deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-36209
Published: 2021-08-06
Description: In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-36351
Published: 2021-08-06
Description: SQL Injection Vulnerability in Care2x Open Source Hospital Information Management 2.7 Alpha via the (1) pday, (2) pmonth, and (3) pyear parameters in GET requests sent to /modules/nursing/nursing-station.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://securityforeveryone.com/blog/care2x-hospital-information-management-system-0-day-vulnerability-cve-2021-36351; https://www.exploit-db.com/exploits/50165; https://securityforeveryone.com/blog/care2x-hospital-information-management-system-0-day-vulnerability-cve-2021-36351
CVE: CVE-2021-36705
Published: 2021-08-06
Description: In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contains a trivial command injection where the value of the TR069_local_port parameter is passed directly to system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#tr069-command-injection; https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#tr069-command-injection
CVE: CVE-2021-36706
Published: 2021-08-06
Description: In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD contains a trivial command injection where the value of the command parameter is passed directly to system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#syscmd-command-injection; https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#syscmd-command-injection
CVE: CVE-2021-36707
Published: 2021-08-06
Description: In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff contains a trivial command injection where the value of the led_cmd parameter is passed directly to do_system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#ledonoff-command-injection; https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#ledonoff-command-injection
CVE: CVE-2021-36708
Published: 2021-08-06
Description: In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset the password to the administrative interface of the router.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640
References: https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#sysinit-password-reset; https://www.ayrx.me/prolink-prc2402m-multiple-vulnerabilities/#sysinit-password-reset
CVE: CVE-2021-37540
Published: 2021-08-06
Description: In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37541
Published: 2021-08-06
Description: In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74, CWE-640
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37542
Published: 2021-08-06
Description: In JetBrains TeamCity before 2020.2.3, XSS was possible.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37543
Published: 2021-08-06
Description: In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects.
CVSS Score: 8.8 (HIGH)
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37544
Published: 2021-08-06
Description: In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37545
Published: 2021-08-06
Description: In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37546
Published: 2021-08-06
Description: In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37547
Published: 2021-08-06
Description: In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37548
Published: 2021-08-06
Description: In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37549
Published: 2021-08-06
Description: In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.
CVSS Score: 9.1 (CRITICAL)
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37550
Published: 2021-08-06
Description: In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37551
Published: 2021-08-06
Description: In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-916
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37552
Published: 2021-08-06
Description: In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37553
Published: 2021-08-06
Description: In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-37554
Published: 2021-08-06
Description: In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.
CVSS Score: 4.3 (MEDIUM)
References: https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/; https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021/
CVE: CVE-2021-26606
Published: 2021-08-06
Description: A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficient validation of the authorization certificate. An attacker could exploit this vulnerability by sending a crafted HTTP request an affected program. A successful exploit could allow the attacker to remotely execute arbitrary code on a target system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-120, CWE-20, CWE-120
References: https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36174; https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36174
CVE: CVE-2021-26998
Published: 2021-08-06
Description: NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with auto-upgrade disabled are advised to upgrade to a fixed version.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2021-26999
Published: 2021-08-06
Description: NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The logged information is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with auto-upgrade disabled are advised to upgrade to a fixed version.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2021-38136
Published: 2021-08-06
Description: Corero SecureWatch Managed Services 9.7.2.0020 is affected by a Path Traversal vulnerability via the snap_file parameter in the /it-IT/splunkd/__raw/services/get_snapshot HTTP API endpoint. A ‘low privileged’ attacker can read any file on the target host.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.corero.com/blog/data-sheets-corero-securewatch-managed-services/; https://www.shielder.it/advisories/corero_secure_watch_managed_services-get_snapshot-path-traversal/; https://www.corero.com/blog/data-sheets-corero-securewatch-managed-services/
CVE: CVE-2021-38137
Published: 2021-08-06
Description: Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user’s privileges, allowing a user to perform actions not belonging to his role.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://www.corero.com/blog/data-sheets-corero-securewatch-managed-services/; https://www.shielder.it/advisories/corero_secure_watch_managed_services-multiple-broken-access-control/; https://www.corero.com/blog/data-sheets-corero-securewatch-managed-services/
CVE: CVE-2021-36454
Published: 2021-08-06
Description: Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) blocks\blocks.php, 3) brands\brands.php, 4) comments\comments.php, 5) coupons\coupons.php, 6) feeds\feeds.php, 7) functions\functions.php, 8) items\items.php, 9) menus\menus.php, 10) orders\orders.php, 11) payment_methods\payment_methods.php, 12) products\products.php, 13) profiles\profiles.php, 14) shipping_methods\shipping_methods.php, 15) templates\templates.php, 16) users\users.php, 17) webdictionary\webdictionary.php, 18) websites\websites.php, and 19) webusers\webusers.php because the initial_url function is built in these files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/NavigateCMS/Navigate-CMS/issues/24; https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_4; https://github.com/NavigateCMS/Navigate-CMS/issues/24
CVE: CVE-2021-36455
Published: 2021-08-06
Description: SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/NavigateCMS/Navigate-CMS/issues/25; https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_4; https://github.com/NavigateCMS/Navigate-CMS/issues/25
CVE: CVE-2021-20594
Published: 2021-08-06
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to acquire legitimate user names registered in the module via brute-force attack on user names.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://jvn.jp/vu/JVNVU98578731/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-008_en.pdf
CVE: CVE-2021-20597
Published: 2021-08-06
Description: Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-522
References: https://jvn.jp/vu/JVNVU98578731/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf
CVE: CVE-2021-20598
Published: 2021-08-06
Description: Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to lockout a legitimate user by continuously trying login with incorrect password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://jvn.jp/vu/JVNVU98578731/index.html; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-010_en.pdf; https://jvn.jp/vu/JVNVU98578731/index.html
CVE: CVE-2021-36795
Published: 2021-08-06
Description: A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. An underprivileged linux user, if certain environment criteria are met, can gain additional privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-36795.md; https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-36795.md
CVE: CVE-2020-18693
Published: 2021-08-06
Description: Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the component '/admin/news'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/MineWeb/MineWebCMS/issues/123; https://github.com/MineWeb/MineWebCMS/issues/123
CVE: CVE-2020-18694
Published: 2021-08-06
Description: Cross Site Request Forgery (CSRF) in IgnitedCMS v1.0 allows remote attackers to obtain sensitive information and gain privilege via the component "/admin/profile/save_profile".
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ignitedcms/ignitedcms/issues/5; https://github.com/ignitedcms/ignitedcms/issues/5
CVE: CVE-2021-35312
Published: 2021-08-06
Description: A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Service.exe" has incorrect permissions, allowing a local unprivileged user to replace it with a malicious file that will be executed with "LocalSystem" privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://packetstormsecurity.com/files/163744/Amica-Prodigy-1.7-Privilege-Escalation.html; https://packetstormsecurity.com/files/163744/Amica-Prodigy-1.7-Privilege-Escalation.html; http://packetstormsecurity.com/files/163744/Amica-Prodigy-1.7-Privilege-Escalation.html
CVE: CVE-2021-38155
Published: 2021-08-06
Description: OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: http://www.openwall.com/lists/oss-security/2021/08/10/5; https://launchpad.net/bugs/1688137; https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html
CVE: CVE-2021-38157
Published: 2021-08-06
Description: LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dgccpa.com; https://gist.github.com/erud1te-sec/5c85924cb78ba85af42e0b7b62a5ec91; https://leostream.com
CVE: CVE-2020-21353
Published: 2021-08-06
Description: A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1319; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1319
CVE: CVE-2020-21356
Published: 2021-08-06
Description: An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = "file" is deleted during file uploads.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://github.com/PopojiCMS/PopojiCMS/issues/23; https://github.com/PopojiCMS/PopojiCMS/issues/23
CVE: CVE-2020-21357
Published: 2021-08-06
Description: A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the E-Mail field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PopojiCMS/PopojiCMS/issues/24; https://github.com/PopojiCMS/PopojiCMS/issues/24
CVE: CVE-2020-21358
Published: 2021-08-06
Description: A cross site request forgery (CSRF) in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/WXiangQian/wage-cms/issues/1; https://github.com/WXiangQian/wage-cms/issues/1
CVE: CVE-2020-28087
Published: 2021-08-06
Description: A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sensitive database information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/zhangdaiscott/jeecg-boot/issues/1887; https://github.com/zhangdaiscott/jeecg-boot/issues/1887
CVE: CVE-2020-28088
Published: 2021-08-06
Description: An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/zhangdaiscott/jeecg-boot/issues/1888; https://github.com/zhangdaiscott/jeecg-boot/issues/1888
CVE: CVE-2021-38148
Published: 2021-08-07
Description: Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.
CVSS Score: 9.8 (CRITICAL)
References: https://forum.obsidian.md/t/obsidian-release-v0-12-12/21564; https://forum.obsidian.md/t/obsidian-release-v0-12-12/21564
CVE: CVE-2021-38160
Published: 2021-08-07
Description: In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://access.redhat.com/security/cve/cve-2021-38160; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4; https://github.com/torvalds/linux/commit/d00d8da5869a2608e97cfede094dfc5e11462a46
CVE: CVE-2021-29922
Published: 2021-08-07
Description: library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
CVSS Score: 9.1 (CRITICAL)
References: https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis; https://doc.rust-lang.org/beta/std/net/struct.Ipv4Addr.html; https://github.com/rust-lang/rust/issues/83648
CVE: CVE-2021-29923
Published: 2021-08-07
Description: Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
CVSS Score: 7.5 (HIGH)
References: https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis; https://github.com/golang/go/issues/30999; https://github.com/golang/go/issues/43389
CVE: CVE-2021-38159
Published: 2021-08-07
Description: In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fixed versions are 2019.0.8 (11.0.8), 2019.1.7 (11.1.7), 2019.2.4 (11.2.4), 2020.0.7 (12.0.7), 2020.1.6 (12.1.6), and 2021.0.4 (13.0.4).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-6-2021; https://www.progress.com/moveit; https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-6-2021
CVE: CVE-2021-38165
Published: 2021-08-07
Description: Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2021/08/07/11; http://www.openwall.com/lists/oss-security/2021/08/07/12; http://www.openwall.com/lists/oss-security/2021/08/07/9
CVE: CVE-2021-38166
Published: 2021-08-07
Description: In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=c4eb1f403243fc7bbb7de644db8587c03de36da6; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUVLBJKZMWA3E3YXSH4SZ7BOYGJP4GXP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UL6CH5M5PRLMA3KPBX4LPUO6Z73GRISO/