deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-18667
Published: 2021-06-24
Description: SQL Injection vulnerability in WebPort <=1.19.1 via the new connection, parameter name in type-conn.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LoRexxar/CVE_Request/blob/master/web%20port%20mul%20vuls%20before%20v1.19.1/web%20port%20mul%20vuls%20before%20v1.19.1.md#post-stored-xss-and-sql-injection-in--logtypeerror; https://www.seebug.org/vuldb/ssvid-97998; https://github.com/LoRexxar/CVE_Request/blob/master/web%20port%20mul%20vuls%20before%20v1.19.1/web%20port%20mul%20vuls%20before%20v1.19.1.md#post-stored-xss-and-sql-injection-in--logtypeerror
CVE: CVE-2021-21571
Published: 2021-06-24
Description: Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability using a person-in-the-middle attack which may lead to a denial of service and payload tampering.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://www.dell.com/support/kbdoc/en-us/000188682; https://www.dell.com/support/kbdoc/en-us/000188682
CVE: CVE-2021-21572
Published: 2021-06-24
Description: Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000188682; https://www.dell.com/support/kbdoc/en-us/000188682
CVE: CVE-2021-21573
Published: 2021-06-24
Description: Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000188682; https://www.dell.com/support/kbdoc/en-us/000188682
CVE: CVE-2021-21574
Published: 2021-06-24
Description: Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000188682; https://www.dell.com/support/kbdoc/en-us/000188682
CVE: CVE-2021-32708
Published: 2021-06-24
Description: Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions are: A user is allowed to supply the path or filename of an uploaded file, the supplied path or filename is not checked against unicode chars, the supplied pathname checked against an extension deny-list, not an allow-list, the supplied path or filename contains a unicode whitespace char in the extension, the uploaded file is stored in a directory that allows PHP code to be executed. Given these conditions are met a user can upload and execute arbitrary code on the system under attack. The unicode whitespace removal has been replaced with a rejection (exception). For 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-367, CWE-367
References: https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74; https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32; https://github.com/thephpleague/flysystem/security/advisories/GHSA-9f46-5r25-5wfm
CVE: CVE-2020-18668
Published: 2021-06-24
Description: Cross Site Scripting (XSS) vulnerabililty in WebPort <=1.19.1 via the description parameter to script/listcalls.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LoRexxar/CVE_Request/blob/master/web%20port%20mul%20vuls%20before%20v1.19.1/web%20port%20mul%20vuls%20before%20v1.19.1.md#stored-xss--in-scriptlistcalls; https://www.seebug.org/vuldb/ssvid-97996; https://github.com/LoRexxar/CVE_Request/blob/master/web%20port%20mul%20vuls%20before%20v1.19.1/web%20port%20mul%20vuls%20before%20v1.19.1.md#stored-xss--in-scriptlistcalls
CVE: CVE-2021-33000
Published: 2021-06-24
Description: Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code execution. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01
CVE: CVE-2021-33002
Published: 2021-06-24
Description: Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. User interaction is require on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01
CVE: CVE-2021-33004
Published: 2021-06-24
Description: The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to execute arbitrary code. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01
CVE: CVE-2020-18670
Published: 2021-06-24
Description: Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/roundcube/roundcubemail/issues/7406; https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php; https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12
CVE: CVE-2020-18671
Published: 2021-06-24
Description: Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/roundcube/roundcubemail/issues/7406; https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config; https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12
CVE: CVE-2020-4885
Published: 2021-06-24
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-59
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190909; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6466363
CVE: CVE-2020-4945
Published: 2021-06-24
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945.
CVSS Score: 8.1 (HIGH)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191945; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6466367
CVE: CVE-2021-20579
Published: 2021-06-24
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTO_REVAL is set to DEFFERED_FORCE. IBM X-Force ID: 199283.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199283; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6466369
CVE: CVE-2021-29703
Published: 2021-06-24
Description: Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200659; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6466371
CVE: CVE-2021-29777
Published: 2021-06-24
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while being accessed in another session, could allow an authenticated user to cause a denial of srevice IBM X-Force ID: 203031.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-829
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203031; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6466373
CVE: CVE-2021-32490
Published: 2021-06-24
Description: A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filter_bv() via crafted djvu file may lead to application crash and other consequences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1943693; https://www.debian.org/security/2021/dsa-5032; https://bugzilla.redhat.com/show_bug.cgi?id=1943693
CVE: CVE-2021-32491
Published: 2021-06-24
Description: A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted djvu file may lead to application crash and other consequences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1943684; https://www.debian.org/security/2021/dsa-5032; https://bugzilla.redhat.com/show_bug.cgi?id=1943684
CVE: CVE-2021-32492
Published: 2021-06-24
Description: A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::has_data() via crafted djvu file may lead to application crash and other consequences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1943686; https://www.debian.org/security/2021/dsa-5032; https://bugzilla.redhat.com/show_bug.cgi?id=1943686
CVE: CVE-2021-32493
Published: 2021-06-24
Description: A flaw was found in djvulibre-3.5.28 and earlier. A heap buffer overflow in function DJVU::GBitmap::decode() via crafted djvu file may lead to application crash and other consequences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1943690; https://www.debian.org/security/2021/dsa-5032; https://bugzilla.redhat.com/show_bug.cgi?id=1943690
CVE: CVE-2021-32709
Published: 2021-06-24
Description: Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-306
References: https://github.com/shopware/platform/security/advisories/GHSA-g7w8-pp9w-7p32; https://github.com/shopware/platform/security/advisories/GHSA-g7w8-pp9w-7p32
CVE: CVE-2021-3500
Published: 2021-06-24
Description: A flaw was found in djvulibre-3.5.28 and earlier. A Stack overflow in function DJVU::DjVuDocument::get_djvu_file() via crafted djvu file may lead to application crash and other consequences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1943685; https://www.debian.org/security/2021/dsa-5032; https://bugzilla.redhat.com/show_bug.cgi?id=1943685
CVE: CVE-2020-17752
Published: 2021-06-24
Description: Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart contract implemented at address 0xB49E984A83d7A638E7F2889fc8328952BA951AbE, an implementation for MillionCoin (MON).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://etherscan.io/address/0xB49E984A83d7A638E7F2889fc8328952BA951AbE; https://github.com/hellowuzekai/blockchains/blob/master/balance.md; https://etherscan.io/address/0xB49E984A83d7A638E7F2889fc8328952BA951AbE
CVE: CVE-2020-17753
Published: 2021-06-24
Description: An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer an arbitrary amount of tokens to an arbitrary address.
CVSS Score: 6.5 (MEDIUM)
References: https://etherscan.io/address/0x07c1C8c2BCe6290DAA554118b7d208041615CE54; https://etherscan.io/address/0x340DbA127F099DAB9DC8599C75b16e44D9b02Fdb; https://etherscan.io/address/0x403E518F21F5Ce308085Dcf6637758C61f92446A
CVE: CVE-2020-17759
Published: 2021-06-24
Description: An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://evernote.com/intl/zh-cn/security/updates/; https://evernote.com/intl/zh-cn/security/updates/
CVE: CVE-2021-32710
Published: 2021-06-24
Description: Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384
References: https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e; https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg; https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e
CVE: CVE-2021-32711
Published: 2021-06-24
Description: Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. Please check your plugins if you have it in use. Detailed technical information can be found in the upgrade information. https://github.com/shopware/platform/blob/v6.3.5.1/UPGRADE-6.3.md#6351 ### Workarounds For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag[PII_REDACTED]9 ### For more information https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021; https://github.com/shopware/platform/commit/157fb84a8b3b4ace4be165a033d[PII_REDACTED]29b; https://github.com/shopware/platform/security/advisories/GHSA-f2vv-h5x4-57gr
CVE: CVE-2021-35448
Published: 2021-06-24
Description: Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer Folder feature to navigate to cmd.exe. It binds to local ports to listen for incoming connections.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://deathflash.ml/blog/remote-mouse-lpe; https://leobreaker1411.github.io/blog/cve-2021-35448; https://www.exploit-db.com/exploits/50047
CVE: CVE-2021-32712
Published: 2021-06-24
Description: Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-209
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021; https://github.com/shopware/shopware/commit/dcb24eb5ec757c991b5a4e2ddced379e5820744d; https://github.com/shopware/shopware/security/advisories/GHSA-9vxv-wpv4-f52p
CVE: CVE-2021-32713
Published: 2021-06-24
Description: Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021; https://github.com/shopware/shopware/commit/a0850ffbc6f581a8eb8425cc2bf77a0715e21e12; https://github.com/shopware/shopware/security/advisories/GHSA-f6p7-8xfw-fjqq
CVE: CVE-2021-32716
Published: 2021-06-24
Description: Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021; https://github.com/shopware/platform/commit/b5c3ce3e93bd121324d72aa9d367cb636ff1c0eb; https://github.com/shopware/platform/security/advisories/GHSA-gpmh-g94g-qrhr
CVE: CVE-2021-32717
Published: 2021-06-24
Description: Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag[PII_REDACTED]9) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-732
References: https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021; https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3; https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52v
CVE: CVE-2021-35475
Published: 2021-06-25
Description: SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163294/SAS-Environment-Manager-2.5-Cross-Site-Scripting.html; https://github.com/saitamang/CVE-2021-35475/blob/main/README.md; https://support.sas.com
CVE: CVE-2021-28958
Published: 2021-06-25
Description: Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.stmcyber.com/vulns/cve-2021-28958/; https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6102-released-with-an-important-security-fix-21-3-2021; https://www.manageengine.com
CVE: CVE-2021-31615
Published: 2021-06-25
Description: Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent device to inject a crafted packet during the receive window of the listening device before the transmitting device initiates its packet transmission to achieve full MITM status without terminating the link. When applied against devices establishing or using encrypted links, crafted packets may be used to terminate an existing link, but will not compromise the confidentiality or integrity of the link.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://bluetooth.com; https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/injectable/; https://bluetooth.com
CVE: CVE-2021-35047
Published: 2021-06-25
Description: Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://support.fidelissecurity.com/hc/en-us/categories/[PII_REDACTED]94-Advisories-News-and-Policies; https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/; https://support.fidelissecurity.com/hc/en-us/categories/[PII_REDACTED]94-Advisories-News-and-Policies
CVE: CVE-2021-35048
Published: 2021-06-25
Description: Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://support.fidelissecurity.com/hc/en-us/categories/[PII_REDACTED]94-Advisories-News-and-Policies; https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/; https://support.fidelissecurity.com/hc/en-us/categories/[PII_REDACTED]94-Advisories-News-and-Policies
CVE: CVE-2021-35049
Published: 2021-06-25
Description: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89, CWE-78
References: https://support.fidelissecurity.com/hc/en-us/categories/[PII_REDACTED]94-Advisories-News-and-Policies; https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/; https://support.fidelissecurity.com/hc/en-us/categories/[PII_REDACTED]94-Advisories-News-and-Policies