deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-32686
Published: 2021-07-23
Description: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://github.com/pjsip/pjproject/commit/d5f95aa066f878b0aef6a64e60b61e8626e664cd; https://github.com/pjsip/pjproject/pull/2716; https://github.com/pjsip/pjproject/releases/tag/2.11.1
CVE: CVE-2021-32783
Published: 2021-07-23
Description: Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy remotely (a denial of service), or to expose the existence of any Secret that Envoy is using for its configuration, including most notably TLS Keypairs. However, it *cannot* be used to get the *content* of those secrets. Since this attack allows access to the administration interface, a variety of administration options are available, such as shutting down the Envoy or draining traffic. In general, the Envoy admin interface cannot easily be used for making changes to the cluster, in-flight requests, or backend services, but it could be used to shut down or drain Envoy, change traffic routing, or to retrieve secret metadata, as mentioned above. The issue will be addressed in Contour v1.18.0 and a cherry-picked patch release, v1.17.1, has been released to cover users who cannot upgrade at this time. For more details refer to the linked GitHub Security Advisory.
CVSS Score: 8.5 (HIGH)
CWE: CWE-441, CWE-610
References: https://github.com/projectcontour/contour/commit/b53a5c4fd927f4ea2c6cf02f1359d8e28bef852e; https://github.com/projectcontour/contour/releases/tag/v1.17.1; https://github.com/projectcontour/contour/security/advisories/GHSA-5ph6-qq5x-7jwc
CVE: CVE-2021-37436
Published: 2021-07-24
Description: Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain sensitive information via a series of complex hardware and software attacks. NOTE: reportedly, there were vendor marketing statements about safely removing personal content via a factory reset. Also, the vendor has reportedly indicated that they are working on mitigations.
CVSS Score: 4.2 (MEDIUM)
References: https://arstechnica.com/gadgets/2021/07/passwords-in-amazon-echo-dots-live-on-even-after-you-factory-reset-them/; https://dl.acm.org/doi/pdf/10.1145/3[PII_REDACTED]820; https://news.ycombinator.com/item?id=27943730
CVE: CVE-2021-23413
Published: 2021-07-25
Description: This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88; https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36; https://github.com/Stuk/jszip/pull/766
CVE: CVE-2021-3663
Published: 2021-07-25
Description: firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: https://github.com/firefly-iii/firefly-iii/commit/afc9f4b7ebc8a240c85864a6e1abda62bfeefae8; https://huntr.dev/bounties/497bdf6d-7dba-49c3-8011-1c64dfbb3380; https://github.com/firefly-iii/firefly-iii/commit/afc9f4b7ebc8a240c85864a6e1abda62bfeefae8
CVE: CVE-2021-37438
Published: 2021-07-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-37450
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md; https://www.nch.com.au/ivm/index.html; https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md
CVE: CVE-2021-37451
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md; https://www.nch.com.au/ivm/index.html; https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md
CVE: CVE-2021-37452
Published: 2021-07-25
Description: NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_CC.md; https://www.nch.com.au/conference/index.html; https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_CC.md
CVE: CVE-2021-37453
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37454
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37455
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37456
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37457
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37458
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37459
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37460
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37461
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37462
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE: CVE-2021-37463
Published: 2021-07-25
Description: In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md; https://www.nch.com.au/conference/index.html; https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE: CVE-2021-37464
Published: 2021-07-25
Description: In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md; https://www.nch.com.au/conference/index.html; https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE: CVE-2021-37465
Published: 2021-07-25
Description: In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md; https://www.nch.com.au/conference/index.html; https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE: CVE-2021-37466
Published: 2021-07-25
Description: In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md; https://www.nch.com.au/conference/index.html; https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE: CVE-2021-37467
Published: 2021-07-25
Description: In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md; https://www.nch.com.au/conference/index.html; https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE: CVE-2021-37468
Published: 2021-07-25
Description: NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files.
CVSS Score: 3.3 (LOW)
CWE: CWE-312
References: https://github.com/0xfml/poc/blob/main/NCH/ReflectCRM_3.01_CC.md; https://www.nchsoftware.com/crm/index.html; https://github.com/0xfml/poc/blob/main/NCH/ReflectCRM_3.01_CC.md
CVE: CVE-2021-37469
Published: 2021-07-25
Description: In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_LFI.md; https://www.nch.com.au/webdictate/index.html; https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_LFI.md
CVE: CVE-2021-37470
Published: 2021-07-25
Description: In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_XSS.md; https://www.nch.com.au/webdictate/index.html; https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_XSS.md
CVE: CVE-2021-37439
Published: 2021-07-25
Description: NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/0xfml/poc/blob/main/NCH/Flexiserver_6.00_LFI.md; https://www.nchsoftware.com/flexi/index.html; https://github.com/0xfml/poc/blob/main/NCH/Flexiserver_6.00_LFI.md
CVE: CVE-2021-37440
Published: 2021-07-25
Description: NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_LFI.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_LFI.md
CVE: CVE-2021-37441
Published: 2021-07-25
Description: NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_LFI.md; https://www.nch.com.au/pbx/index.html; https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_LFI.md
CVE: CVE-2021-37442
Published: 2021-07-25
Description: NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_LFI.md; https://www.nch.com.au/ivm/index.html; https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_LFI.md
CVE: CVE-2021-37443
Published: 2021-07-25
Description: NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_LFI.md; https://www.nch.com.au/ivm/index.html; https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_LFI.md
CVE: CVE-2021-37444
Published: 2021-07-25
Description: NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Autodial function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_RCE.md; https://www.nch.com.au/ivm/index.html; https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_RCE.md
CVE: CVE-2021-37445
Published: 2021-07-25
Description: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md; https://www.nch.com.au/conference/index.html; https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md
CVE: CVE-2021-37446
Published: 2021-07-25
Description: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md; https://www.nch.com.au/conference/index.html; https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md
CVE: CVE-2021-37447
Published: 2021-07-25
Description: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md; https://www.nch.com.au/conference/index.html; https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md
CVE: CVE-2021-37448
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md; https://www.nch.com.au/ivm/index.html; https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md
CVE: CVE-2021-37449
Published: 2021-07-25
Description: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md; https://www.nch.com.au/ivm/index.html; https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md
CVE: CVE-2021-21440
Published: 2021-07-26
Description: Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-200
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html; https://otrs.com/release-notes/otrs-security-advisory-2021-10/; https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE: CVE-2021-21442
Published: 2021-07-26
Description: In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://otrs.com/release-notes/otrs-security-advisory-2021-12/; https://otrs.com/release-notes/otrs-security-advisory-2021-12/
CVE: CVE-2021-21443
Published: 2021-07-26
Description: Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html; https://otrs.com/release-notes/otrs-security-advisory-2021-13/; https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE: CVE-2021-36091
Published: 2021-07-26
Description: Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.
CVSS Score: 3.5 (LOW)
CWE: CWE-200, CWE-863
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html; https://otrs.com/release-notes/otrs-security-advisory-2021-14/; https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE: CVE-2021-36092
Published: 2021-07-26
Description: It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition:6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://otrs.com/release-notes/otrs-security-advisory-2021-15/; https://otrs.com/release-notes/otrs-security-advisory-2021-15/
CVE: CVE-2021-33900
Published: 2021-07-26
Description: While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-319
References: https://lists.apache.org/thread.html/rb1dbcc43a5b406e45d335343a1704f4233de613140a01929d102fdc9%40%3Cusers.directory.apache.org%3E; https://lists.apache.org/thread.html/rb1dbcc43a5b406e45d335343a1704f4233de613140a01929d102fdc9%40%3Cusers.directory.apache.org%3E
CVE: CVE-2020-12681
Published: 2021-07-26
Description: Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock policies are applied.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://www.3xlogic.com/products/access-control/infinias-ethernet-enabled-integrated-door-controller-eidc; https://www.3xlogic.com/sites/www.3xlogic.com/files/media/2020-08/INF_RN_infinias_eIDC32_V3.9_Firmware%20Release_08142020.pdf; https://www.3xlogic.com/products/access-control/infinias-ethernet-enabled-integrated-door-controller-eidc
CVE: CVE-2020-4623
Published: 2021-07-26
Description: IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 184984.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184984; https://www.ibm.com/support/pages/node/6474857; https://exchange.xforce.ibmcloud.com/vulnerabilities/184984
CVE: CVE-2021-20337
Published: 2021-07-26
Description: IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 194448.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/194448; https://www.ibm.com/support/pages/node/6474847; https://exchange.xforce.ibmcloud.com/vulnerabilities/194448
CVE: CVE-2021-20430
Published: 2021-07-26
Description: IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196341; https://www.ibm.com/support/pages/node/6474861; https://exchange.xforce.ibmcloud.com/vulnerabilities/196341
CVE: CVE-2021-20431
Published: 2021-07-26
Description: IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196342; https://www.ibm.com/support/pages/node/6474865; https://exchange.xforce.ibmcloud.com/vulnerabilities/196342
CVE: CVE-2021-20560
Published: 2021-07-26
Description: IBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 199229.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199229; https://www.ibm.com/support/pages/node/6474829; https://exchange.xforce.ibmcloud.com/vulnerabilities/199229
CVE: CVE-2021-22144
Published: 2021-07-26
Description: In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://discuss.elastic.co/t/elasticsearch-7-13-3-and-6-8-17-security-update/278100; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuapr2022.html