deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-37158
Published: 2021-11-10
Description: An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. An authenticated attacker could inject OS commands by starting a Counter-Strike server and using the map field to enter a Bash command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/OpenGamePanel/OGP-Website/pull/561; https://www.exploit-db.com/exploits/50373; https://github.com/OpenGamePanel/OGP-Website/pull/561
CVE: CVE-2021-26443
Published: 2021-11-10
Description: Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
CVSS Score: 9.0 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26443; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26443
CVE: CVE-2021-26444
Published: 2021-11-10
Description: Azure RTOS Information Disclosure Vulnerability
CVSS Score: 3.3 (LOW)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26444; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26444
CVE: CVE-2021-36957
Published: 2021-11-10
Description: Windows Desktop Bridge Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36957; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36957
CVE: CVE-2021-38631
Published: 2021-11-10
Description: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
CVSS Score: 4.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38631; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38631
CVE: CVE-2021-38665
Published: 2021-11-10
Description: Remote Desktop Protocol Client Information Disclosure Vulnerability
CVSS Score: 7.4 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38665; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38665
CVE: CVE-2021-38666
Published: 2021-11-10
Description: Remote Desktop Client Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38666; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38666
CVE: CVE-2021-40442
Published: 2021-11-10
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40442; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40442
CVE: CVE-2021-41349
Published: 2021-11-10
Description: Microsoft Exchange Server Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41349; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41349
CVE: CVE-2021-41351
Published: 2021-11-10
Description: Microsoft Edge (Chrome based) Spoofing on IE Mode
CVSS Score: 4.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41351; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41351
CVE: CVE-2021-41356
Published: 2021-11-10
Description: Windows Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41356; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41356
CVE: CVE-2021-41366
Published: 2021-11-10
Description: Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41366; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41366
CVE: CVE-2021-41367
Published: 2021-11-10
Description: NTFS Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41367; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41367
CVE: CVE-2021-41368
Published: 2021-11-10
Description: Microsoft Access Remote Code Execution Vulnerability
CVSS Score: 6.1 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41368; https://www.zerodayinitiative.com/advisories/ZDI-21-1309/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41368
CVE: CVE-2021-41370
Published: 2021-11-10
Description: NTFS Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41370; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41370
CVE: CVE-2021-41371
Published: 2021-11-10
Description: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
CVSS Score: 4.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41371; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41371
CVE: CVE-2021-41372
Published: 2021-11-10
Description: A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim.
Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded.
The security update addresses the vulnerability by helping to ensure that Power BI Report Server properly sanitize file uploads.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-352
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41372
CVE: CVE-2021-41373
Published: 2021-11-10
Description: FSLogix Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41373; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41373
CVE: CVE-2021-41374
Published: 2021-11-10
Description: Azure Sphere Information Disclosure Vulnerability
CVSS Score: 6.7 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41374; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41374
CVE: CVE-2021-41375
Published: 2021-11-10
Description: Azure Sphere Information Disclosure Vulnerability
CVSS Score: 4.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41375; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41375
CVE: CVE-2021-41376
Published: 2021-11-10
Description: Azure Sphere Information Disclosure Vulnerability
CVSS Score: 2.3 (LOW)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41376; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41376
CVE: CVE-2021-41377
Published: 2021-11-10
Description: Windows Fast FAT File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41377; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41377
CVE: CVE-2021-41378
Published: 2021-11-10
Description: Windows NTFS Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41378; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41378
CVE: CVE-2021-41379
Published: 2021-11-10
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41379; https://www.zerodayinitiative.com/advisories/ZDI-21-1308/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41379
CVE: CVE-2021-42274
Published: 2021-11-10
Description: Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42274; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42274
CVE: CVE-2021-42275
Published: 2021-11-10
Description: Microsoft COM for Windows Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42275; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42275
CVE: CVE-2021-42276
Published: 2021-11-10
Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42276; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42276
CVE: CVE-2021-42277
Published: 2021-11-10
Description: Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42277; https://www.zerodayinitiative.com/advisories/ZDI-21-1306/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42277
CVE: CVE-2021-42278
Published: 2021-11-10
Description: Active Directory Domain Services Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42278; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42278; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42278
CVE: CVE-2021-42279
Published: 2021-11-10
Description: Chakra Scripting Engine Memory Corruption Vulnerability
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42279; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42279
CVE: CVE-2021-42280
Published: 2021-11-10
Description: Windows Feedback Hub Elevation of Privilege Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42280; https://www.zerodayinitiative.com/advisories/ZDI-21-1307/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42280
CVE: CVE-2021-42282
Published: 2021-11-10
Description: Active Directory Domain Services Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42282; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42282
CVE: CVE-2021-42283
Published: 2021-11-10
Description: NTFS Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42283; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42283
CVE: CVE-2021-42284
Published: 2021-11-10
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42284; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42284
CVE: CVE-2021-42285
Published: 2021-11-10
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42285; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42285
CVE: CVE-2021-42286
Published: 2021-11-10
Description: Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42286; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42286
CVE: CVE-2021-42287
Published: 2021-11-10
Description: Active Directory Domain Services Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42287; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42287; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42287
CVE: CVE-2021-42288
Published: 2021-11-10
Description: Windows Hello Security Feature Bypass Vulnerability
CVSS Score: 5.7 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42288; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42288
CVE: CVE-2021-42291
Published: 2021-11-10
Description: Active Directory Domain Services Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42291; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42291
CVE: CVE-2021-42292
Published: 2021-11-10
Description: Microsoft Excel Security Feature Bypass Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42292; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42292; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42292
CVE: CVE-2021-42296
Published: 2021-11-10
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42296; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42296
CVE: CVE-2021-42298
Published: 2021-11-10
Description: Microsoft Defender Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42298; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42298
CVE: CVE-2021-42300
Published: 2021-11-10
Description: Azure Sphere Tampering Vulnerability
CVSS Score: 6.0 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42300; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42300
CVE: CVE-2021-42301
Published: 2021-11-10
Description: Azure RTOS Information Disclosure Vulnerability
CVSS Score: 3.3 (LOW)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42301; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42301
CVE: CVE-2021-42302
Published: 2021-11-10
Description: Azure RTOS Elevation of Privilege Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42302; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42302
CVE: CVE-2021-42303
Published: 2021-11-10
Description: Azure RTOS Elevation of Privilege Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42303; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42303
CVE: CVE-2021-42304
Published: 2021-11-10
Description: Azure RTOS Elevation of Privilege Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42304; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42304
CVE: CVE-2021-42305
Published: 2021-11-10
Description: Microsoft Exchange Server Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42305; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42305
CVE: CVE-2021-42316
Published: 2021-11-10
Description: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42316; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42316
CVE: CVE-2021-42319
Published: 2021-11-10
Description: Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42319; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42319
CVE: CVE-2021-42321
Published: 2021-11-10
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/166153/Microsoft-Exchange-Server-Remote-Code-Execution.html; http://packetstormsecurity.com/files/168131/Microsoft-Exchange-Server-ChainedSerializationBinder-Remote-Code-Execution.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42321
CVE: CVE-2021-42322
Published: 2021-11-10
Description: Visual Studio Code Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42322; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42322
CVE: CVE-2021-42323
Published: 2021-11-10
Description: Azure RTOS Information Disclosure Vulnerability
CVSS Score: 3.3 (LOW)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42323; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42323
CVE: CVE-2021-43208
Published: 2021-11-10
Description: 3D Viewer Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43208; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43208
CVE: CVE-2021-43209
Published: 2021-11-10
Description: 3D Viewer Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43209; https://www.zerodayinitiative.com/advisories/ZDI-21-909/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43209
CVE: CVE-2021-22870
Published: 2021-11-10
Description: A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.19, 3.1.11, and 3.2.3. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.19; https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.11; https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.3
CVE: CVE-2021-31853
Published: 2021-11-10
Description: DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption (MDE) prior to 7.3.0 HF2 (7.3.0.183) allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10374; https://kc.mcafee.com/corporate/index?page=content&id=SB10374
CVE: CVE-2021-25974
Published: 2021-11-10
Description: In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/publify/publify/commit/fefd5f76302adcc425b2b6e7e7d23587cfc0083e; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25974; https://github.com/publify/publify/commit/fefd5f76302adcc425b2b6e7e7d23587cfc0083e
CVE: CVE-2021-25975
Published: 2021-11-10
Description: In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/publify/publify/commit/d99c0870d3dbbfde7febdc6cad33199b84770101; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25974; https://github.com/publify/publify/commit/d99c0870d3dbbfde7febdc6cad33199b84770101
CVE: CVE-2021-34582
Published: 2021-11-10
Description: In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated certificate file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cert.vde.com/en/advisories/VDE-2021-046/; https://cert.vde.com/en/advisories/VDE-2021-046/
CVE: CVE-2021-34598
Published: 2021-11-10
Description: In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://cert.vde.com/en/advisories/VDE-2021-046/; https://cert.vde.com/en/advisories/VDE-2021-046/
CVE: CVE-2021-39474
Published: 2021-11-10
Description: Vulnerability in the product Docsis 3.0 UBC1319BA00 Router supported affected version[PII_REDACTED]r009. The vulnerability allows an attacker with privileges and network access through the ping.cmd component to execute commands on the device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://saikotwolf.medium.com/f9ed24e14e51; https://www.ubeeinteractive.com/?product=ubc1319; https://saikotwolf.medium.com/f9ed24e14e51
CVE: CVE-2021-43136
Published: 2021-11-10
Description: An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/164930/FormaLMS-2.4.4-Authentication-Bypass.html; https://blog.hacktivesecurity.com; https://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass/
CVE: CVE-2021-38887
Published: 2021-11-10
Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information from application response requests that could be used in further attacks against the system. IBM X-Force ID: 209401.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209401; https://www.ibm.com/support/pages/node/6510178; https://exchange.xforce.ibmcloud.com/vulnerabilities/209401