deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3511
Published: 2021-04-28
Description: Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to obtain information such as configuration via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/vu/JVNVU99235714/index.html; https://www.buffalo.jp/news/detail/20210427-01.html; https://jvn.jp/en/vu/JVNVU99235714/index.html
CVE: CVE-2021-3512
Published: 2021-04-28
Description: Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to bypass access restriction and to start telnet service and execute arbitrary OS commands with root privileges via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: https://jvn.jp/en/vu/JVNVU99235714/index.html; https://www.buffalo.jp/news/detail/20210427-01.html; https://jvn.jp/en/vu/JVNVU99235714/index.html
CVE: CVE-2021-31815
Published: 2021-04-28
Description: GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a user's location history, in-person social graph, and (sometimes) COVID-19 infection status, because Rolling Proximity Identifiers and MAC addresses are written to the Android system log, and many Android devices have applications (preinstalled by the hardware manufacturer or network operator) that read system log data and send it to third parties. NOTE: a news outlet (The Markup) states that they received a vendor response indicating that fix deployment "began several weeks ago and will be complete in the coming days."
CVSS Score: 3.3 (LOW)
CWE: CWE-319
References: https://blog.appcensus.io/2021/04/27/why-google-should-stop-logging-contact-tracing-data/; https://themarkup.org/privacy/2021/04/27/google-promised-its-contact-tracing-app-was-completely-private-but-it-wasnt; https://blog.appcensus.io/2021/04/27/why-google-should-stop-logging-contact-tracing-data/
CVE: CVE-2020-36326
Published: 2021-04-28
Description: PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT/
CVE: CVE-2021-31856
Published: 2021-04-28
Description: A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/layer5io/meshery/pull/2745; https://meshery.io; https://github.com/layer5io/meshery/pull/2745
CVE: CVE-2021-27933
Published: 2021-04-28
Description: pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2021/Apr/61; http://seclists.org/fulldisclosure/2021/Apr/61
CVE: CVE-2021-31777
Published: 2021-04-28
Description: The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/162429/TYPO3-6.2.1-SQL-Injection.html; https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-31777; https://excellium-services.com/cert-xlm-advisory/
CVE: CVE-2021-31778
Published: 2021-04-28
Description: The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://typo3.org/security/advisory/typo3-ext-sa-2021-004; https://typo3.org/security/advisory/typo3-ext-sa-2021-004
CVE: CVE-2021-31779
Published: 2021-04-28
Description: The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://typo3.org/security/advisory/typo3-ext-sa-2021-006; https://typo3.org/security/advisory/typo3-ext-sa-2021-006
CVE: CVE-2021-31863
Published: 2021-04-28
Description: Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/news/131; https://www.redmine.org/projects/redmine/wiki/Security_Advisories
CVE: CVE-2021-31864
Published: 2021-04-28
Description: Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incoming mail handler.
CVSS Score: 5.3 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/news/131; https://www.redmine.org/projects/redmine/wiki/Security_Advisories
CVE: CVE-2021-31865
Published: 2021-04-28
Description: Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments.
CVSS Score: 5.3 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/news/131; https://www.redmine.org/projects/redmine/wiki/Security_Advisories
CVE: CVE-2021-31866
Published: 2021-04-28
Description: Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html; https://www.redmine.org/news/131; https://www.redmine.org/projects/redmine/wiki/Security_Advisories
CVE: CVE-2021-27648
Published: 2021-04-28
Description: Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote authenticated users to obtain privilege via unspecified vectors.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-610, CWE-610
References: https://www.synology.com/security/advisory/Synology_SA_21_15; https://www.synology.com/security/advisory/Synology_SA_21_15
CVE: CVE-2021-30166
Published: 2021-04-28
Description: The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e; https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388; https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
CVE: CVE-2021-30167
Published: 2021-04-28
Description: The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-306
References: https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e; https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388; https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
CVE: CVE-2021-30168
Published: 2021-04-28
Description: The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-522
References: https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e; https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388; https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
CVE: CVE-2021-30169
Published: 2021-04-28
Description: The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-522
References: https://gist.github.com/keniver/86ebef688fb274b534da51ef1a84dd3e; https://www.chtsecurity.com/news/0b733a38-e616-4ff3-86a6-13e710643388; https://www.meritlilin.com/assets/uploads/support/file/M00166-TW.pdf
CVE: CVE-2021-22327
Published: 2021-04-28
Description: There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing. Due to insufficient validation of the input files, successful exploit could cause certain service abnormal. Affected product versions include:HUAWEI P30 versions 10.0.0.186(C10E7R5P1), 10.0.0.186(C461E4R3P1), 10.0.0.188(C00E85R2P11), 10.0.0.188(C01E88R2P11),10.0.0.188(C605E19R1P3), 10.0.0.190(C185E4R7P1), 10.0.0.190(C431E22R2P5), 10.0.0.190(C432E22R2P5),10.0.0.190(C605E19R1P3), 10.0.0.190(C636E4R3P4), 10.0.0.192(C635E3R2P4).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210331-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210331-01-smartphone-en
CVE: CVE-2021-22330
Published: 2021-04-28
Description: There is an out of bounds write vulnerability in Huawei Smartphone HUAWEI P30 versions 9.1.0.131(C00E130R1P21) when processing a message. An unauthenticated attacker can exploit this vulnerability by sending specific message to the target device. Due to insufficient validation of the input parameter, successful exploit can cause the process and the service to be abnormal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210331-01-p30-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210331-01-p30-en
CVE: CVE-2021-22393
Published: 2021-04-28
Description: There is a denial of service vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800. The affected product cannot deal with some messages because of module design weakness . Attackers can exploit this vulnerability by sending a large amount of specific messages to cause denial of service. This can compromise normal service.
CVSS Score: 7.5 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210324-01-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210324-01-dos-en
CVE: CVE-2021-22514
Published: 2021-04-28
Description: An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51. The vulnerability could allow remote attackers to execute arbitrary code on affected installations of APM.
CVSS Score: 9.8 (CRITICAL)
References: https://softwaresupport.softwaregrp.com/doc/KM03806649; https://softwaresupport.softwaregrp.com/doc/KM03806649
CVE: CVE-2021-22331
Published: 2021-04-28
Description: There is a JavaScript injection vulnerability in certain Huawei smartphones. A module does not verify some inputs sufficiently. Attackers can exploit this vulnerability by sending a malicious application request to launch JavaScript injection. This may compromise normal service. Affected product versions include HUAWEI P30 versions earlier than 10.1.0.165(C01E165R2P11), 11.0.0.118(C635E2R1P3), 11.0.0.120(C00E120R2P5), 11.0.0.138(C10E4R5P3), 11.0.0.138(C185E4R7P3), 11.0.0.138(C432E8R2P3), 11.0.0.138(C461E4R3P3), 11.0.0.138(C605E4R1P3), and 11.0.0.138(C636E4R3P3).
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210331-01-js-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210331-01-js-en
CVE: CVE-2021-22332
Published: 2021-04-28
Description: There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800. When a function is called, the same memory pointer is copied to two functional modules. Attackers can exploit this vulnerability by performing a malicious operation to cause the pointer double free. This may lead to module crash, compromising normal service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210407-01-doublefree-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210407-01-doublefree-en
CVE: CVE-2020-18019
Published: 2021-04-28
Description: SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "mode_worcAction.php" component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/si1ence90/xinhu1.8.3_SqlInject; https://github.com/si1ence90/xinhu1.8.3_SqlInject
CVE: CVE-2020-18020
Published: 2021-04-28
Description: SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user_phone" parameter of a crafted HTTP request to the "admin.php" component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/koyshe/phpshe/issues/IQ8S8; https://gitee.com/koyshe/phpshe/issues/IQ8S8
CVE: CVE-2020-21991
Published: 2021-04-28
Description: AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin GET parameter in changeparams.php script. Setting the autologin value to 1 allows an unauthenticated attacker to permanently disable the authentication security control and access the management interface with admin privileges without providing credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.exploit-db.com/exploits/47822; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5549.php; https://www.exploit-db.com/exploits/47822
CVE: CVE-2021-29159
Published: 2021-04-28
Description: A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of the NXRM application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]82; https://support.sonatype.com/hc/en-us/categories/201980768-Welcome-to-the-Sonatype-Support-Knowledge-Base; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]82
CVE: CVE-2021-29387
Published: 2021-04-28
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remote attackers to inject arbitrary javascript via any "Add" sections, such as Add Item , Employee and Position or others in the Name Parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49722; https://www.sourcecodester.com/php/11327/equipment-inventory.html; https://www.exploit-db.com/exploits/49722
CVE: CVE-2021-29388
Published: 2021-04-28
Description: A stored cross-site scripting (XSS) vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php via vulnerable field 'Budget Title'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49723; https://www.sourcecodester.com/php/14403/budget-management-system.html; https://www.exploit-db.com/exploits/49723
CVE: CVE-2021-3508
Published: 2021-04-28
Description: A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=1951198; https://github.com/enferex/pdfresurrect/issues/17; https://bugzilla.redhat.com/show_bug.cgi?id=1951198
CVE: CVE-2020-21993
Published: 2021-04-28
Description: In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5551.php; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-21994
Published: 2021-04-28
Description: AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file '/xml/authClients.xml' and obtain administrative login information that allows for a successful authentication bypass attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://cwe.mitre.org/data/definitions/522.html; https://www.exploit-db.com/exploits/47819; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5550.php
CVE: CVE-2020-21996
Published: 2021-04-28
Description: AVE DOMINAplus <=1.10.x suffers from an unauthenticated reboot command execution. Attackers can exploit this issue to cause a denial of service scenario.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://cwe.mitre.org/data/definitions/306.html; https://www.exploit-db.com/exploits/47820; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5548.php
CVE: CVE-2020-7123
Published: 2021-04-28
Description: A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.8 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-009.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-009.txt
CVE: CVE-2021-25147
Published: 2021-04-28
Description: A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-010.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-010.txt
CVE: CVE-2020-17999
Published: 2021-04-28
Description: Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/bg5sbk/MiniCMS/issues/27; https://github.com/bg5sbk/MiniCMS/issues/27
CVE: CVE-2020-18022
Published: 2021-04-28
Description: Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hpj233/qibocms/blob/master/v7; https://github.com/hpj233/qibocms/blob/master/v7
CVE: CVE-2021-23364
Published: 2021-04-28
Description: The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474; https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98; https://github.com/browserslist/browserslist/pull/593
CVE: CVE-2021-25151
Published: 2021-04-28
Description: A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-010.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-010.txt
CVE: CVE-2021-25153
Published: 2021-04-28
Description: A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-010.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-010.txt
CVE: CVE-2021-25154
Published: 2021-04-28
Description: A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-010.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-010.txt