deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-26908
Published: 2021-04-23
Description: Automox Agent prior to version 31 logs potentially sensitive information in local log files, which could be used by a locally-authenticated attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent.
CVSS Score: 3.3 (LOW)
CWE: CWE-532, CWE-532
References: https://community.automox.com/t/cve-2021-26908-and-cve-201-26909-automox-agent-information-disclosure-vulnerabilities-fixed/1955; https://www.rapid7.com/blog/post/2021/04/13/cve-2021-26908-and-cve-2021-26909-automox-agent-information-disclosure-fixed/; https://community.automox.com/t/cve-2021-26908-and-cve-201-26909-automox-agent-information-disclosure-vulnerabilities-fixed/1955
CVE: CVE-2021-26909
Published: 2021-04-23
Description: Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent.
CVSS Score: 3.7 (LOW)
CWE: CWE-284, CWE-330
References: https://community.automox.com/t/cve-2021-26908-and-cve-201-26909-automox-agent-information-disclosure-vulnerabilities-fixed/1955; https://www.rapid7.com/blog/post/2021/04/13/cve-2021-26908-and-cve-2021-26909-automox-agent-information-disclosure-fixed/; https://community.automox.com/t/cve-2021-26908-and-cve-201-26909-automox-agent-information-disclosure-vulnerabilities-fixed/1955
CVE: CVE-2021-31403
Published: 2021-04-23
Description: Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://github.com/vaadin/framework/pull/12188; https://github.com/vaadin/framework/pull/12190; https://vaadin.com/security/cve-2021-31403
CVE: CVE-2021-31404
Published: 2021-04-23
Description: Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://github.com/vaadin/flow/pull/9875; https://vaadin.com/security/cve-2021-31404; https://github.com/vaadin/flow/pull/9875
CVE: CVE-2021-31405
Published: 2021-04-23
Description: Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/vaadin/flow-components/pull/442; https://vaadin.com/security/cve-2021-31405; https://github.com/vaadin/flow-components/pull/442
CVE: CVE-2021-31406
Published: 2021-04-23
Description: Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://github.com/vaadin/flow/pull/10157; https://vaadin.com/security/cve-2021-31406; https://github.com/vaadin/flow/pull/10157
CVE: CVE-2021-31407
Published: 2021-04-23
Description: Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.
CVSS Score: 8.6 (HIGH)
CWE: CWE-402, CWE-668
References: https://github.com/vaadin/flow/pull/10229; https://github.com/vaadin/flow/pull/10269; https://github.com/vaadin/osgi/issues/50
CVE: CVE-2021-22893
Published: 2021-04-23
Description: Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287, CWE-416
References: https://blog.pulsesecure.net/pulse-connect-secure-security-update/; https://kb.cert.org/vuls/id/213092; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/
CVE: CVE-2021-31408
Published: 2021-04-23
Description: Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://github.com/vaadin/flow/pull/10577; https://vaadin.com/security/cve-2021-31408; https://github.com/vaadin/flow/pull/10577
CVE: CVE-2021-31410
Published: 2021-04-23
Description: Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request.
CVSS Score: 8.6 (HIGH)
CWE: CWE-402, CWE-668
References: https://vaadin.com/security/cve-2021-31410; https://vaadin.com/security/cve-2021-31410
CVE: CVE-2021-31539
Published: 2021-04-23
Description: Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able to read usernames and passwords.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://www.gruppotim.it/redteam; https://www.wowza.com/docs/wowza-streaming-engine-4-8-8-01-release-notes#breaking; https://www.wowza.com/products/streaming-engine
CVE: CVE-2021-31540
Published: 2021-04-23
Description: Wowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions of configuration files in the conf/ directory. A regular local user is able to read and write to all the configuration files, e.g., modify the application server configuration.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://www.gruppotim.it/redteam; https://www.wowza.com/docs/wowza-streaming-engine-4-8-12-release-notes; https://www.wowza.com/products/streaming-engine
CVE: CVE-2021-20084
Published: 2021-04-23
Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-sparkle.md; https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-sparkle.md
CVE: CVE-2021-20087
Published: 2021-04-23
Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties into Object.prototype.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-deparam.md; https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-deparam.md; https://github.com/RetireJS/retire.js/blob/6da45fcb6a3425e55ee8181b2ac35168879bf086/repository/jsrepository-master.json#L824-L842
CVE: CVE-2021-20088
Published: 2021-04-23
Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/mootools-more.md; https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/mootools-more.md
CVE: CVE-2021-22204
Published: 2021-04-23
Description: Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html; http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html; http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
CVE: CVE-2021-22205
Published: 2021-04-23
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html; http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json
CVE: CVE-2021-22207
Published: 2021-04-23
Description: Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted capture file
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22207.json; https://gitlab.com/wireshark/wireshark/-/issues/17331; https://lists.debian.org/debian-lts-announce/2021/12/msg00015.html
CVE: CVE-2021-22678
Published: 2021-04-23
Description: Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. This could lead to memory corruption. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-112-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-112-01
CVE: CVE-2021-22682
Published: 2021-04-23
Description: Cscape (All versions prior to 9.90 SP4) is configured by default to be installed for all users, which allows full permissions, including read/write access. This may allow unprivileged users to modify the binaries and configuration files and lead to local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-112-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-112-01
CVE: CVE-2021-29469
Published: 2021-04-23
Description: Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e; https://github.com/NodeRedis/node-redis/releases/tag/v3.1.1; https://github.com/NodeRedis/node-redis/security/advisories/GHSA-35q2-47q7-3pc3
CVE: CVE-2021-20083
Published: 2021-04-23
Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: http://packetstormsecurity.com/files/166299/WordPress-Core-5.9.0-5.9.1-Cross-Site-Scripting.html; https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-query-object.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7CR6VGITIB2TXXZ6B5QRRWPU5S4BXQPD/
CVE: CVE-2021-20085
Published: 2021-04-23
Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/backbone-qp.md; https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/backbone-qp.md
CVE: CVE-2021-20086
Published: 2021-04-23
Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-bbq.md; https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-bbq.md; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-20089
Published: 2021-04-23
Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject properties into Object.prototype.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/purl.md; https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/purl.md
CVE: CVE-2021-29470
Published: 2021-04-23
Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.4.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-125
References: https://github.com/Exiv2/exiv2/pull/1581; https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/
CVE: CVE-2021-31780
Published: 2021-04-23
Description: In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a sharing group associated with an event edit, the sharing group object is ignored and instead the passed local ID is reused.
CVSS Score: 7.5 (HIGH)
CWE: CWE-212
References: https://github.com/MISP/MISP/commit/a0f08501d[PII_REDACTED]e703f40fb1570c7995478; https://github.com/MISP/MISP/commit/a0f08501d[PII_REDACTED]e703f40fb1570c7995478
CVE: CVE-2020-17542
Published: 2021-04-23
Description: Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment window of the "/dotAdmin/#/c/workflow" component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/dotCMS/core/issues/16890; https://github.com/dotCMS/core/issues/16890
CVE: CVE-2020-7034
Published: 2021-04-23
Description: A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affected system privileges. Affected versions of Avaya Session Border Controller for Enterprise include 7.x, 8.0 through 8.1.1.x
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-77
References: https://downloads.avaya.com/css/P8/documents/101075451; https://downloads.avaya.com/css/P8/documents/101075451
CVE: CVE-2020-7035
Published: 2021-04-23
Description: An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611, CWE-611
References: https://downloads.avaya.com/css/P8/documents/101075450; https://downloads.avaya.com/css/P8/documents/101075450
CVE: CVE-2020-7036
Published: 2021-04-23
Description: An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Callback Assist includes all 4.0.x versions before 4.7.1.1 Patch 7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611, CWE-611
References: https://downloads.avaya.com/css/P8/documents/101075450; https://downloads.avaya.com/css/P8/documents/101075450
CVE: CVE-2021-25898
Published: 2021-04-23
Description: An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-798
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28765; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/
CVE: CVE-2021-25899
Published: 2021-04-23
Description: An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28765; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/
CVE: CVE-2021-29158
Published: 2021-04-23
Description: Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863
References: https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]62; https://support.sonatype.com/hc/en-us/categories/201980768-Welcome-to-the-Sonatype-Support-Knowledge-Base; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]62
CVE: CVE-2021-31583
Published: 2021-04-23
Description: Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in callforward/time/set/save (POST tsetname); Reflected XSS in addressbook (GET filter); Stored XSS in addressbook/save (POST firstname, lastname, company); and Reflected XSS in statistics/versions (GET lang).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.html; http://packetstormsecurity.com/files/162316/Sipwise-C5-NGCP-CSC-Cross-Site-Scripting.html; https://www.sipwise.com
CVE: CVE-2021-31584
Published: 2021-04-23
Description: Sipwise C5 NGCP www_csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks for actions with administrative privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.html; http://packetstormsecurity.com/files/162318/Sipwise-C5-NGCP-CSC-Cross-Site-Request-Forgery.html; https://www.sipwise.com
CVE: CVE-2021-31791
Published: 2021-04-23
Description: In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://www.sentrysoftware.com/library/releaseNotes/index.html?hardwaresentrykmforpatrol10_0_01releasenotes.htm; https://www.sentrysoftware.com/library/releaseNotes/index.html?hardwaresentrykmforpatrol10_0_01releasenotes.htm
CVE: CVE-2021-31598
Published: 2021-04-24
Description: An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files, leading to a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html; https://sourceforge.net/p/ezxml/bugs/28/; https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html
CVE: CVE-2021-31795
Published: 2021-04-24
Description: The PowerVR GPU kernel driver in pvrsrvkm.ko through 2021-04-24 for the Linux kernel, as used on Alcatel 1S phones, allows attackers to overwrite heap memory via PhysmemNewRamBackedPMR.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: https://mcyoloswagham.github.io/linux/; https://mcyoloswagham.github.io/linux/
CVE: CVE-2021-31794
Published: 2021-04-24
Description: Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/awillix/research/blob/main/cve/CVE-2021-31794.md; https://www.directum.ru/; https://github.com/awillix/research/blob/main/cve/CVE-2021-31794.md
CVE: CVE-2021-31712
Published: 2021-04-24
Description: react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/jpuri/react-draft-wysiwyg/commit/d2faeb612b53f10dff048de7dc57e1f4044b5380; https://github.com/jpuri/react-draft-wysiwyg/issues/1102; https://github.com/jpuri/react-draft-wysiwyg/pull/1104
CVE: CVE-2021-30502
Published: 2021-04-25
Description: The unofficial vscode-ghc-simple (aka Simple Glasgow Haskell Compiler) extension before 0.2.3 for Visual Studio Code allows remote code execution via a crafted workspace configuration with replCommand.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/dramforever/vscode-ghc-simple/blob/master/CHANGELOG.md#v023; https://github.com/dramforever/vscode-ghc-simple/commit/bc7f6f0b857dade46ea51496d8bd1a4edef39b46; https://github.com/dramforever/vscode-ghc-simple/releases
CVE: CVE-2021-31718
Published: 2021-04-25
Description: The server in npupnp before 4.1.4 is affected by DNS rebinding in the embedded web server (including UPnP SOAP and GENA endpoints), leading to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346
References: http://www.openwall.com/lists/oss-security/2021/04/25/2; https://framagit.org/medoc92/npupnp; https://www.lesbonscomptes.com/upmpdcli/npupnp-doc/libnpupnp.html
CVE: CVE-2021-31726
Published: 2021-04-25
Description: Akuvox C315[PII_REDACTED] allows remote command Injection via the cfgd_server service. The attack vector is sending a payload to port 189 (default root 0.0.0.0).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://pastebin.com/yv4ajFjD; https://www.akuvox.com/ProductsDisp.aspx?pid=21; https://pastebin.com/yv4ajFjD
CVE: CVE-2021-31760
Published: 2021-04-25
Description: Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Mesh3l911/CVE-2021-31760; https://github.com/electronicbots/CVE-2021-31760; https://github.com/webmin/webmin