deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37187
Published: 2021-12-10
Description: An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the device, which allows decoding of other users' passwords.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt; https://www.digi.com/search/results?q=transport; https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
CVE: CVE-2021-37188
Published: 2021-12-10
Description: An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware (because the bootloader does not verify that it is authentic), changing the behavior of the gateway.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt; https://www.digi.com/search/results?q=transport; https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
CVE: CVE-2021-37189
Published: 2021-12-10
Description: An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt; https://www.digi.com/search/results?q=transport; https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
CVE: CVE-2021-40834
Published: 2021-12-10
Description: A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame; https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-40834; https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
CVE: CVE-2021-3829
Published: 2021-12-10
Description: openwhyd is vulnerable to URL Redirection to Untrusted Site
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/openwhyd/openwhyd/commit/[PII_REDACTED]3dcba49d89d993f56bebd346069640; https://huntr.dev/bounties/6b8acb0c-8b5d-461e-9b46-b1bfb5a8ccdf; https://github.com/openwhyd/openwhyd/commit/[PII_REDACTED]3dcba49d89d993f56bebd346069640
CVE: CVE-2021-29214
Published: 2021-12-10
Description: A security vulnerability has been identified in HPE StoreServ Management Console (SSMC). An authenticated SSMC administrator could exploit the vulnerability to inject code and elevate their privilege in SSMC. The scope of this vulnerability is limited to SSMC. Note: The arrays being managed are not impacted by this vulnerability. This vulnerability impacts SSMC versions 3.4 GA to 3.8.1.
CVSS Score: 7.2 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04207en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04207en_us
CVE: CVE-2021-36911
Published: 2021-12-10
Description: Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/comment-engine-pro/wordpress-comment-engine-pro-plugin-1-0-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/comment-engine-pro/; https://patchstack.com/database/vulnerability/comment-engine-pro/wordpress-comment-engine-pro-plugin-1-0-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-37934
Published: 2021-12-10
Description: Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force password guessing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://gist.github.com/andrey-lomtev/4ec[PII_REDACTED]ea9d0043a09d59498a6; https://gist.github.com/andrey-lomtev/4ec[PII_REDACTED]ea9d0043a09d59498a6
CVE: CVE-2021-37935
Published: 2021-12-10
Description: An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user to get information about the domain name of the configured LDAP server. An attacker could exploit this vulnerability by requesting the login page and searching for the "isLdap" JavaScript parameter in the HTML source code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://gist.github.com/andrey-lomtev/c970fb7dd022d04f5b57ad37fbedd064; https://gist.github.com/andrey-lomtev/c970fb7dd022d04f5b57ad37fbedd064
CVE: CVE-2021-31745
Published: 2021-12-10
Description: Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation attempts such as resetting their password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://github.com/pluck-cms/pluck/issues/99; https://github.com/pluck-cms/pluck/issues/99
CVE: CVE-2021-31746
Published: 2021-12-10
Description: Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/pluck-cms/pluck/issues/100; https://github.com/pluck-cms/pluck/issues/100
CVE: CVE-2021-38917
Published: 2021-12-10
Description: IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary host system memory through a series of carefully crafted service procedures. IBM X-Force ID: 210018.
CVSS Score: 9.1 (CRITICAL)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210018; https://www.ibm.com/support/pages/node/6525010; https://exchange.xforce.ibmcloud.com/vulnerabilities/210018
CVE: CVE-2021-38937
Published: 2021-12-10
Description: IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a specially crafted IBMi Hypervisor call. IBM X-Force ID: 210894.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210894; https://www.ibm.com/support/pages/node/6525014; https://exchange.xforce.ibmcloud.com/vulnerabilities/210894
CVE: CVE-2021-43813
Published: 2021-12-10
Description: Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.openwall.com/lists/oss-security/2021/12/10/4; https://github.com/github/securitylab-vulnerabilities/commit/689fc5d9fd665be4d5bba200a6a433b532172d0f; https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d
CVE: CVE-2021-27983
Published: 2021-12-10
Description: Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/maxsite/cms/issues/430; https://github.com/maxsite/cms/issues/430
CVE: CVE-2021-27984
Published: 2021-12-10
Description: In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://github.com/pluck-cms/pluck/issues/98; https://github.com/pluck-cms/pluck/issues/98
CVE: CVE-2021-31747
Published: 2021-12-10
Description: Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-middle attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://github.com/pluck-cms/pluck/issues/101; https://github.com/pluck-cms/pluck/issues/101
CVE: CVE-2021-23463
Published: 2021-12-10
Description: The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e[PII_REDACTED]199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3; https://github.com/h2database/h2database/issues/3195; https://github.com/h2database/h2database/pull/3199
CVE: CVE-2021-23561
Published: 2021-12-10
Description: All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-COMB-1730083; https://snyk.io/vuln/SNYK-JS-COMB-1730083
CVE: CVE-2021-23639
Published: 2021-12-10
Description: The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a; https://github.com/simonhaenisch/md-to-pdf/issues/99; https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880
CVE: CVE-2021-23663
Published: 2021-12-10
Description: All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-SEY-1727592; https://snyk.io/vuln/SNYK-JS-SEY-1727592
CVE: CVE-2021-23700
Published: 2021-12-10
Description: All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-MERGEDEEP2-1727593; https://snyk.io/vuln/SNYK-JS-MERGEDEEP2-1727593
CVE: CVE-2021-4089
Published: 2021-12-10
Description: snipe-it is vulnerable to Improper Access Control
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/snipe/snipe-it/commit/1699c09758e56f740437674a8d6ba36443399f24; https://huntr.dev/bounties/19453ef1-4d77-4cff-b7e8-1bc8f3af0862; https://github.com/snipe/snipe-it/commit/1699c09758e56f740437674a8d6ba36443399f24
CVE: CVE-2021-43815
Published: 2021-12-10
Description: Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.openwall.com/lists/oss-security/2021/12/10/4; https://github.com/grafana/grafana/commit/d6ec6f8ad28f0212e584406730f939105ff6c6d3; https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d
CVE: CVE-2020-12890
Published: 2021-12-10
Description: Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with physical or administrative access to potentially manipulate the AMD Generic Encapsulated Software Architecture (AGESA) to execute arbitrary code undetected by the operating system.
CVSS Score: 6.7 (MEDIUM)
References: https://www.amd.com/en/corporate/product-security; https://www.amd.com/en/corporate/product-security
CVE: CVE-2021-26340
Published: 2021-12-10
Description: A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior inside the virtual machine (VM).
CVSS Score: 8.4 (HIGH)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1023; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1023
CVE: CVE-2021-41242
Published: 2021-12-10
Description: OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. By providing a filename that contains a relative path as a parameter in some REST methods, it is possible to create directory structures and write files anywhere on the target system. The attack could be used to write files anywhere in the web root folder or outside, depending on the configuration of the system and the properly configured permission of the application server user. The attack requires an OpenOlat user account, an enabled REST API and the rights on a business object to call the vulnerable REST calls. The problem is fixed in version 15.5.12 and 16.0.5. There is a workaround available. The vulnerability requires the REST module to be enabled. Disabling the REST module or limiting the REST module via some firewall or web-server access rules to be accessed only be trusted systems will mitigate the risk.
CVSS Score: 8.1 (HIGH)
CWE: CWE-23, CWE-22
References: https://github.com/OpenOLAT/OpenOLAT/commit/336d5ce80681be61a0bbf4f73d2af5d1ff67e93a; https://github.com/OpenOLAT/OpenOLAT/commit/c450df7d7ffe6afde39ebca6da9136f1caa16ec4; https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-62hv-rfp4-hmrm
CVE: CVE-2021-4092
Published: 2021-12-11
Description: yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/585da04bb72d36a894f6ea5939ab909e53fd8c23; https://huntr.dev/bounties/7b58c160-bb62-45fe-ad1f-38354378b89e; https://github.com/yetiforcecompany/yetiforcecrm/commit/585da04bb72d36a894f6ea5939ab909e53fd8c23
CVE: CVE-2021-4097
Published: 2021-12-12
Description: phpservermon is vulnerable to Improper Neutralization of CRLF Sequences
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-93
References: https://github.com/phpservermon/phpservermon/commit/162bba0046fcda1580f4fbc7b9ababe3c7c13ce4; https://huntr.dev/bounties/d617ced7-be06-4e34-9db0-63d45c003a43; https://github.com/phpservermon/phpservermon/commit/162bba0046fcda1580f4fbc7b9ababe3c7c13ce4
CVE: CVE-2021-41805
Published: 2021-12-12
Description: HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.hashicorp.com/blog/category/consul
CVE: CVE-2021-44515
Published: 2021-12-12
Description: Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
CVSS Score: 9.8 (CRITICAL)
References: https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp; https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilities-catalog; https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html
CVE: CVE-2021-44833
Published: 2021-12-12
Description: The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://github.com/opensearch-project/opensearch-cli/blob/275085730f791daccaac81c566a25f541656d9f9/commands/root.go#L43; https://github.com/opensearch-project/opensearch-cli/commit/69dc712d0d0d05dc2bc2bd0d733c73e3641b633a; https://github.com/opensearch-project/opensearch-cli/blob/275085730f791daccaac81c566a25f541656d9f9/commands/root.go#L43
CVE: CVE-2018-25021
Published: 2021-12-13
Description: The TCP Server module in toxcore before 0.2.8 doesn't free the TCP priority queue under certain conditions, which allows a remote attacker to exhaust the system's memory, causing a denial of service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/; https://github.com/TokTok/c-toxcore/issues/1214; https://github.com/TokTok/c-toxcore/pull/1216
CVE: CVE-2018-25022
Published: 2021-12-13
Description: The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP address (when knowing only their Tox Id) by positioning themselves close to target's Tox Id in the DHT for the target to establish an onion connection with the attacker, guessing the target's DHT public key and creating a DHT node with public key close to it, and finally onion-routing a NAT Ping Request to the target, requesting it to ping the just created DHT node.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://blog.tox.chat/2018/04/security-vulnerability-and-new-toxcore-release; https://github.com/TokTok/c-toxcore/issues/873; https://github.com/TokTok/c-toxcore/pull/872
CVE: CVE-2021-44847
Published: 2021-12-13
Description: A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calculation during the handling of received network packets) allows remote attackers to crash the process or potentially execute arbitrary code via a network packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-682
References: https://github.com/TokTok/c-toxcore/pull/1718; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7EBS3NIRYJ7V3PTNINP3PJSVUHGZTGA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLTKINSPO5T65LB3ZASDPCREKUE22RYE/
CVE: CVE-2021-44848
Published: 2021-12-13
Description: In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: http://packetstormsecurity.com/files/165327/Cibele-Thinfinity-VirtualUI-2.5.41.0-User-Enumeration.html; https://github.com/cybelesoft/virtualui/issues/1; http://packetstormsecurity.com/files/165327/Cibele-Thinfinity-VirtualUI-2.5.41.0-User-Enumeration.html
CVE: CVE-2021-40856
Published: 2021-12-13
Description: Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-706
References: http://packetstormsecurity.com/files/165162/Auerswald-COMfortel-1400-2600-3600-IP-2.8F-Authentication-Bypass.html; https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses; https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-004/-auerswald-comfortel-1400-2600-3600-ip-authentication-bypass
CVE: CVE-2021-40857
Published: 2021-12-13
Description: Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://packetstormsecurity.com/files/165163/Auerswald-COMpact-8.0B-Privilege-Escalation.html; https://www.redteam-pentesting.de/advisories/rt-sa-2021-005; https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
CVE: CVE-2021-40858
Published: 2021-12-13
Description: Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileName=../../etc/passwd substring.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/165166/Auerswald-COMpact-8.0B-Arbitrary-File-Disclosure.html; https://www.redteam-pentesting.de/advisories/rt-sa-2021-006; https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
CVE: CVE-2021-44151
Published: 2021-12-13
Description: An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version (the Linux version appears to have 8 characters). An attacker can obtain the static part of the cookie (cookie name) by first making a request to any page on the application (e.g., /goforms/menu) and saving the name of the cookie sent with the response. The attacker can then use the name of the cookie and try to request that same page, setting a random value for the cookie. If any user has an active session, the page should return with the authorized content, when a valid cookie value is hit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://packetstormsecurity.com/files/165191/Reprise-License-Manager-14.2-Session-Hijacking.html; https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes; https://www.reprisesoftware.com/RELEASE_NOTES
CVE: CVE-2021-44152
Published: 2021-12-13
Description: An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html; https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes; https://www.reprisesoftware.com/RELEASE_NOTES