deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21380
Published: 2021-03-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. The problem has been patched in XWiki 12.9RC1. The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-79rg-7mv3-jrr5; https://jira.xwiki.org/browse/XWIKI-17662; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-79rg-7mv3-jrr5
CVE: CVE-2021-28967
Published: 2021-03-24
Description: The unofficial MATLAB extension before 2.0.1 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace because of lint configuration settings.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/Gimly/vscode-matlab/commit/fc5dc[PII_REDACTED]4099e80629e785a25718bf5ec; https://github.com/Gimly/vscode-matlab/releases; https://marketplace.visualstudio.com/items/Gimly81.matlab/changelog
CVE: CVE-2021-29133
Published: 2021-03-24
Description: Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/rapid7/metasploit-framework/pull/14833; https://github.com/rapid7/metasploit-framework/pull/14833/commits/5bf6b2d094deb22fa8183ce161b90cbe4fd40a70; https://gitlab.alpinelinux.org/alpine/aports/-/issues/12539
CVE: CVE-2021-29025
Published: 2021-03-24
Description: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/my_images.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md; https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md
CVE: CVE-2021-29026
Published: 2021-03-24
Description: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/permissions.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md; https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md
CVE: CVE-2021-29027
Published: 2021-03-24
Description: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/index.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md; https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md
CVE: CVE-2021-29028
Published: 2021-03-24
Description: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/user_activity.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md; https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md
CVE: CVE-2021-29029
Published: 2021-03-24
Description: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/edit_personal_page.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md; https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md
CVE: CVE-2021-29030
Published: 2021-03-24
Description: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/index.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md; https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md
CVE: CVE-2021-29031
Published: 2021-03-24
Description: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/users_import.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md; https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md
CVE: CVE-2021-29032
Published: 2021-03-24
Description: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/preferences.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md; https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md
CVE: CVE-2021-29033
Published: 2021-03-24
Description: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/edit_group.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md; https://github.com/xoffense/POC/blob/main/Multiple%20URI%20Based%20XSS%20in%20Bitweaver%203.1.0.md
CVE: CVE-2021-27315
Published: 2021-03-24
Description: Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/161641/Doctor-Appointment-System-1.0-SQL-Injection.html; http://packetstormsecurity.com/files/161641/Doctor-Appointment-System-1.0-SQL-Injection.html
CVE: CVE-2021-27316
Published: 2021-03-24
Description: Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/161641/Doctor-Appointment-System-1.0-SQL-Injection.html; http://packetstormsecurity.com/files/161641/Doctor-Appointment-System-1.0-SQL-Injection.html
CVE: CVE-2021-27319
Published: 2021-03-24
Description: Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/161642/Doctor-Appointment-System-1.0-Blind-SQL-Injection.html; http://packetstormsecurity.com/files/161642/Doctor-Appointment-System-1.0-Blind-SQL-Injection.html
CVE: CVE-2021-27320
Published: 2021-03-24
Description: Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/161642/Doctor-Appointment-System-1.0-Blind-SQL-Injection.html; https://www.sourcecodester.com/php/14182/doctor-appointment-system.html; http://packetstormsecurity.com/files/161642/Doctor-Appointment-System-1.0-Blind-SQL-Injection.html
CVE: CVE-2021-28362
Published: 2021-03-24
Description: An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension header options in an incoming IPv6 packet, there is an attempt to remove the RPL extension headers. Because the packet length and the extension header length are unchecked (with respect to the available data) at this stage, and these variables are susceptible to integer underflow, it is possible to construct an invalid extension header that will cause memory corruption issues and lead to a Denial-of-Service condition. This is related to rpl-ext-header.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://github.com/contiki-os/contiki/releases; https://www.kb.cert.org/vuls/id/815128; https://github.com/contiki-os/contiki/releases
CVE: CVE-2020-5015
Published: 2021-03-24
Description: IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause a denial of service by sending malformed UDP requests. IBM X-Force ID: 193486.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193486; https://www.ibm.com/support/pages/node/6434155; https://www.ibm.com/support/pages/node/6434737
CVE: CVE-2021-29002
Published: 2021-03-24
Description: A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/plone/Products.CMFPlone/issues/3255; https://www.exploit-db.com/exploits/49668; https://github.com/plone/Products.CMFPlone/issues/3255
CVE: CVE-2019-19349
Published: 2021-03-24
Description: An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-metering as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266
References: https://bugzilla.redhat.com/show_bug.cgi?id=1791534; https://bugzilla.redhat.com/show_bug.cgi?id=1793284; https://bugzilla.redhat.com/show_bug.cgi?id=1791534
CVE: CVE-2019-19350
Published: 2021-03-24
Description: An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shipped in Red Hat Openshift 4 and 3.11. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266
References: https://bugzilla.redhat.com/show_bug.cgi?id=1791534; https://bugzilla.redhat.com/show_bug.cgi?id=1793283; https://bugzilla.redhat.com/show_bug.cgi?id=1791534
CVE: CVE-2020-35337
Published: 2021-03-24
Description: ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to execute arbitrary SQL commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.unc1e.com/2020/12/thinksaas-has-post-auth-sql-injection.html; https://github.com/thinksaas/ThinkSAAS/issues/24; https://blog.unc1e.com/2020/12/thinksaas-has-post-auth-sql-injection.html
CVE: CVE-2020-36283
Published: 2021-03-24
Description: HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation Mode). By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to upload a configuration file to the device. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198443; https://www.hidglobal.com/sites/default/files/resource_files/hid-psa-2020-01-omnikey-csrf-security-advisory-paper.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/198443
CVE: CVE-2019-19352
Published: 2021-03-24
Description: An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266
References: https://bugzilla.redhat.com/show_bug.cgi?id=1791534; https://bugzilla.redhat.com/show_bug.cgi?id=1793281; https://bugzilla.redhat.com/show_bug.cgi?id=1791534
CVE: CVE-2019-19353
Published: 2021-03-24
Description: An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266
References: https://access.redhat.com/articles/4859371; https://bugzilla.redhat.com/show_bug.cgi?id=1791534; https://bugzilla.redhat.com/show_bug.cgi?id=1793279
CVE: CVE-2019-19354
Published: 2021-03-24
Description: An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266, CWE-269
References: https://access.redhat.com/articles/4859371; https://bugzilla.redhat.com/show_bug.cgi?id=1791534; https://bugzilla.redhat.com/show_bug.cgi?id=1793278
CVE: CVE-2020-15809
Published: 2021-03-24
Description: spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-918
References: https://support.spinetix.com/wiki/DSOS_release_notes; https://support.spinetix.com/wiki/SpinetiX-SA-20:01; https://support.spinetix.com/wiki/DSOS_release_notes
CVE: CVE-2020-7839
Published: 2021-03-24
Description: In MaEPSBroker 2.5.0.31 and prior, a command injection vulnerability caused by improper input validation checks when parsing brokerCommand parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35946; https://www.markany.com/; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35946
CVE: CVE-2021-22176
Published: 2021-03-24
Description: An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22176.json; https://gitlab.com/gitlab-org/gitlab/-/issues/243491; https://hackerone.com/reports/962604
CVE: CVE-2021-22178
Published: 2021-03-24
Description: An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22178.json; https://gitlab.com/gitlab-org/gitlab/-/issues/284819; https://hackerone.com/reports/1037411
CVE: CVE-2021-22179
Published: 2021-03-24
Description: A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22179.json; https://gitlab.com/gitlab-org/gitlab/-/issues/293733; https://hackerone.com/reports/1055816
CVE: CVE-2021-22185
Published: 2021-03-24
Description: Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22185.json; https://gitlab.com/gitlab-org/gitlab/-/issues/299143; https://hackerone.com/reports/1087061
CVE: CVE-2021-22186
Published: 2021-03-24
Description: An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22186.json; https://gitlab.com/gitlab-org/gitlab/-/issues/321653; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22186.json
CVE: CVE-2021-22192
Published: 2021-03-24
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.
CVSS Score: 9.9 (CRITICAL)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22192.json; https://gitlab.com/gitlab-org/gitlab/-/issues/324452; https://hackerone.com/reports/1125425
CVE: CVE-2021-22193
Published: 2021-03-24
Description: An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project.
CVSS Score: 3.5 (LOW)
CWE: CWE-209
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22193.json; https://gitlab.com/gitlab-org/gitlab/-/issues/12560; https://hackerone.com/reports/605608
CVE: CVE-2021-22169
Published: 2021-03-24
Description: An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22169.json; https://gitlab.com/gitlab-org/gitlab/-/issues/289930; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22169.json
CVE: CVE-2021-1377
Published: 2021-03-24
Description: A vulnerability in Address Resolution Protocol (ARP) management of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent an affected device from resolving ARP entries for legitimate hosts on the connected subnets. This vulnerability exists because ARP entries are mismanaged. An attacker could exploit this vulnerability by continuously sending traffic that results in incomplete ARP entries. A successful exploit could allow the attacker to cause ARP requests on the device to be unsuccessful for legitimate hosts, resulting in a denial of service (DoS) condition.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-arp-mtfhBfjE; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-arp-mtfhBfjE
CVE: CVE-2021-1382
Published: 2021-03-24
Description: A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to execute commands with root privileges.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/orangecertcc/security-research/security/advisories/GHSA-7xfm-92p7-qc57; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xesdwcinj-t68PPW7m; https://github.com/orangecertcc/security-research/security/advisories/GHSA-7xfm-92p7-qc57
CVE: CVE-2021-1383
Published: 2021-03-24
Description: Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation of certain CLI commands. An attacker could exploit these vulnerabilities by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to access the underlying operating system with root privileges.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20, CWE-88
References: https://github.com/orangecertcc/security-research/security/advisories/GHSA-vw54-f9mw-g46r; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xesdwpinj-V4weeqzU; https://github.com/orangecertcc/security-research/security/advisories/GHSA-vw54-f9mw-g46r
CVE: CVE-2021-1384
Published: 2021-03-24
Description: A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the underlying operating system as the root user. This vulnerability is due to incomplete validation of fields in the application packages loaded onto IOx. An attacker could exploit this vulnerability by creating a crafted application .tar file and loading it onto the device. A successful exploit could allow the attacker to perform command injection into the underlying operating system as the root user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/orangecertcc/security-research/security/advisories/GHSA-h332-fj6p-2232; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-cmdinj-RkSURGHG; https://github.com/orangecertcc/security-research/security/advisories/GHSA-h332-fj6p-2232
CVE: CVE-2021-1385
Published: 2021-03-24
Description: A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticated, remote attacker to conduct directory traversal attacks and read and write files on the underlying operating system or host system. This vulnerability occurs because the device does not properly validate URIs in IOx API requests. An attacker could exploit this vulnerability by sending a crafted API request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/orangecertcc/security-research/security/advisories/GHSA-hhfw-6cm2-v3w5; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-pt-hWGcPf7g; https://github.com/orangecertcc/security-research/security/advisories/GHSA-hhfw-6cm2-v3w5
CVE: CVE-2021-1390
Published: 2021-03-24
Description: A vulnerability in one of the diagnostic test CLI commands of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker would need to have valid user credentials at privilege level 15. This vulnerability exists because the affected software permits modification of the run-time memory of an affected device under specific circumstances. An attacker could exploit this vulnerability by authenticating to the affected device and issuing a specific diagnostic test command at the CLI. A successful exploit could trigger a logic error in the code that was designed to restrict run-time memory modifications. The attacker could take advantage of this logic error to overwrite system memory locations and execute arbitrary code on the underlying Linux operating system (OS) of the affected device.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-123
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-OFP-6Nezgn7b; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-OFP-6Nezgn7b