-1.0-Cross-Site-Scripting.html; https://www.sourcecodester.com/php/14182/doctor-appointment-system.html; http://packetstormsecurity.com/files/161574/Doctor-Appointment-System-1.0-Cross-Site-Scripting.html
CVE: CVE-2021-3332
Published: 2021-03-01
Description: WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via post_password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://blog.sebastianschmitt.eu/security/wps-hide-login-1-6-1-protection-bypass-cve-2021-3332; https://blog.sebastianschmitt.eu/security/wps-hide-login-1-6-1-protection-bypass-cve-2021-3332
CVE: CVE-2021-26475
Published: 2021-03-01
Description: EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://files.eprints.org/2548/; https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf; https://files.eprints.org/2548/
CVE: CVE-2021-26476
Published: 2021-03-01
Description: EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://files.eprints.org/2548/; https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf; https://files.eprints.org/2548/
CVE: CVE-2021-26702
Published: 2021-03-01
Description: EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://files.eprints.org/2548/; https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf; https://files.eprints.org/2548/
CVE: CVE-2021-26703
Published: 2021-03-01
Description: EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://files.eprints.org/2548/; https://files.eprints.org/2549/; https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf
CVE: CVE-2021-26704
Published: 2021-03-01
Description: EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://files.eprints.org/2548/; https://files.eprints.org/2549/; https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf
CVE: CVE-2021-27876
Published: 2021-03-01
Description: An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
CVSS Score: 8.1 (HIGH)
References: http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html; https://www.veritas.com/content/support/en_US/security/VTS21-001#issue2; http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html
CVE: CVE-2021-27877
Published: 2021-03-01
Description: An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
CVSS Score: 8.2 (HIGH)
References: http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html; https://www.veritas.com/content/support/en_US/security/VTS21-001#issue1; http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html
CVE: CVE-2021-27878
Published: 2021-03-01
Description: An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html; https://www.veritas.com/content/support/en_US/security/VTS21-001#issue3; http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html
CVE: CVE-2021-3342
Published: 2021-03-01
Description: EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex= URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://files.eprints.org/2548/; https://files.eprints.org/2549/; https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf
CVE: CVE-2021-27884
Published: 2021-03-01
Description: Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-330
References: https://github.com/YMFE/yapi/issues/2117; https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi; https://github.com/YMFE/yapi/issues/2117
CVE: CVE-2016-8001
Published: 2021-03-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none
CVE: CVE-2016-8003
Published: 2021-03-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none
CVE: CVE-2016-8004
Published: 2021-03-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none