deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28969
Published: 2021-04-01
Description: eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort_by parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3. NOTE: this is different from CVE-2020-25034 and affects newer versions of the software.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-005.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-005.txt
CVE: CVE-2021-28970
Published: 2021-04-01
Description: eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the job_id parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-006.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-006.txt
CVE: CVE-2021-29421
Published: 2021-04-01
Description: models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/pikepdf/pikepdf/blob/v2.10.0/docs/release_notes.rst#v2100; https://github.com/pikepdf/pikepdf/commit/3f38f73218e5e782fe411ccbb3b44a793c0b343a; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG/
CVE: CVE-2021-28047
Published: 2021-04-01
Description: Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary web script or HTML via multiple input fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://devolutions.net/security/advisories/devo-2021-0003; https://devolutions.net/security/advisories/devo-2021-0003
CVE: CVE-2021-21416
Published: 2021-04-01
Description: django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly apply filters to sensitive data, with the result that sensitive data could be included in error reports rather than removed automatically by Django. Triggering this requires: A site is using django-registration < 3.1.2, The site has detailed error reports (such as Django's emailed error reports to site staff/developers) enabled and a server-side error (HTTP 5xx) occurs during an attempt by a user to register an account. Under these conditions, recipients of the detailed error report will see all submitted data from the account-registration attempt, which may include the user's proposed credentials (such as a password).
CVSS Score: 3.7 (LOW)
CWE: CWE-209, CWE-209
References: https://github.com/ubernostrum/django-registration/security/advisories/GHSA-58c7-px5v-82hh; https://github.com/ubernostrum/django-registration/security/advisories/GHSA-58c7-px5v-82hh
CVE: CVE-2021-21420
Published: 2021-04-01
Description: vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. The update addresses the vulnerability by modifying the way the extension validates its settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://github.com/stripe/vscode-stripe/security/advisories/GHSA-j6x4-4622-8vv3; https://github.com/stripe/vscode-stripe/security/advisories/GHSA-j6x4-4622-8vv3
CVE: CVE-2021-21421
Published: 2021-04-01
Description: node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200, CWE-209
References: https://github.com/creharmony/node-etsy-client/commit/b4beb8ef080366c1a87dbf9e163051a446acaa7d; https://github.com/creharmony/node-etsy-client/security/advisories/GHSA-xw22-wv29-3299; https://github.com/creharmony/node-etsy-client/commit/b4beb8ef080366c1a87dbf9e163051a446acaa7d
CVE: CVE-2021-23921
Published: 2021-04-01
Description: An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements.
CVSS Score: 9.1 (CRITICAL)
References: https://devolutions.net/security/advisories/devo-2021-0002; https://devolutions.net/security/advisories/devo-2021-0002
CVE: CVE-2021-23922
Published: 2021-04-01
Description: An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviews.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://devolutions.net/security/advisories/devo-2021-0001; https://devolutions.net/security/advisories/devo-2021-0001
CVE: CVE-2021-23923
Published: 2021-04-01
Description: An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://devolutions.net/security/advisories/devo-2021-0002; https://devolutions.net/security/advisories/devo-2021-0002
CVE: CVE-2021-23924
Published: 2021-04-01
Description: An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://devolutions.net/security/advisories/devo-2021-0002; https://devolutions.net/security/advisories/devo-2021-0002
CVE: CVE-2021-23925
Published: 2021-04-01
Description: An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://devolutions.net/security/advisories/devo-2021-0002; https://devolutions.net/security/advisories/devo-2021-0002
CVE: CVE-2021-30002
Published: 2021-04-02
Description: An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-401
References: https://bugzilla.suse.com/show_bug.cgi?id=1184120; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.3; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fb18802a338b36f675a388fc03d2aa504a0d0899
CVE: CVE-2021-30003
Published: 2021-04-02
Description: An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface via urlfilter.cgi?add url_address.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://research.0xdutra.com/posts/router-g120w-f/; https://research.0xdutra.com/posts/router-g120w-f/
CVE: CVE-2021-30004
Published: 2021-04-02
Description: In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://security.gentoo.org/glsa/202309-16; https://w1.fi/cgit/hostap/commit/?id=a0541334a6394f8237a4393b7372693cd7e96f15; https://security.gentoo.org/glsa/202309-16
CVE: CVE-2021-30000
Published: 2021-04-02
Description: An issue was discovered in LATRIX 0.6.0. SQL injection in the txtaccesscode parameter of inandout.php leads to information disclosure and code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/cptsticky/A-0day-Per-Day-Keeps-The-Cope-Away/blob/main/CVE-2021-30000; https://sourceforge.net/projects/latrix/; https://github.com/cptsticky/A-0day-Per-Day-Keeps-The-Cope-Away/blob/main/CVE-2021-30000
CVE: CVE-2021-22696
Published: 2021-04-02
Description: CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-918, CWE-918
References: http://www.openwall.com/lists/oss-security/2021/04/02/2; https://cxf.apache.org/security-advisories.data/CVE-2021-22696.txt.asc; https://lists.apache.org/thread.html/r6445001cc5f9a2bb1e[PII_REDACTED]306e054bdd1d702656b7cbe59045%40%3Cannounce.apache.org%3E
CVE: CVE-2021-25893
Published: 2021-04-02
Description: Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.magnolia-cms.com/product-docs/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#ReleasenotesforMagnoliaCMS6.2.4-Notablebugfixes; https://www.itas.vn/itas-security-team-found-multi-vulnerabilities-on-magnolia-cms-platform/; https://www.magnolia-cms.com
CVE: CVE-2021-25894
Published: 2021-04-02
Description: Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://git.magnolia-cms.com/projects/MODULES/repos/public-user-registration/commits/80c096c24d39ba2050b778e68ef838d79d4811dc; https://www.itas.vn/itas-security-team-found-multi-vulnerabilities-on-magnolia-cms-platform/; https://www.magnolia-cms.com/
CVE: CVE-2021-29011
Published: 2021-04-02
Description: DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164154/DMA-Softlab-Radius-Manager-4.4.0-Session-Management-Cross-Site-Scripting.html; https://github.com/1d8/publications/tree/main/cve-2021-29011; https://sourceforge.net/projects/radiusmanager/
CVE: CVE-2021-29012
Published: 2021-04-02
Description: DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid (temporarily) during times when the admin is logged out. In other words, the cookie is functionally equivalent to a static password, and thus provides permanent access if stolen.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/164154/DMA-Softlab-Radius-Manager-4.4.0-Session-Management-Cross-Site-Scripting.html; https://github.com/1d8/publications/tree/main/cve-2021-29012; https://sourceforge.net/projects/radiusmanager/
CVE: CVE-2021-29651
Published: 2021-04-02
Description: Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/pomerium/pomerium/security/advisories/GHSA-35vc-w93w-75c2; https://github.com/pomerium/pomerium/security/advisories/GHSA-35vc-w93w-75c2
CVE: CVE-2021-29652
Published: 2021-04-02
Description: Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/pomerium/pomerium/security/advisories/GHSA-fv82-r8qv-ch4v; https://github.com/pomerium/pomerium/security/advisories/GHSA-fv82-r8qv-ch4v
CVE: CVE-2021-21400
Published: 2021-04-02
Description: wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat when the user does not actively give focus to the input field. Input element focus is enforced programatically in version 2021-03-15-production.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200, CWE-200
References: https://github.com/wireapp/wire-webapp/commit/281f2a9d795f68abe423c116d5da4e1e73a60062; https://github.com/wireapp/wire-webapp/pull/10704; https://github.com/wireapp/wire-webapp/releases/tag/2021-03-15-production.0
CVE: CVE-2021-28113
Published: 2021-04-02
Description: A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: http://packetstormsecurity.com/files/163428/Okta-Access-Gateway-2020.5.5-Authenticated-Remote-Root.html; https://www.okta.com/security-advisories/cve-2021-28113; http://packetstormsecurity.com/files/163428/Okta-Access-Gateway-2020.5.5-Authenticated-Remote-Root.html
CVE: CVE-2021-28123
Published: 2021-04-02
Description: Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. The ssh key can provide an attacker access to the linux system in the affected version.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-28123.md; https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-28123.md
CVE: CVE-2021-28124
Published: 2021-04-02
Description: A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. Missing server authentication in impacted versions can allow an attacker to Man-in-the-middle (MITM) support channel UI session to Cohesity DataPlatform cluster.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-306
References: https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-28124.md; https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-28124.md
CVE: CVE-2019-20463
Published: 2021-04-02
Description: An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2[PII_REDACTED]17 devices. A crash and reboot can be triggered by crafted IP traffic, as demonstrated by the Nikto vulnerability scanner. For example, sending the 111111 string to UDP port 20188 causes a reboot. To deny service for a long time period, the crafted IP traffic may be sent periodically.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/; http://seclists.org/fulldisclosure/2024/Jul/14
CVE: CVE-2019-20464
Published: 2021-04-02
Description: An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2[PII_REDACTED]17 devices. By default, a mobile application is used to stream over UDP. However, the device offers many more services that also enable streaming. Although the service used by the mobile application requires a password, the other streaming services do not. By initiating communication on the RTSP port, an attacker can obtain access to the video feed without authenticating.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/; http://seclists.org/fulldisclosure/2024/Jul/14
CVE: CVE-2019-20465
Published: 2021-04-02
Description: An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2[PII_REDACTED]17 devices. It is possible (using TELNET without a password) to control the camera's pan/zoom/tilt functionality.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/; http://seclists.org/fulldisclosure/2024/Jul/14
CVE: CVE-2019-20466
Published: 2021-04-02
Description: An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2[PII_REDACTED]17 devices. A local attacker with the "default" account is capable of reading the /etc/passwd file, which contains a weakly hashed root password. By taking this hash and cracking it, the attacker can obtain root rights on the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-916, CWE-916
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/; http://seclists.org/fulldisclosure/2024/Jul/14
CVE: CVE-2020-11922
Published: 2021-04-02
Description: An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent encrypted and has low risk in isolation, it decreases the privacy of the end user. The information sent includes the local IP address being used and the SSID of the Wi-Fi network the device is connected to. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://cwe.mitre.org/data/definitions/201.html; https://www.eurofins-cybersecurity.com/news/connected-devices-wiz-smart-lightbulbs/
CVE: CVE-2020-11925
Published: 2021-04-02
Description: An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522, CWE-521
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitor/; http://seclists.org/fulldisclosure/2024/Jul/14
CVE: CVE-2021-22196
Published: 2021-04-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22196.json; https://gitlab.com/gitlab-org/gitlab/-/issues/254710; https://hackerone.com/reports/977697
CVE: CVE-2021-22197
Published: 2021-04-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other
CVSS Score: 3.5 (LOW)
CWE: CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22197.json; https://gitlab.com/gitlab-org/gitlab/-/issues/323198; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22197.json
CVE: CVE-2021-22198
Published: 2021-04-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of public projects.
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22198.json; https://gitlab.com/gitlab-org/gitlab/-/issues/323452; https://hackerone.com/reports/1107281
CVE: CVE-2021-22200
Published: 2021-04-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user.
CVSS Score: 5.9 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22200.json; https://gitlab.com/gitlab-org/gitlab/-/issues/247523; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22200.json
CVE: CVE-2021-22201
Published: 2021-04-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server.
CVSS Score: 9.6 (CRITICAL)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22201.json; https://gitlab.com/gitlab-org/gitlab/-/issues/325562; https://hackerone.com/reports/1132378
CVE: CVE-2021-22202
Published: 2021-04-02
Description: An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.
CVSS Score: 2.4 (LOW)
CWE: CWE-352
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22202.json; https://gitlab.com/gitlab-org/gitlab/-/issues/26017; https://hackerone.com/reports/471274
CVE: CVE-2021-22203
Published: 2021-04-02
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server.
CVSS Score: 7.5 (HIGH)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22203.json; https://gitlab.com/gitlab-org/gitlab/-/issues/320919; https://hackerone.com/reports/1098793
CVE: CVE-2020-10001
Published: 2021-04-02
Description: An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to read restricted memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://lists.debian.org/debian-lts-announce/2021/10/msg00027.html; https://support.apple.com/en-us/HT212011; https://lists.debian.org/debian-lts-announce/2021/10/msg00027.html
CVE: CVE-2020-10008
Published: 2021-04-02
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.0.1. A malicious application with root privileges may be able to access private information.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT211931; https://support.apple.com/en-us/HT211931
CVE: CVE-2020-10015
Published: 2021-04-02
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT211931; https://support.apple.com/en-us/HT212011; https://support.apple.com/en-us/HT211931
CVE: CVE-2020-27893
Published: 2021-04-02
Description: An issue existed in screen sharing. This issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. A user with screen sharing access may be able to view another user's screen.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/HT211931; https://support.apple.com/en-us/HT211931
CVE: CVE-2020-27897
Published: 2021-04-02
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT211931; https://support.apple.com/en-us/HT212011; https://www.zerodayinitiative.com/advisories/ZDI-21-486/
CVE: CVE-2020-27899
Published: 2021-04-02
Description: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.2 and iPadOS 14.2, macOS Big Sur 11.0.1, watchOS 7.1, tvOS 14.2. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://support.apple.com/en-us/HT211928; https://support.apple.com/en-us/HT211929; https://support.apple.com/en-us/HT211930