deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-16812
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16813
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16814
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16815
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16816
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16817
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16818
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16819
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16820
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16821
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16822
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16823
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16824
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16825
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16826
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16827
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16828
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16829
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16830
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16831
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16832
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16833
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16834
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16835
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-16836
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3627
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3631
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3682
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3695
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3697
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3705
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3706
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3707
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3708
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-3709
Published: 2021-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2021-43842
Published: 2021-12-20
Description: Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5.257 and earlier are vulnerable to stored cross-site scripting through a SVG file upload. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the SVG is viewed directly by other users. Scripts do not execute when loaded inside a page via normal `<img>` tags. Commit 5d3e81496fba1f0fbd64eeb855f30f69a9040718 fixes this vulnerability by adding an optional (enabled by default) SVG sanitization step to all file uploads that match the SVG mime type. As a workaround, disable file upload for all non-trusted users. Wiki.js version 2.5.260 is the first production version to contain a patch. Version 2.5.258 is the first development build to contain a patch and is available only as a Docker image as requarks/wiki:canary-2.5.258.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Requarks/wiki/commit/5d3e81496fba1f0fbd64eeb855f30f69a9040718; https://github.com/Requarks/wiki/releases/tag/2.5.260; https://github.com/Requarks/wiki/security/advisories/GHSA-3qv4-gp35-rgh7
CVE: CVE-2021-45450
Published: 2021-12-21
Description: In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0; https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5/
CVE: CVE-2021-45451
Published: 2021-12-21
Description: In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W/
CVE: CVE-2021-24578
Published: 2021-12-21
Description: The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/69351798-c790-42d4-9485-1813cd325769; https://wpscan.com/vulnerability/69351798-c790-42d4-9485-1813cd325769
CVE: CVE-2021-24738
Published: 2021-12-21
Description: The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2c3d8c21-ecd4-41ba-8183-2ecbd9a3df25; https://wpscan.com/vulnerability/2c3d8c21-ecd4-41ba-8183-2ecbd9a3df25
CVE: CVE-2021-24739
Published: 2021-12-21
Description: The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature
CVSS Score: 8.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://wpscan.com/vulnerability/2afadc76-93ad-47e1-a224-e442ac41cbce; https://wpscan.com/vulnerability/2afadc76-93ad-47e1-a224-e442ac41cbce
CVE: CVE-2021-24750
Published: 2021-12-21
Description: The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.html; https://plugins.trac.wordpress.org/changeset/2622268; https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de
CVE: CVE-2021-24846
Published: 2021-12-21
Description: The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/a1e7cd2b-8400-4c5d-8b47-a8ccd1e21675; https://wpscan.com/vulnerability/a1e7cd2b-8400-4c5d-8b47-a8ccd1e21675
CVE: CVE-2021-24849
Published: 2021-12-21
Description: The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e; https://wpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e
CVE: CVE-2021-24907
Published: 2021-12-21
Description: The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/56dae1ae-d5d2-45d3-8991-db69cc47ddb7; https://wpscan.com/vulnerability/56dae1ae-d5d2-45d3-8991-db69cc47ddb7
CVE: CVE-2021-24941
Published: 2021-12-21
Description: The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/beca7afd-8f03-4909-bea0-77b63513564b; https://wpscan.com/vulnerability/beca7afd-8f03-4909-bea0-77b63513564b
CVE: CVE-2021-24956
Published: 2021-12-21
Description: The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5882ea89-f463-4f0b-a624-150bbaf967c2; https://wpscan.com/vulnerability/5882ea89-f463-4f0b-a624-150bbaf967c2
CVE: CVE-2021-24981
Published: 2021-12-21
Description: The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352, CWE-434
References: https://blog.sucuri.net/2021/11/fake-ransomware-infection-spooks-website-owners.html; https://wpscan.com/vulnerability/4c45df6d-b3f6-49e5-8b1f-edd32a12d71c; https://blog.sucuri.net/2021/11/fake-ransomware-infection-spooks-website-owners.html
CVE: CVE-2021-45252
Published: 2021-12-21
Description: Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_topic.php, manage_user.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/Forum-Discussion-System-1.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/Forum-Discussion-System-1.0
CVE: CVE-2021-45253
Published: 2021-12-21
Description: The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CSMS-1.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CSMS-1.0
CVE: CVE-2021-45255
Published: 2021-12-21
Description: The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/Video-Sharing-Website; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/Video-Sharing-Website
CVE: CVE-2021-4139
Published: 2021-12-21
Description: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/d5c3e876d[PII_REDACTED]35061c3bd24d301351245; https://huntr.dev/bounties/6ec59e43-095f-4ba3-8b75-e92250da8e3a; https://github.com/pimcore/pimcore/commit/d5c3e876d[PII_REDACTED]35061c3bd24d301351245
CVE: CVE-2012-20001
Published: 2021-12-21
Description: PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://seclists.org/bugtraq/2012/Nov/1; https://seclists.org/bugtraq/2012/Nov/1
CVE: CVE-2021-45089
Published: 2021-12-21
Description: Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.
CVSS Score: 5.2 (MEDIUM)
References: https://advisories.stormshield.eu/2021-071/; https://advisories.stormshield.eu/2021-071/
CVE: CVE-2021-45090
Published: 2021-12-21
Description: Stormshield Endpoint Security before 2.1.2 allows remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://advisories.stormshield.eu/2021-070/; https://advisories.stormshield.eu/2021-070/
CVE: CVE-2021-45091
Published: 2021-12-21
Description: Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
References: https://advisories.stormshield.eu/2021-072/; https://advisories.stormshield.eu/2021-072/
CVE: CVE-2021-36316
Published: 2021-12-21
Description: Dell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI. A malicious user with high privileges could potentially exploit this vulnerability, leading to the disclosure of the AUI info and performing some unauthorized operation on the AUI.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://www.dell.com/support/kbdoc/000193369; https://www.dell.com/support/kbdoc/000193369
CVE: CVE-2021-36317
Published: 2021-12-21
Description: Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://security.gentoo.org/glsa/202210-09; https://www.dell.com/support/kbdoc/000193369; https://security.gentoo.org/glsa/202210-09
CVE: CVE-2021-36318
Published: 2021-12-21
Description: Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vulnerability, leading to a complete outage.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-532, CWE-522
References: https://security.gentoo.org/glsa/202210-09; https://www.dell.com/support/kbdoc/000193369; https://security.gentoo.org/glsa/202210-09
CVE: CVE-2021-36336
Published: 2021-12-21
Description: Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execute code on the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.dell.com/support/kbdoc/000193079; https://www.dell.com/support/kbdoc/000193079
CVE: CVE-2021-36337
Published: 2021-12-21
Description: Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible to Man-In-The-Middle attacks thereby compromising Confidentiality and Integrity of data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://www.dell.com/support/kbdoc/000193079; https://www.dell.com/support/kbdoc/000193079
CVE: CVE-2021-36341
Published: 2021-12-21
Description: Dell Wyse Device Agent version 14.5.4.1 and below contain a sensitive data exposure vulnerability. A local authenticated user with low privileges could potentially exploit this vulnerability in order to access sensitive information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.dell.com/support/kbdoc/en-us/000193151; https://www.dell.com/support/kbdoc/en-us/000193151
CVE: CVE-2021-36350
Published: 2021-12-21
Description: Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an authentication bypass by primary weakness in one of the authentication factors. A remote unauthenticated attacker may potentially exploit this vulnerability and bypass one of the factors of authentication.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://www.dell.com/support/kbdoc/000194157; https://www.dell.com/support/kbdoc/000194157
CVE: CVE-2021-43587
Published: 2021-12-21
Description: Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malicious user may potentially exploit this vulnerability to gain access to secrets and elevate to gain higher privileges.
CVSS Score: 8.2 (HIGH)
CWE: CWE-321
References: https://www.dell.com/support/kbdoc/en-us/000194083/dsa-2021-260; https://www.dell.com/support/kbdoc/en-us/000194083/dsa-2021-260
CVE: CVE-2021-43839
Published: 2021-12-21
Description: Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.
CVSS Score: 7.5 (HIGH)
CWE: CWE-670, CWE-670
References: https://github.com/crypto-org-chain/cronos/commit/150ef237b37ac28c8136e1c0f494932860b9ebe8; https://github.com/crypto-org-chain/cronos/pull/270; https://github.com/crypto-org-chain/cronos/security/advisories/GHSA-f854-hpxv-cw9r
CVE: CVE-2021-44874
Published: 2021-12-21
Description: Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. The bi report module exposes direct SQL commands via POST data in order to select data for report generation. A malicious actor can use the bi report endpoint as a direct SQL prompt under the authenticated user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.systeam.com.br/cve/insecure%20design%20-%20sql%20manipulation-en.txt; https://www.systeam.com.br/cve/insecure%20design%20-%20sql%20manipulation-en.txt