deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28663
Published: 2021-05-10
Description: The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/support/arm-security-updates; https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver; https://github.com/lntrx/CVE-2021-28663
CVE: CVE-2021-28664
Published: 2021-05-10
Description: The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0 through r30p0 before r31p0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/support/arm-security-updates; https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver
CVE: CVE-2020-13529
Published: 2021-05-10
Description: An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-290, CWE-290
References: http://www.openwall.com/lists/oss-security/2021/08/04/2; http://www.openwall.com/lists/oss-security/2021/08/17/3; http://www.openwall.com/lists/oss-security/2021/09/07/3
CVE: CVE-2021-21822
Published: 2021-05-10
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A specially crafted PDF document can trigger the reuse of previously free memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening a malicious file or site to trigger this vulnerability if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1287; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1287
CVE: CVE-2021-31877
Published: 2021-05-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA due to lack of a reference providing provenance. Notes: none
CVE: CVE-2021-20538
Published: 2021-05-10
Description: IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198919; https://www.ibm.com/support/pages/node/6450849; https://exchange.xforce.ibmcloud.com/vulnerabilities/198919
CVE: CVE-2021-20559
Published: 2021-05-10
Description: IBM Control Desk 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199228.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199228; https://www.ibm.com/support/pages/node/6450759; https://exchange.xforce.ibmcloud.com/vulnerabilities/199228
CVE: CVE-2021-20577
Published: 2021-05-10
Description: IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199281.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199281; https://www.ibm.com/support/pages/node/6450849; https://exchange.xforce.ibmcloud.com/vulnerabilities/199281
CVE: CVE-2021-29501
Published: 2021-05-10
Description: Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable the exploitable code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/Dav-Git/Dav-Cogs/commit/3d54ef9b52ce03f139b7d6c1cc38c375e65593fd; https://github.com/Dav-Git/Dav-Cogs/security/advisories/GHSA-r2cf-49r7-pfj7; https://github.com/Dav-Git/Dav-Cogs/commit/3d54ef9b52ce03f139b7d6c1cc38c375e65593fd
CVE: CVE-2020-19199
Published: 2021-05-10
Description: A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious user execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/qinggan/phpok/issues/5; https://github.com/qinggan/phpok/issues/5
CVE: CVE-2021-29502
Published: 2021-05-10
Description: WarnSystem is a cog (plugin) for the Red discord bot. A vulnerability has been found in the code that allows any user to access sensible informations by setting up a specific template which is not properly sanitized. The problem has been patched in version 1.3.18. Users should update and type `!warnsysteminfo` to check that their version is 1.3.18 or above. As a workaround users may unload the WarnSystem cog or disable the `!warnset description` command globally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-94
References: https://github.com/retke/Laggrons-Dumb-Cogs/commit/c79dd2cc879989cf2018e76ba2aad0baef3b4ec8; https://github.com/retke/Laggrons-Dumb-Cogs/security/advisories/GHSA-834g-67vv-m9wq; https://github.com/retke/Laggrons-Dumb-Cogs/commit/c79dd2cc879989cf2018e76ba2aad0baef3b4ec8
CVE: CVE-2020-27226
Published: 2021-05-10
Description: An exploitable SQL injection vulnerability exists in ‘quickFile.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1202; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1202
CVE: CVE-2020-27229
Published: 2021-05-10
Description: A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findPersonID parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205
CVE: CVE-2020-27230
Published: 2021-05-10
Description: A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findSector parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205
CVE: CVE-2020-27231
Published: 2021-05-10
Description: A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findDistrict parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1205
CVE: CVE-2020-28588
Published: 2021-05-10
Description: An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has been introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and is still present in v5.10-rc4, so it’s likely that all versions in between are affected. An attacker can read /proc/pid/syscall to trigger this vulnerability, which leads to the kernel leaking memory contents.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-681, CWE-681
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1211; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1211
CVE: CVE-2021-21428
Published: 2021-05-10
Description: Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-269, CWE-668
References: https://github.com/OpenAPITools/openapi-generator/pull/8788; https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-23x4-m842-fmwf; https://github.com/OpenAPITools/openapi-generator/pull/8788
CVE: CVE-2021-29022
Published: 2021-05-10
Description: In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-434
References: https://notnnor.github.io/research/2021/03/17/full-path-discloure-in-invoiceplane.html; https://notnnor.github.io/research/2021/03/17/full-path-discloure-in-invoiceplane.html
CVE: CVE-2020-18102
Published: 2021-05-10
Description: Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/FantasticLBP/Hotels_Server/issues/3; https://github.com/FantasticLBP/Hotels_Server/issues/3
CVE: CVE-2020-27232
Published: 2021-05-10
Description: An exploitable SQL injection vulnerability exists in ‘manageServiceStocks.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1206; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1206
CVE: CVE-2020-28600
Published: 2021-05-10
Description: An out-of-bounds write vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1224; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1224
CVE: CVE-2021-21430
Published: 2021-05-10
Description: OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. Affected generators: `java` (jersey2, okhttp-gson (default library)), `scala-finch`. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-269, CWE-668
References: https://github.com/OpenAPITools/openapi-generator/pull/8787; https://github.com/OpenAPITools/openapi-generator/pull/8791; https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-cqxr-xf2w-943w
CVE: CVE-2021-32053
Published: 2021-05-10
Description: JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/hapifhir/hapi-fhir/issues/2641; https://github.com/hapifhir/hapi-fhir/pull/2642; https://hapifhir.io
CVE: CVE-2021-32399
Published: 2021-05-10
Description: net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2021/05/11/2; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e2cb6b891ad2b8caa9131e3be70f45243df82a80; https://github.com/torvalds/linux/commit/e2cb6b891ad2b8caa9131e3be70f45243df82a80
CVE: CVE-2021-32489
Published: 2021-05-10
Description: An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device because response_msg.st.len=8 can be accepted but triggers an integer overflow, which causes CRYPTO_cbc128_decrypt (in OpenSSL) to encounter an undersized buffer and experience a segmentation fault. The yubihsm-shell project is included in the YubiHSM 2 SDK product.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://blog.inhq.net/posts/yubico-libyubihsm-vuln2/#second-attack-variant-cve-pending; https://blog.inhq.net/posts/yubico-libyubihsm-vuln2/#second-attack-variant-cve-pending
CVE: CVE-2020-23369
Published: 2021-05-10
Description: In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yzmcms/yzmcms/issues/46; https://github.com/yzmcms/yzmcms/issues/46
CVE: CVE-2020-23370
Published: 2021-05-10
Description: In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yzmcms/yzmcms/issues/45; https://github.com/yzmcms/yzmcms/issues/45
CVE: CVE-2020-23371
Published: 2021-05-10
Description: Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nangge/noneCms/issues/30; https://github.com/nangge/noneCms/issues/30
CVE: CVE-2020-23373
Published: 2021-05-10
Description: Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nangge/noneCms/issues/33; https://github.com/nangge/noneCms/issues/33
CVE: CVE-2020-23374
Published: 2021-05-10
Description: Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nangge/noneCms/issues/32; https://github.com/nangge/noneCms/issues/32
CVE: CVE-2020-23376
Published: 2021-05-10
Description: NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://cwe.mitre.org/data/definitions/352.html; https://github.com/nangge/noneCms/issues/35; https://cwe.mitre.org/data/definitions/352.html
CVE: CVE-2020-23575
Published: 2021-05-10
Description: A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/48561; https://www.exploit-db.com/exploits/48561
CVE: CVE-2021-32563
Published: 2021-05-11
Description: An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-913
References: http://www.openwall.com/lists/oss-security/2021/05/11/3; http://www.openwall.com/lists/oss-security/2023/01/05/1; http://www.openwall.com/lists/oss-security/2023/01/05/2
CVE: CVE-2021-30174
Published: 2021-05-11
Description: RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4718-f16df-1.html; https://www.twcert.org.tw/tw/cp-132-4718-f16df-1.html
CVE: CVE-2021-32544
Published: 2021-05-11
Description: Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS (Cross-site scripting) attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4719-e298a-1.html; https://www.twcert.org.tw/tw/cp-132-4719-e298a-1.html
CVE: CVE-2020-27242
Published: 2021-05-11
Description: An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208
CVE: CVE-2020-27243
Published: 2021-05-11
Description: An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoService parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208
CVE: CVE-2020-27244
Published: 2021-05-11
Description: An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoCode parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208
CVE: CVE-2020-27245
Published: 2021-05-11
Description: An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoBuyer parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208
CVE: CVE-2020-27246
Published: 2021-05-11
Description: An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoComment parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1208
CVE: CVE-2021-26309
Published: 2021-05-11
Description: Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.
CVSS Score: 3.3 (LOW)
CWE: CWE-668
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/; https://blog.jetbrains.com
CVE: CVE-2021-26310
Published: 2021-05-11
Description: In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.
CVSS Score: 7.5 (HIGH)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/; https://blog.jetbrains.com
CVE: CVE-2021-27733
Published: 2021-05-11
Description: In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/; https://blog.jetbrains.com
CVE: CVE-2021-29263
Published: 2021-05-11
Description: In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS.
CVSS Score: 7.8 (HIGH)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/; https://blog.jetbrains.com
CVE: CVE-2021-30005
Published: 2021-05-11
Description: In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS.
CVSS Score: 7.8 (HIGH)
CWE: CWE-345
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/; https://security.gentoo.org/glsa/202107-45
CVE: CVE-2021-30006
Published: 2021-05-11
Description: In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/; https://blog.jetbrains.com
CVE: CVE-2021-30504
Published: 2021-05-11
Description: In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/; https://blog.jetbrains.com
CVE: CVE-2021-31899
Published: 2021-05-11
Description: In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode.
CVSS Score: 8.8 (HIGH)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/; https://blog.jetbrains.com