deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-24666
Published: 2021-01-29
Description: The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Display Name' parameter. Remediated in >= 9.1.0.1
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.hitachi.com/hirt/hitachi-sec/2020/601.html; https://www.accenture.com; http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
CVE: CVE-2020-24669
Published: 2021-01-29
Description: The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Analysis Report Description' field in 'About this Report' section. Remediated in >= 8.3.0.9, >= 9.0.0.1, and >= 9.1.0.0 GA.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.hitachi.com/hirt/hitachi-sec/2020/601.html; https://www.accenture.com; http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
CVE: CVE-2020-24670
Published: 2021-01-29
Description: The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'type' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.hitachi.com/hirt/hitachi-sec/2020/601.html; https://www.accenture.com; http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
CVE: CVE-2021-25124
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local spx_restservice deletevideo_func function path traversal vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25125
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local spx_restservice delsolrecordedvideo_func function path traversal vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25126
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice downloadkvmjnlp_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25127
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice generatesslcertificate_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25128
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local spx_restservice gethelpdata_func function path traversal vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25129
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local spx_restservice getvideodata_func function path traversal vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25130
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice setactdir_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25131
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice setfwimagelocation_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25132
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice setmediaconfig_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25133
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice setradiusconfig_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25134
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice setremoteimageinfo_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25135
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice setsmtp_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25136
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice setsolvideoremotestorage_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25137
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice startflash_func function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2021-25138
Published: 2021-01-29
Description: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice uploadsshkey function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us
CVE: CVE-2020-29557
Published: 2021-01-29
Description: An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: https://shaqed.github.io/dlink/; https://www.dlink.ru/ru/download2/5/19/2354/441/; https://shaqed.github.io/dlink/
CVE: CVE-2021-25646
Published: 2021-01-29
Description: Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/162345/Apache-Druid-0.20.0-Remote-Command-Execution.html; http://www.openwall.com/lists/oss-security/2021/01/29/6; https://lists.apache.org/thread.html/r04fa1ba93599487c95a8497044d37f8c02a439bfcf92b4567bfb7c8f%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2021-21254
Published: 2021-01-29
Description: CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0; https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr; https://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm
CVE: CVE-2020-15568
Published: 2021-01-30
Description: TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-913
References: https://help.terra-master.com/TOS/view/; https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution/; https://help.terra-master.com/TOS/view/
CVE: CVE-2020-14418
Published: 2021-01-30
Description: A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://github.com/nettitude/metasploit-modules; https://labs.nettitude.com/blog/cve-2020-14418-madcodehook-library-local-privilege-escalation/; https://github.com/nettitude/metasploit-modules
CVE: CVE-2020-15690
Published: 2021-01-30
Description: In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://www.openwall.com/lists/oss-security/2021/02/04/3; https://consensys.net/diligence/vulnerabilities/nim-asyncftpd-crlf-injection/; https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/asyncftpclient.nim#L145
CVE: CVE-2020-17380
Published: 2021-01-30
Description: A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2021/03/09/1; https://bugzilla.redhat.com/show_bug.cgi?id=1862167; https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html
CVE: CVE-2021-23329
Published: 2021-01-31
Description: The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/Geta/NestedObjectAssign/pull/11; https://snyk.io/vuln/SNYK-JS-NESTEDOBJECTASSIGN-1065977; https://github.com/Geta/NestedObjectAssign/pull/11
CVE: CVE-2020-13856
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-13857
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They can be rebooted by sending an unauthenticated poof.cgi HTTP GET request.
CVSS Score: 7.5 (HIGH)
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-13858
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mofidev accounts are defined in /etc/passwd and the password is not unique across installations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-13859
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interface without a password by abusing a forgotten-password feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-755
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-13860
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. The one-time password algorithm for the undocumented system account mofidev generates a predictable six-digit password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-15832
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The poof.cgi script contains undocumented code that provides the ability to remotely reboot the device. An adversary with the private key (but not the root password) can remotely reboot the device.
CVSS Score: 7.5 (HIGH)
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-15833
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to accept an alternate hard-coded path to a public key that allows root access. This key is stored in a /rom location that cannot be modified by the device owner.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-15834
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The wireless network password is exposed in a QR encoded picture that an unauthenticated adversary can download via the web-management interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-15835
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocumented code that provides the ability to authenticate as root without knowing the actual root password. An adversary with the private key can remotely authenticate to the management interface as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-15836
Published: 2021-02-01
Description: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root.
CVSS Score: 9.8 (CRITICAL)
References: https://mofinetwork.com/index.php?main_page=page&id=14; https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers/; https://mofinetwork.com/index.php?main_page=page&id=14
CVE: CVE-2020-26547
Published: 2021-02-01
Description: Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. This allows a remote attacker (able to send stanzas to a victim) to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://github.com/anurodhp/Monal/commits/develop; https://monal.im/blog/cve-2020-26547/; https://github.com/anurodhp/Monal/commits/develop
CVE: CVE-2021-3348
Published: 2021-02-01
Description: nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: http://www.openwall.com/lists/oss-security/2021/02/01/1; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b98e762e3d71e893b221f871825dc64694cfb258; https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
CVE: CVE-2021-3349
Published: 2021-02-01
Description: GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior
CVSS Score: 3.3 (LOW)
CWE: CWE-345
References: https://dev.gnupg.org/T4735; https://gitlab.gnome.org/GNOME/evolution/-/issues/299; https://mgorny.pl/articles/evolution-uid-trust-extrapolation.html
CVE: CVE-2021-3350
Published: 2021-02-01
Description: deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/vintagedaddyo/MyBB_Plugin-Delete_Account/pull/1; https://github.com/vintagedaddyo/MyBB_Plugin-Delete_Account/pull/1
CVE: CVE-2020-28194
Published: 2021-02-01
Description: Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69; https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr; https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69
CVE: CVE-2020-36109
Published: 2021-02-01
Description: ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi function of the httpd module that can cause code execution when an attacker constructs malicious data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/; https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/