deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3769
Published: 2021-11-30
Description: # Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability can be exploited. **Fixed in**: [b3ba9978](https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978). **Impacted areas**: - `pygmalion` theme. - `pygmalion-virtualenv` theme. - `refined` theme.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978; https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978
CVE: CVE-2021-42115
Published: 2021-11-30
Description: Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1004, CWE-732
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42116
Published: 2021-11-30
Description: Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher privileged users, via identifying said components in the front-end source code or other means.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42117
Published: 2021-11-30
Description: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker with Object Modification privileges to insert arbitrary HTML without code execution.
CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-79
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42118
Published: 2021-11-30
Description: Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribute, which is then rendered in the Structure Component, to alter the intended functionality and steal cookies, the latter allowing for account takeover.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42119
Published: 2021-11-30
Description: Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42120
Published: 2021-11-30
Description: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification privileges to insert arbitrarily long strings, eventually leading to exhaustion of the underlying resource.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-400
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42121
Published: 2021-11-30
Description: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(s) allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format into date fields, which leads to breaking the object page that the date field is present.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42122
Published: 2021-11-30
Description: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format, which makes the affected attribute non-editable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42123
Published: 2021-11-30
Description: Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 in the File Upload Functions allows an authenticated remote attacker with Upload privileges to upload files with any file type, enabling client-side attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434, CWE-434
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42544
Published: 2021-11-30
Description: Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenticated remote attacker to perform multiple login attempts, which facilitates gaining privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-42545
Published: 2021-11-30
Description: An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-613, CWE-613
References: https://confluence.topease.ch/confluence/display/DOC/Release+Notes; https://confluence.topease.ch/confluence/display/DOC/Release+Notes
CVE: CVE-2021-43771
Published: 2021-11-30
Description: Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could allow an attacker to establish a connection that could lead to full local privilege escalation within the application. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10832; https://www.zerodayinitiative.com/advisories/ZDI-21-1320/; https://helpcenter.trendmicro.com/en-us/article/TMKA-10832
CVE: CVE-2021-41677
Published: 2021-11-30
Description: A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/functions/GetStuListFnc.php &Grade= parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic/issues/202; https://github.com/OS4ED/openSIS-Classic/issues/202
CVE: CVE-2021-25987
Published: 2021-11-30
Description: Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987; https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200
CVE: CVE-2021-41678
Published: 2021-11-30
Description: A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/users/Staff.php, staff{TITLE] parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic/issues/203; https://github.com/OS4ED/openSIS-Classic/issues/203
CVE: CVE-2021-41679
Published: 2021-11-30
Description: A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic/issues/204; https://github.com/OS4ED/openSIS-Classic/issues/204
CVE: CVE-2021-43998
Published: 2021-11-30
Description: HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://discuss.hashicorp.com/t/hcsec-2021-30-vaults-templated-acl-policies-matched-first-created-alias-per-entity-and-auth-backend/32132; https://security.gentoo.org/glsa/202207-01; https://discuss.hashicorp.com/t/hcsec-2021-30-vaults-templated-acl-policies-matched-first-created-alias-per-entity-and-auth-backend/32132
CVE: CVE-2021-43202
Published: 2021-11-30
Description: In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/; https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
CVE: CVE-2021-38958
Published: 2021-11-30
Description: IBM MQ Appliance 9.2 CD and 9.2 LTS is affected by a denial of service attack caused by a concurrency issue. IBM X-Force ID: 212042
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212043; https://www.ibm.com/support/pages/node/6519420; https://exchange.xforce.ibmcloud.com/vulnerabilities/212043
CVE: CVE-2021-38967
Published: 2021-11-30
Description: IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-Force ID: 212441.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212441; https://www.ibm.com/support/pages/node/6512826; https://exchange.xforce.ibmcloud.com/vulnerabilities/212441
CVE: CVE-2021-38999
Published: 2021-11-30
Description: IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213214; https://www.ibm.com/support/pages/node/6519418; https://exchange.xforce.ibmcloud.com/vulnerabilities/213214
CVE: CVE-2021-39000
Published: 2021-11-30
Description: IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213215; https://www.ibm.com/support/pages/node/6519422; https://exchange.xforce.ibmcloud.com/vulnerabilities/213215
CVE: CVE-2020-7879
Published: 2021-11-30
Description: This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36365; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36365
CVE: CVE-2020-7880
Published: 2021-11-30
Description: The vulnerabilty was discovered in ActiveX module related to NeoRS remote support program. This issue allows an remote attacker to download and execute remote file. It is because of improper parameter validation of StartNeoRS function in ActiveX.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36367; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36367
CVE: CVE-2021-22095
Published: 2021-11-30
Description: In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://tanzu.vmware.com/security/cve-2021-22097; https://tanzu.vmware.com/security/cve-2021-22097
CVE: CVE-2021-26612
Published: 2021-11-30
Description: An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36380; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36380
CVE: CVE-2021-42099
Published: 2021-11-30
Description: Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/microsoft-365-management-reporting/release-notes.html#4421; https://www.manageengine.com
CVE: CVE-2021-43282
Published: 2021-11-30
Description: An issue was discovered on Victure WR1200 devices through 1.0.3. The default Wi-Fi WPA2 key is advertised to anyone within Wi-Fi range through the router's MAC address. The device default Wi-Fi password corresponds to the last 4 bytes of the MAC address of its 2.4 GHz network interface controller (NIC). An attacker within scanning range of the Wi-Fi network can thus scan for Wi-Fi networks to obtain the default key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/; https://www.nccgroup.trust/us/our-research/?research=Technical+advisories; https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/
CVE: CVE-2021-43283
Published: 2021-11-30
Description: An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device, allowing an attacker with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges. This occurs in the ping and traceroute features. An attacker would thus be able to use this vulnerability to open a reverse shell on the device with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/; https://www.nccgroup.trust/us/our-research/?research=Technical+advisories; https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/
CVE: CVE-2021-43284
Published: 2021-11-30
Description: An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an attacker to gain control of the device through SSH (regardless of whether the admin password was changed on the web interface).
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/; https://www.nccgroup.trust/us/our-research/?research=Technical+advisories; https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/
CVE: CVE-2021-43294
Published: 2021-11-30
Description: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://manageengine.com; https://www.manageengine.com/products/support-center/readme.html#11016; https://manageengine.com
CVE: CVE-2021-43295
Published: 2021-11-30
Description: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://manageengine.com; https://www.manageengine.com/products/support-center/readme.html#11016; https://manageengine.com
CVE: CVE-2021-43296
Published: 2021-11-30
Description: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://manageengine.com; https://www.manageengine.com/products/support-center/readme.html#11016; https://manageengine.com
CVE: CVE-2021-43319
Published: 2021-11-30
Description: Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://manageengine.com; https://www.manageengine.com/network-configuration-manager/release-notes.html#125488; https://manageengine.com
CVE: CVE-2021-44230
Published: 2021-11-30
Description: PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. In this scenario, the compromised account may have inherited read access to sensitive configuration, database, and log files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://portswigger.net/burp/releases/enterprise-edition-2021-11?requestededition=enterprise; https://portswigger.net/burp/releases/enterprise-edition-2021-11?requestededition=enterprise
CVE: CVE-2021-31787
Published: 2021-11-30
Description: The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown of a device by flooding the target device with LMP_features_res packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://launchstudio.bluetooth.com/ListingDetails/76427; https://www.actions-semi.com/index.php?id=3581&siteId=4
CVE: CVE-2021-40101
Published: 2021-11-30
Description: An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password.
CVSS Score: 7.2 (HIGH)
CWE: CWE-732
References: https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes; https://hackerone.com/reports/1065577; https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes
CVE: CVE-2021-42564
Published: 2021-11-30
Description: An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to provide confidential messages via Cryptshare) to redirect targeted victims to any URL via the '<meta http-equiv="refresh"' substring in the editor parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-057.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-057.txt
CVE: CVE-2021-43320
Published: 2021-11-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-41244. Reason: This candidate is a reservation duplicate of CVE-2021-41244. Notes: All CVE users should reference CVE-2021-41244 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-4026
Published: 2021-11-30
Description: bookstack is vulnerable to Improper Access Control
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://github.com/bookstackapp/bookstack/commit/b4fa82e3298a15443ca40bff205b7a16a1031d92; https://huntr.dev/bounties/c6dfa80d-43e6-4b49-95af-cc031bb66b1d; https://github.com/bookstackapp/bookstack/commit/b4fa82e3298a15443ca40bff205b7a16a1031d92
CVE: CVE-2021-36326
Published: 2021-11-30
Description: Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface (UI). A remote unauthenticated attacker could potentially exploit this vulnerability, leading to a downgrade in the communications between the client and server into an unencrypted format.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-757
References: https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities; https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities
CVE: CVE-2021-36327
Published: 2021-11-30
Description: Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to perform port scanning of internal networks and make HTTP requests to an arbitrary domain of the attacker's choice.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities; https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities
CVE: CVE-2021-36328
Published: 2021-11-30
Description: Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions and retrieve sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-598, CWE-89
References: https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities; https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities