deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-32773
Published: 2021-07-20
Description: Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules instead of their intended dependencies. This could allow system functions to be controlled by the attacker, giving access to facilities intended to be restricted. This problem is fixed in Racket version 8.2. A workaround is available, depending on system settings. For systems that provide arbitrary Racket evaluation, external sandboxing such as containers limit the impact of the problem. For multi-user evaluation systems, such as the `handin-server` system, it is not possible to work around this problem and upgrading is required.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-441, CWE-610
References: https://github.com/racket/racket/commit/6ca4ffeca1e5877d44f835760ad89f18488d97e1; https://github.com/racket/racket/security/advisories/GHSA-cgrw-p7p7-937c; https://github.com/racket/racket/commit/6ca4ffeca1e5877d44f835760ad89f18488d97e1
CVE: CVE-2021-32774
Published: 2021-07-20
Description: DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in commit 67a82b76e186925330b89ace9c5fd893a300830b. There are no known workarounds. You must completely disable DataDump.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/miraheze/DataDump/commit/67a82b76e186925330b89ace9c5fd893a300830b; https://github.com/miraheze/DataDump/security/advisories/GHSA-29mh-4vhv-x8mr; https://phabricator.miraheze.org/T7593
CVE: CVE-2021-26081
Published: 2021-07-20
Description: REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-72499; https://jira.atlassian.com/browse/JRASERVER-72499
CVE: CVE-2021-26082
Published: 2021-07-20
Description: The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72393; https://jira.atlassian.com/browse/JRASERVER-72393
CVE: CVE-2021-26083
Published: 2021-07-20
Description: Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72213; https://jira.atlassian.com/browse/JRASERVER-72213
CVE: CVE-2019-25050
Published: 2021-07-20
Description: netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15143; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15156; https://github.com/OSGeo/gdal/commit/27b9bf644bcf1208f7d6594bdd104cc8a8bb0646
CVE: CVE-2019-25051
Published: 2021-07-20
Description: objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18462; https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/aspell/OSV-2020-521.yaml
CVE: CVE-2020-36428
Published: 2021-07-20
Description: matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4).
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21421; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/matio/OSV-2020-799.yaml; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21421
CVE: CVE-2020-36429
Published: 2021-07-20
Description: Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20578; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/open62541/OSV-2020-153.yaml; https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d
CVE: CVE-2020-36430
Published: 2021-07-20
Description: libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libass/OSV-2020-2099.yaml; https://github.com/libass/libass/commit/017137471d0043e0321e377ed8da48e45a3ec632
CVE: CVE-2020-36431
Published: 2021-07-20
Description: Unicorn Engine 1.0.2 has an out-of-bounds write in helper_wfe_arm.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20245; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unicorn/OSV-2020-837.yaml; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20245
CVE: CVE-2021-35054
Published: 2021-07-20
Description: Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN53278122/index.html; https://vuln.ryotak.me/advisories/55; https://www.minecraft.net/en-us/article/minecraft-java-edition-1-16-5
CVE: CVE-2021-36976
Published: 2021-07-20
Description: libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://seclists.org/fulldisclosure/2022/Mar/27; http://seclists.org/fulldisclosure/2022/Mar/28; http://seclists.org/fulldisclosure/2022/Mar/29
CVE: CVE-2021-36977
Published: 2021-07-20
Description: matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265; https://github.com/HDFGroup/hdf5/issues/272; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/matio/OSV-2021-440.yaml
CVE: CVE-2021-36978
Published: 2021-07-20
Description: QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28262; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qpdf/OSV-2020-2245.yaml; https://github.com/qpdf/qpdf/commit/dc92574c10f3e2516ec6445b88c5d584f40df4e5
CVE: CVE-2021-36979
Published: 2021-07-20
Description: Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_armeb (called from cpu_arm_exec_armeb and tcg_cpu_exec_armeb).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30391; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unicorn/OSV-2020-2305.yaml; https://github.com/unicorn-engine/unicorn/commit/bf1713d9e011b55ca1f502a6779fc4722b4bb077
CVE: CVE-2021-36980
Published: 2021-07-20
Description: Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/openvswitch/OSV-2020-2197.yaml; https://github.com/openvswitch/ovs/commit/38744b1bcb022c611712527f[PII_REDACTED]00f58f
CVE: CVE-2020-7866
Published: 2021-07-20
Description: When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://support.tobesoft.co.kr/Support/index.html; https://krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=36082; http://support.tobesoft.co.kr/Support/index.html
CVE: CVE-2021-22125
Published: 2021-07-20
Description: An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://fortiguard.com/advisory/FG-IR-21-005; https://fortiguard.com/advisory/FG-IR-21-005
CVE: CVE-2021-24022
Published: 2021-07-20
Description: A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an authenticated, local attacker to perform a Denial of Service attack by running the `diagnose system geoip-city` command with a large ip value.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://fortiguard.com/advisory/FG-IR-20-194; https://fortiguard.com/advisory/FG-IR-20-194
CVE: CVE-2021-26095
Published: 2021-07-20
Description: The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.
CVSS Score: 7.5 (HIGH)
References: https://fortiguard.com/advisory/FG-IR-21-019; https://fortiguard.com/advisory/FG-IR-21-019
CVE: CVE-2021-27021
Published: 2021-07-20
Description: A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1027, CWE-89
References: https://puppet.com/security/cve/cve-2021-27021/; https://puppet.com/security/cve/cve-2021-27021/
CVE: CVE-2021-32463
Published: 2021-07-20
Description: An incorrect permission assignment denial-of-service vulnerability in Trend Micro Apex One, Apex One as a Service (SaaS), Worry-Free Business Security 10.0 SP1 and Worry-Free Servgices could allow a local attacker to escalate privileges and delete files with system privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://success.trendmicro.com/solution/000286855; https://success.trendmicro.com/solution/000286856; https://www.zerodayinitiative.com/advisories/ZDI-21-786/
CVE: CVE-2020-15660
Published: 2021-07-20
Description: Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a CSRF vulnerability, that might, when paired with a specifically prepared request, lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/02/07/3; https://github.com/mozilla/geckodriver/releases/tag/v0.27.0; http://www.openwall.com/lists/oss-security/2022/02/07/3
CVE: CVE-2021-22235
Published: 2021-07-20
Description: Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0 to 3.2.14 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22235.json; https://gitlab.com/wireshark/wireshark/-/issues/17462; https://lists.debian.org/debian-lts-announce/2021/12/msg00015.html
CVE: CVE-2021-27338
Published: 2021-07-20
Description: Faraday Edge before 3.7 allows XSS via the network/create/ page and its network name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Pho03niX/CVE-2021-27338/blob/main/CVE-2021-27338; https://www.faraday.net/products/faradayedge; https://github.com/Pho03niX/CVE-2021-27338/blob/main/CVE-2021-27338
CVE: CVE-2021-27517
Published: 2021-07-20
Description: Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious PDF document containing embedded JavaScript code that abuses app.alert (in the Acrobat JavaScript API).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-35427
Published: 2021-07-20
Description: SQL injection vulnerability in PHPGurukul Employee Record Management System 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://phpgurukul.com/; https://www.exploit-db.com/exploits/49165; https://phpgurukul.com/
CVE: CVE-2021-32667
Published: 2021-07-20
Description: TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-8mq9-fqv8-59wf; https://typo3.org/security/advisory/typo3-core-sa-2021-009; https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-8mq9-fqv8-59wf
CVE: CVE-2021-32668
Published: 2021-07-20
Description: TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-6mh3-j5r5-2379; https://typo3.org/security/advisory/typo3-core-sa-2021-010; https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-6mh3-j5r5-2379
CVE: CVE-2021-3246
Published: 2021-07-20
Description: A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/libsndfile/libsndfile/issues/687; https://lists.debian.org/debian-lts-announce/2021/07/msg00024.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUDCEMMPRA3IYYYHVZUOUZXI65FU37V/
CVE: CVE-2021-32669
Published: 2021-07-20
Description: TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for _backend layouts_ are not properly encoded, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-rgcg-28xm-8mmw; https://typo3.org/security/advisory/typo3-core-sa-2021-011; https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-rgcg-28xm-8mmw
CVE: CVE-2021-32767
Published: 2021-07-20
Description: TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-34fr-fhqr-7235; https://typo3.org/security/advisory/typo3-core-sa-2021-012; https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-34fr-fhqr-7235
CVE: CVE-2021-20478
Published: 2021-07-20
Description: IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self service console. IBM X-Force ID: 197497.
CVSS Score: 3.3 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197497; https://www.ibm.com/support/pages/node/6473065; https://exchange.xforce.ibmcloud.com/vulnerabilities/197497
CVE: CVE-2021-32763
Published: 2021-07-20
Description: OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip `<pre>` tags from the message being quoted. The `(.|\s)` part can match a space character in two ways, so an unterminated `<pre>` tag containing `n` spaces causes Ruby's regex engine to backtrack to try 2<sup>n</sup> states in the NFA. This will result in a Regular Expression Denial of Service. The issue is fixed in OpenProject 11.3.3. As a workaround, one may install the patch manually.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/opf/openproject/pull/9447.patch; https://github.com/opf/openproject/security/advisories/GHSA-qqvp-j6gm-q56f; https://github.com/opf/openproject/pull/9447.patch
CVE: CVE-2020-25205
Published: 2021-07-20
Description: The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain arbitrary JavaScript. The file contents are then used as part of a welcome/banner message presented to unauthenticated users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://labs.f-secure.com/advisories/; https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/; https://labs.f-secure.com/advisories/
CVE: CVE-2020-25206
Published: 2021-07-20
Description: The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafted POST requests to the affected endpoints (/core/api/calls/Throughput.php, /core/api/calls/WANStats.php, /core/api/calls/PhyStats.php, /core/api/calls/QosStats.php). This results in the complete takeover of the vulnerable device. This vulnerability does not occur in the older 1.5.x firmware versions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cwe.mitre.org/data/definitions/78.html; https://labs.f-secure.com/advisories/; https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/
CVE: CVE-2021-33909
Published: 2021-07-20
Description: fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html; http://packetstormsecurity.com/files/163671/Kernel-Live-Patch-Security-Notice-LSN-0079-1.html; http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html
CVE: CVE-2021-33910
Published: 2021-07-20
Description: basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html; http://www.openwall.com/lists/oss-security/2021/08/04/2; http://www.openwall.com/lists/oss-security/2021/08/17/3
CVE: CVE-2020-23284
Published: 2021-07-20
Description: Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL application that connect into the database which reveals internal and sensitive information without logging into the web application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://github.com/ifmacedo/mconnect/blob/main/sensitiveDataExposure; https://github.com/ifmacedo/mconnect/blob/main/sensitiveDataExposure
CVE: CVE-2021-36230
Published: 2021-07-20
Description: HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://discuss.hashicorp.com/t/hcsec-2021-18-terraform-enterprise-allowed-privilege-escalation-via-run-token/27070; https://www.hashicorp.com/blog/category/terraform/; https://discuss.hashicorp.com/t/hcsec-2021-18-terraform-enterprise-allowed-privilege-escalation-via-run-token/27070
CVE: CVE-2021-36746
Published: 2021-07-20
Description: Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/cseasholtz/CVE-2021-36746; https://github.com/cseasholtz/CVE-2021-36746
CVE: CVE-2021-36747
Published: 2021-07-20
Description: Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/cseasholtz/CVE-2021-36747; https://github.com/cseasholtz/CVE-2021-36747