deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-42336
Published: 2021-10-15
Description: The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html; https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html
CVE: CVE-2021-37736
Published: 2021-10-15
Description: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 9.8 (CRITICAL)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-37737
Published: 2021-10-15
Description: A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-38431
Published: 2021-10-15
Description: An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-285-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-285-01
CVE: CVE-2021-39332
Published: 2021-10-15
Description: The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.4.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39332; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39332
CVE: CVE-2021-39334
Published: 2021-10-15
Description: The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjb_exp_in and the psjb_curr_in parameters found in the ~/job-settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/BigTiger2020/word-press/blob/main/Job%20Board%20Vanila%20Plugin-2.md; https://plugins.trac.wordpress.org/browser/job-board-vanilla/trunk/job-settings.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39334
CVE: CVE-2021-39335
Published: 2021-10-15
Description: The WpGenius Job Listing WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/admin/class/class-wpgenious-job-listing-options.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/BigTiger2020/word-press/blob/main/WpGenius%20Job%20Listing.md; https://plugins.trac.wordpress.org/browser/wpgenious-job-listing/trunk/src/admin/class/class-wpgenious-job-listing-options.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39335
CVE: CVE-2021-39336
Published: 2021-10-15
Description: The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin-jobs.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 0.7.25. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/BigTiger2020/word-press/blob/main/Job%20Manager.md; https://plugins.trac.wordpress.org/browser/job-manager/trunk/admin-jobs.php#L244; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39336
CVE: CVE-2021-39337
Published: 2021-10-15
Description: The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/jobs_function.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 0.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/BigTiger2020/word-press/blob/main/job-portal.md; https://plugins.trac.wordpress.org/browser/job-portal/trunk/admin/jobs_function.php#L99; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39337
CVE: CVE-2021-39338
Published: 2021-10-15
Description: The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/BigTiger2020/word-press/blob/main/MyBB%20Cross-Poster.md; https://plugins.trac.wordpress.org/browser/mybb-cross-poster/trunk/classes/MyBBXPSettings.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39338
CVE: CVE-2021-39344
Published: 2021-10-15
Description: The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/class-kjm-admin-notices-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/BigTiger2020/word-press/blob/main/KJM%20Admin%20Notices.md; https://plugins.trac.wordpress.org/browser/kjm-admin-notices/trunk/admin/class-kjm-admin-notices-admin.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39344
CVE: CVE-2021-39345
Published: 2021-10-15
Description: The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/wp-hal.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.1.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/BigTiger2020/word-press/blob/main/HAL.md; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2614075%40hal&new=2614075%40hal&sfp_email=&sfph_mail=; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39345
CVE: CVE-2021-39349
Published: 2021-10-15
Description: The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/BigTiger2020/word-press/blob/main/Author%20Bio%20Box.md; https://plugins.trac.wordpress.org/changeset/2613798/author-bio-box/tags/3.3.2/includes/admin/class-author-bio-box-admin.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39349
CVE: CVE-2021-37738
Published: 2021-10-15
Description: A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-37739
Published: 2021-10-15
Description: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-3874
Published: 2021-10-15
Description: bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/bookstackapp/bookstack/commit/7224fbcc89f00f2b71644e36bb1b1d96addd1d5a; https://huntr.dev/bounties/ac268a17-72b5-446f-a09a-9945ef58607a; https://github.com/bookstackapp/bookstack/commit/7224fbcc89f00f2b71644e36bb1b1d96addd1d5a
CVE: CVE-2021-3875
Published: 2021-10-15
Description: vim is vulnerable to Heap-based Buffer Overflow
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: http://www.openwall.com/lists/oss-security/2022/01/15/1; https://github.com/vim/vim/commit/35a319b77f897744eec1155b736e9372c9c5575f; https://huntr.dev/bounties/5cdbc168-6ba1-4bc2-ba6c-28be12166a53
CVE: CVE-2021-3878
Published: 2021-10-15
Description: corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99; https://huntr.dev/bounties/a11c889b-ccff-4fea-9e29-963a23a63dd2; https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99
CVE: CVE-2021-3881
Published: 2021-10-15
Description: libmobi is vulnerable to Out-of-bounds Read
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21; https://huntr.dev/bounties/540fd115-7de4-4e19-a918-5ee61f5157c1; https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21
CVE: CVE-2021-40986
Published: 2021-10-15
Description: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40987
Published: 2021-10-15
Description: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40988
Published: 2021-10-15
Description: A remote directory traversal vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40989
Published: 2021-10-15
Description: A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.8 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40990
Published: 2021-10-15
Description: A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40992
Published: 2021-10-15
Description: A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-41147
Published: 2021-10-15
Description: Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute arbitrary SQL queries. Tuleap Community Edition 11.16.99.173, Tuleap Enterprise Edition 11.16-6, and Tuleap Enterprise Edition 11.15-8 contain a patch for this issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Enalean/tuleap/commit/d6b2f8b8c5098938bc094726a4826479ddbee941; https://github.com/Enalean/tuleap/security/advisories/GHSA-j2mq-65wv-prmp; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d6b2f8b8c5098938bc094726a4826479ddbee941
CVE: CVE-2021-41148
Published: 2021-10-15
Description: Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal dashboard could execute arbitrary SQL queries. Tuleap Community Edition 11.16.99.173, Tuleap Enterprise Edition 11.16-6, and Tuleap Enterprise Edition 11.15-8 contain a patch for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Enalean/tuleap/commit/91535add59f4b3a04b6b8eab123c002cd5af180d; https://github.com/Enalean/tuleap/security/advisories/GHSA-3c4q-8c35-cp63; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=91535add59f4b3a04b6b8eab123c002cd5af180d
CVE: CVE-2021-38432
Published: 2021-10-15
Description: FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data, which could result in a stack-based buffer overflow condition and allow an attacker to remotely execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-280-07; https://us-cert.cisa.gov/ics/advisories/icsa-21-280-07
CVE: CVE-2021-39864
Published: 2021-10-15
Description: Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://helpx.adobe.com/security/products/magento/apsb21-86.html; https://helpx.adobe.com/security/products/magento/apsb21-86.html
CVE: CVE-2021-40720
Published: 2021-10-15
Description: Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkout_repo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/ops_cli/apsb21-88.html; https://helpx.adobe.com/security/products/ops_cli/apsb21-88.html
CVE: CVE-2021-40721
Published: 2021-10-15
Description: Adobe Connect version 11.2.3 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/connect/apsb21-91.html; https://helpx.adobe.com/security/products/connect/apsb21-91.html
CVE: CVE-2021-40724
Published: 2021-10-15
Description: Acrobat Reader for Android versions 21.8.0 (and earlier) are affected by a Path traversal vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://helpx.adobe.com/security/products/reader-mobile/apsb21-89.html; https://helpx.adobe.com/security/products/reader-mobile/apsb21-89.html
CVE: CVE-2021-40728
Published: 2021-10-15
Description: Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-104.html; https://helpx.adobe.com/security/products/acrobat/apsb21-104.html
CVE: CVE-2021-40729
Published: 2021-10-15
Description: Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb21-104.html; https://helpx.adobe.com/security/products/acrobat/apsb21-104.html
CVE: CVE-2021-40730
Published: 2021-10-15
Description: Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free that allow a remote attacker to disclose sensitive information on affected installations of of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG2000 images.
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-104.html; https://helpx.adobe.com/security/products/acrobat/apsb21-104.html
CVE: CVE-2021-40731
Published: 2021-10-15
Description: Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by an out-of-bounds write vulnerability when parsing a crafted JPEG2000 file, which could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-104.html; https://helpx.adobe.com/security/products/acrobat/apsb21-104.html
CVE: CVE-2021-40991
Published: 2021-10-15
Description: A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40993
Published: 2021-10-15
Description: A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt