deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1550
Published: 2021-05-22
Description: Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG
CVE: CVE-2021-1551
Published: 2021-05-22
Description: Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG
CVE: CVE-2021-1552
Published: 2021-05-22
Description: Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG
CVE: CVE-2021-1553
Published: 2021-05-22
Description: Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG
CVE: CVE-2021-1554
Published: 2021-05-22
Description: Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG
CVE: CVE-2021-1555
Published: 2021-05-22
Description: Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities, the attacker must have valid administrative credentials for the device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG
CVE: CVE-2021-1557
Published: 2021-05-22
Description: Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. These vulnerabilities are due to insufficient restrictions during the execution of affected CLI commands. An attacker could exploit these vulnerabilities by leveraging the insufficient restrictions during execution of these commands. A successful exploit could allow the attacker to elevate privileges from dnasadmin and execute arbitrary commands on the underlying operating system as root.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-prvesc-q6T6BzW; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-prvesc-q6T6BzW
CVE: CVE-2021-1558
Published: 2021-05-22
Description: Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. These vulnerabilities are due to insufficient restrictions during the execution of affected CLI commands. An attacker could exploit these vulnerabilities by leveraging the insufficient restrictions during execution of these commands. A successful exploit could allow the attacker to elevate privileges from dnasadmin and execute arbitrary commands on the underlying operating system as root.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-prvesc-q6T6BzW; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-prvesc-q6T6BzW
CVE: CVE-2021-1559
Published: 2021-05-22
Description: Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected device. These vulnerabilities are due to insufficient input sanitization when executing affected commands. A high-privileged attacker could exploit these vulnerabilities on a Cisco DNA Spaces Connector by injecting crafted input during command execution. A successful exploit could allow the attacker to execute arbitrary commands as root within the Connector docker container.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-cmdinj-HOj4YV5n; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-cmdinj-HOj4YV5n
CVE: CVE-2021-1560
Published: 2021-05-22
Description: Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected device. These vulnerabilities are due to insufficient input sanitization when executing affected commands. A high-privileged attacker could exploit these vulnerabilities on a Cisco DNA Spaces Connector by injecting crafted input during command execution. A successful exploit could allow the attacker to execute arbitrary commands as root within the Connector docker container.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78, CWE-77
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-cmdinj-HOj4YV5n; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-cmdinj-HOj4YV5n
CVE: CVE-2021-20713
Published: 2021-05-24
Description: Privilege escalation vulnerability in QND Advance/Premium/Standard Ver.11.0.4i and earlier allows an attacker who can log in to the PC where the product's Windows client is installed to gain administrative privileges via unspecified vectors. As a result, sensitive information may be altered/obtained or unintended operations may be performed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://jvn.jp/en/jp/JVN74686032/index.html; https://www.qualitysoft.com/product/qnd_vulnerabilities_2021/; https://jvn.jp/en/jp/JVN74686032/index.html
CVE: CVE-2021-20722
Published: 2021-05-24
Description: Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe allows an attacker to gain privileges and execute arbitrary code with the privilege of the user invoking the installer via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jvn.jp/en/jp/JVN65733194/index.html; https://scansnap.fujitsu.com/global/dl/; https://jvn.jp/en/jp/JVN65733194/index.html
CVE: CVE-2021-20723
Published: 2021-05-24
Description: Reflected cross-site scripting vulnerability in [MailForm01] free edition (versions which the last updated date listed at the top of descriptions in the program file is from 2014 December 12 to 2018 July 27) allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN53910556/index.html; https://www.php-factory.net/mail/01.php; https://jvn.jp/en/jp/JVN53910556/index.html
CVE: CVE-2021-20724
Published: 2021-05-24
Description: Reflected cross-site scripting vulnerability in the admin page of [Telop01] free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN53910556/index.html; https://www.php-factory.net/telop/01.php; https://jvn.jp/en/jp/JVN53910556/index.html
CVE: CVE-2021-20725
Published: 2021-05-24
Description: Reflected cross-site scripting vulnerability in the admin page of [Calendar01] free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN53910556/index.html; https://www.php-factory.net/calendar/01.php; https://jvn.jp/en/jp/JVN53910556/index.html
CVE: CVE-2021-20726
Published: 2021-05-24
Description: Untrusted search path vulnerability in The Installer of Overwolf 2.168.0.n and earlier allows an attacker to gain privileges and execute arbitrary code with the privilege of the user invoking the installer via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jvn.jp/en/jp/JVN78254777/index.html; https://www.overwolf.com/; https://jvn.jp/en/jp/JVN78254777/index.html
CVE: CVE-2021-33496
Published: 2021-05-24
Description: Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dutchcoders/transfer.sh/commit/9df18fdc69de2e71f30d8c1e6bfab2fda2e52eb4; https://github.com/dutchcoders/transfer.sh/pull/373; https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4
CVE: CVE-2021-33497
Published: 2021-05-24
Description: Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/dutchcoders/transfer.sh/pull/373; https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4; https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4
CVE: CVE-2021-21000
Published: 2021-05-24
Description: On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://cert.vde.com/en-us/advisories/vde-2021-014; https://cert.vde.com/en-us/advisories/vde-2021-014
CVE: CVE-2021-21001
Published: 2021-05-24
Description: On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://cert.vde.com/en-us/advisories/vde-2021-014; https://cert.vde.com/en-us/advisories/vde-2021-014
CVE: CVE-2021-24294
Published: 2021-05-24
Description: The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/43b8cfb4-f875-432b-8e3b-52653fdee87c; https://wpscan.com/vulnerability/43b8cfb4-f875-432b-8e3b-52653fdee87c
CVE: CVE-2021-24296
Published: 2021-05-24
Description: The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c450f54a-3372-49b2-8ad8-68d5cc0dd49e; https://wpscan.com/vulnerability/c450f54a-3372-49b2-8ad8-68d5cc0dd49e
CVE: CVE-2021-24297
Published: 2021-05-24
Description: The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a64a3b2e-7924-47aa-96e8-3aa02a6cdccc; https://wpscan.com/vulnerability/a64a3b2e-7924-47aa-96e8-3aa02a6cdccc
CVE: CVE-2021-24298
Published: 2021-05-24
Description: The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://codevigilant.com/disclosure/2021/wp-plugin-giveasap-xss/; https://wpscan.com/vulnerability/30aebded-3eb3-4dda-90b5-12de5e622c91; https://codevigilant.com/disclosure/2021/wp-plugin-giveasap-xss/
CVE: CVE-2021-24300
Published: 2021-05-24
Description: The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837; https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837
CVE: CVE-2021-24301
Published: 2021-05-24
Description: The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/eb8e2b9d-f153-49c9-862a-5c016934f9ad; https://wpscan.com/vulnerability/eb8e2b9d-f153-49c9-862a-5c016934f9ad
CVE: CVE-2021-24302
Published: 2021-05-24
Description: The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/372a66ca-1c3c-4429-86a5-81dbdaa9ec7d; https://wpscan.com/vulnerability/372a66ca-1c3c-4429-86a5-81dbdaa9ec7d
CVE: CVE-2021-24305
Published: 2021-05-24
Description: The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64; https://www.targetfirst.com/; https://wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64
CVE: CVE-2021-24306
Published: 2021-05-24
Description: The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/35516555-c50c-486a-886c-df49c9e51e2c; https://wpscan.com/vulnerability/35516555-c50c-486a-886c-df49c9e51e2c
CVE: CVE-2021-24307
Published: 2021-05-24
Description: The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://aioseo.com/changelog/; https://wpscan.com/vulnerability/ab2c94d2-f6c4-418b-bd14-711ed164bcf1; https://aioseo.com/changelog/
CVE: CVE-2021-24308
Published: 2021-05-24
Description: The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/162856/WordPress-LifterLMS-4.21.0-Cross-Site-Scripting.html; https://github.com/gocodebox/lifterlms/releases/tag/4.21.1; https://wpscan.com/vulnerability/f29f68a5-6575-441d-98c9-867145f2b082
CVE: CVE-2021-24332
Published: 2021-05-24
Description: The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-04-01%5D-%5BWordPress%5D-%5BCWE-79%5D-Autoptimize-WordPress-Plugin-v2.8.3.txt; https://wpscan.com/vulnerability/6678e064-ce21-4bb2-8c50-061073fb22fb; https://m0ze.ru/vulnerability/%5B2021-04-01%5D-%5BWordPress%5D-%5BCWE-79%5D-Autoptimize-WordPress-Plugin-v2.8.3.txt
CVE: CVE-2021-25938
Published: 2021-05-24
Description: In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for leveraging self XSS by attackers.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/arangodb/arangodb/commit/3e486b9bc33cc97e92645dd279899000e57f61f4; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25938; https://github.com/arangodb/arangodb/commit/3e486b9bc33cc97e92645dd279899000e57f61f4
CVE: CVE-2021-21987
Published: 2021-05-24
Description: VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (TTC Parser). A malicious actor with access to a virtual machine or remote desktop may be able to exploit these issues leading to information disclosure from the TPView process running on the system where Workstation or Horizon Client for Windows is installed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://www.vmware.com/security/advisories/VMSA-2021-0009.html; https://www.zerodayinitiative.com/advisories/ZDI-21-608/; https://www.vmware.com/security/advisories/VMSA-2021-0009.html
CVE: CVE-2021-21988
Published: 2021-05-24
Description: VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (JPEG2000 Parser). A malicious actor with access to a virtual machine or remote desktop may be able to exploit these issues leading to information disclosure from the TPView process running on the system where Workstation or Horizon Client for Windows is installed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://www.vmware.com/security/advisories/VMSA-2021-0009.html; https://www.zerodayinitiative.com/advisories/ZDI-21-609/; https://www.vmware.com/security/advisories/VMSA-2021-0009.html
CVE: CVE-2021-21989
Published: 2021-05-24
Description: VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (TTC Parser). A malicious actor with access to a virtual machine or remote desktop may be able to exploit these issues leading to information disclosure from the TPView process running on the system where Workstation or Horizon Client for Windows is installed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://www.vmware.com/security/advisories/VMSA-2021-0009.html; https://www.zerodayinitiative.com/advisories/ZDI-21-610/; https://www.vmware.com/security/advisories/VMSA-2021-0009.html