deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-22888
Published: 2021-03-25
Description: Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/revive-adserver/revive-adserver/commit/f472d890; https://hackerone.com/reports/1097979; https://www.revive-adserver.com/security/revive-sa-2021-003/
CVE: CVE-2021-22889
Published: 2021-03-25
Description: Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/revive-adserver/revive-adserver/commit/2f868414; https://hackerone.com/reports/1097217; https://www.revive-adserver.com/security/revive-sa-2021-003/
CVE: CVE-2021-27438
Published: 2021-03-25
Description: The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (all firmware versions prior to 02A04.1).
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94, CWE-798
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-082-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-082-03
CVE: CVE-2021-27440
Published: 2021-03-25
Description: The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (all firmware versions prior to 02A04.1).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-082-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-082-03
CVE: CVE-2021-27448
Published: 2021-03-25
Description: A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00.1).
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-082-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-082-02
CVE: CVE-2021-27450
Published: 2021-03-25
Description: SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which could lead to additional misconfiguration or be leveraged as part of a larger attack on the MU320E (all firmware versions prior to v04A00.1).
CVSS Score: 7.8 (HIGH)
CWE: CWE-326
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-082-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-082-02
CVE: CVE-2021-27452
Published: 2021-03-25
Description: The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentials on the MU320E (all firmware versions prior to v04A00.1).
CVSS Score: 7.8 (HIGH)
CWE: CWE-259, CWE-798
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-082-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-082-02
CVE: CVE-2021-27454
Published: 2021-03-25
Description: The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses on the Reason DR60 (all firmware versions prior to 02A04.1).
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-082-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-082-03
CVE: CVE-2021-29008
Published: 2021-03-25
Description: A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the "to_time" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/seopanel/Seo-Panel/issues/211; https://github.com/seopanel/Seo-Panel/issues/211
CVE: CVE-2021-29009
Published: 2021-03-25
Description: A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "type" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/seopanel/Seo-Panel/issues/210; https://github.com/seopanel/Seo-Panel/issues/210
CVE: CVE-2021-29010
Published: 2021-03-25
Description: A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "report_type" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/seopanel/Seo-Panel/issues/212; https://github.com/seopanel/Seo-Panel/issues/212
CVE: CVE-2021-29093
Published: 2021-03-25
Description: A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image
CVE: CVE-2021-29094
Published: 2021-03-25
Description: Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image
CVE: CVE-2021-29095
Published: 2021-03-25
Description: Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-824, CWE-824
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image
CVE: CVE-2021-29097
Published: 2021-03-25
Description: Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-122, CWE-119
References: https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/; https://www.zerodayinitiative.com/advisories/ZDI-21-360/; https://www.zerodayinitiative.com/advisories/ZDI-21-363/
CVE: CVE-2021-29098
Published: 2021-03-25
Description: Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/; https://www.zerodayinitiative.com/advisories/ZDI-21-361/; https://www.zerodayinitiative.com/advisories/ZDI-21-362/
CVE: CVE-2021-27372
Published: 2021-03-25
Description: Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permissions via the build-in network monitoring tool and execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://www.realtek.com/images/safe-report/RTL9601D_CVE-2021-27372.pdf; https://www.realtek.com/images/safe-report/RTL9601D_CVE-2021-27372.pdf
CVE: CVE-2021-3119
Published: 2021-03-25
Description: Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/sqlcipher/sqlcipher/commit/cb71f53e8cea4802509f182fa5bead0ac6ab0e7f#diff-9305215a9a0ea69300281fc4af90bc7f3437e34a0e1745d[PII_REDACTED]93ddae4; https://www.telekom.com/resource/blob/621186/3fb50ca7a4a97728be18717ed7b0062c/dl-210308-critical-dos-vulnerability-in-sqlcipher-sql-command-processing-data.pdf; https://github.com/sqlcipher/sqlcipher/commit/cb71f53e8cea4802509f182fa5bead0ac6ab0e7f#diff-9305215a9a0ea69300281fc4af90bc7f3437e34a0e1745d[PII_REDACTED]93ddae4
CVE: CVE-2020-23517
Published: 2021-03-26
Description: Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://vulnerabilitypublishing.blogspot.com/2021/03/aryanic-highmail-high-cms-reflected.html; https://vulnerabilitypublishing.blogspot.com/2021/03/aryanic-highmail-high-cms-reflected.html
CVE: CVE-2021-3027
Published: 2021-03-26
Description: app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided search filter because user input gets no sanitization.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/LibrIT/passhport/commit/366b03f607729c4538e91b634ecc57c8398522a1; https://github.com/LibrIT/passhport/pull/562; https://jorgectf.gitlab.io/disclosure/cve-2021-3027/
CVE: CVE-2021-3153
Published: 2021-03-26
Description: HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://discuss.hashicorp.com/t/hcsec-2021-06-terraform-enterprise-organization-level-mfa-requirement-was-not-enforced/22401; https://discuss.hashicorp.com/t/hcsec-2021-06-terraform-enterprise-organization-level-mfa-requirement-was-not-enforced/22401
CVE: CVE-2020-28346
Published: 2021-03-26
Description: ACRN through 2.2 has a devicemodel/hw/pci/virtio/virtio.c NULL Pointer Dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/projectacrn/acrn-hypervisor/pull/5453; https://github.com/projectacrn/acrn-hypervisor/pull/5453/commits/ae0ab82434509d6e75f4a2f1e1a0dd2ee3dc3681; https://github.com/projectacrn/acrn-hypervisor/pull/5453
CVE: CVE-2021-28246
Published: 2021-03-26
Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/; https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE: CVE-2021-28247
Published: 2021-03-26
Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the platform users. The affected endpoints are: cgi/nhWeb with the parameter report, aviewbin/filtermibobjects.pl with the parameter namefilter, and aviewbin/query.pl with the parameters System, SystemText, Group, and GroupText. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/; https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE: CVE-2021-28248
Published: 2021-03-26
Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/; https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE: CVE-2021-28249
Published: 2021-03-26
Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a malicious library in the writable RPATH, to be dynamically linked when the FtpCollector executable is run. The code in the library will be executed as the root user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 8.8 (HIGH)
CWE: CWE-426
References: https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/; https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE: CVE-2021-28250
Published: 2021-03-26
Description: CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the script code will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/; https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/
CVE: CVE-2021-20677
Published: 2021-03-26
Description: UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending a specially crafted command.
CVSS Score: 3.1 (LOW)
References: https://jvn.jp/en/jp/JVN12737530/index.html; https://www.necplatforms.co.jp/en/press/security_adv.html; https://jvn.jp/en/jp/JVN12737530/index.html
CVE: CVE-2021-20681
Published: 2021-03-26
Description: Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://basercms.net/security/JVN64869876; https://jvn.jp/en/jp/JVN64869876/index.html; https://basercms.net/security/JVN64869876
CVE: CVE-2021-20682
Published: 2021-03-26
Description: baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://basercms.net/security/JVN64869876; https://jvn.jp/en/jp/JVN64869876/index.html; https://basercms.net/security/JVN64869876
CVE: CVE-2021-20683
Published: 2021-03-26
Description: Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://basercms.net/security/JVN64869876; https://jvn.jp/en/jp/JVN64869876/index.html; https://basercms.net/security/JVN64869876
CVE: CVE-2021-23888
Published: 2021-03-26
Description: Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10352; https://kc.mcafee.com/corporate/index?page=content&id=SB10352
CVE: CVE-2021-23889
Published: 2021-03-26
Description: Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10352; https://kc.mcafee.com/corporate/index?page=content&id=SB10352
CVE: CVE-2021-23890
Published: 2021-03-26
Description: Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages (specifically McAfee Agent) available in ePO repository and install them on their own machines to have it managed and then in turn get policy details from the ePO server. This can only happen when the ePO Agent Handler is installed in a Demilitarized Zone (DMZ) to service machines not connected to the network through a VPN.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10352; https://kc.mcafee.com/corporate/index?page=content&id=SB10352
CVE: CVE-2021-3275
Published: 2021-03-26
Description: Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm, networkMap.htm, dhcpClient.htm, qsEdit.htm, and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/161989/TP-Link-Cross-Site-Scripting.html; https://github.com/smriti548/CVE/blob/main/CVE-2021-3275; https://seclists.org/fulldisclosure/2021/Mar/67
CVE: CVE-2020-25840
Published: 2021-03-26
Description: Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause configuration destruction.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.microfocus.com/documentation/access-manager/5.0/accessmanager50-release-notes/accessmanager50-release-notes.html; https://www.microfocus.com/documentation/access-manager/5.0/accessmanager50-release-notes/accessmanager50-release-notes.html
CVE: CVE-2021-22506
Published: 2021-03-26
Description: Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.
CVSS Score: 7.5 (HIGH)
References: https://www.microfocus.com/documentation/access-manager/5.0/accessmanager50-release-notes/accessmanager50-release-notes.html; https://www.microfocus.com/documentation/access-manager/5.0/accessmanager50-release-notes/accessmanager50-release-notes.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22506
CVE: CVE-2020-19625
Published: 2021-03-26
Description: Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitrary code, via crafted value to the $query parameter.
CVSS Score: 9.8 (CRITICAL)
References: http://mayoterry.com/file/cve/Remote_Code_Execution_Vulnerability_in_gridx_latest_version.pdf; https://github.com/oria/gridx/issues/433; http://mayoterry.com/file/cve/Remote_Code_Execution_Vulnerability_in_gridx_latest_version.pdf
CVE: CVE-2020-19626
Published: 2021-03-26
Description: Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://mayoterry.com/file/cve/XSS_vuluerability_in_Craftcms_3.1.31.pdf; https://github.com/craftcms/cms/commit/76a2168b6a5e30144f5c06da4ff264f4eca577ff; http://mayoterry.com/file/cve/XSS_vuluerability_in_Craftcms_3.1.31.pdf
CVE: CVE-2020-35856
Published: 2021-03-26
Description: SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Release_Notes/Orion_Platform_2020-2-5_release_notes.htm; https://support.solarwinds.com/SuccessCenter/s/; https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Release_Notes/Orion_Platform_2020-2-5_release_notes.htm
CVE: CVE-2021-3109
Published: 2021-03-26
Description: The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account.
CVSS Score: 4.8 (MEDIUM)
References: https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Release_Notes/Orion_Platform_2020-2-5_release_notes.htm; https://support.solarwinds.com/SuccessCenter/s/; https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Release_Notes/Orion_Platform_2020-2-5_release_notes.htm
CVE: CVE-2020-27829
Published: 2021-03-26
Description: A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122
References: https://bugzilla.redhat.com/show_bug.cgi?id=1922525; https://github.com/ImageMagick/ImageMagick/commit/6ee5059cd3ac8d82714a1ab1321399b88539abf0; https://bugzilla.redhat.com/show_bug.cgi?id=1922525
CVE: CVE-2020-35508
Published: 2021-03-26
Description: A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-665, CWE-362, CWE-665
References: https://bugzilla.redhat.com/show_bug.cgi?id=1902724; https://github.com/torvalds/linux/commit/b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-35518
Published: 2021-03-26
Description: When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-203
References: https://bugzilla.redhat.com/show_bug.cgi?id=1905565; https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32; https://github.com/389ds/389-ds-base/commit/cc0f69283abc[PII_REDACTED]02dae485b8eae938bc
CVE: CVE-2021-1626
Published: 2021-03-26
Description: MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Versions affected: Mule 4.1.x and 4.2.x runtime released before February 2, 2021.
CVSS Score: 9.8 (CRITICAL)
References: https://help.salesforce.com/articleView?id=000357382&type=1&mode=1; https://help.salesforce.com/articleView?id=000357382&type=1&mode=1