deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-40496
Published: 2021-10-12
Description: SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request and exposing sensitive data. This vulnerability is normally exposed over the network and successful exploitation can lead to exposure of data like system details.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://launchpad.support.sap.com/#/notes/3087254; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3087254
CVE: CVE-2021-40497
Published: 2021-10-12
Description: SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation could lead to exposure of some system specific data like its version.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://launchpad.support.sap.com/#/notes/3098917; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3098917
CVE: CVE-2021-40498
Published: 2021-10-12
Description: A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is related to Android implementation methods that are widely used across Android mobile applications, and such methods are embedded into the SAP SuccessFactors mobile application. These Android methods begin executing once the user accesses their profile on the mobile application. While executing, it can also pick up the activities from other Android applications that are running in the background of the users device and are using the same types of methods in the application. Such vulnerability can also lead to phishing attacks that can be used for staging other types of attacks.
CVSS Score: 5.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3077635; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3077635
CVE: CVE-2021-40499
Published: 2021-10-12
Description: Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://launchpad.support.sap.com/#/notes/3100882; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3100882
CVE: CVE-2021-40500
Published: 2021-10-12
Description: SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can enable the attacker to retrieve arbitrary files from the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://launchpad.support.sap.com/#/notes/3074693; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983; https://launchpad.support.sap.com/#/notes/3074693
CVE: CVE-2021-35214
Published: 2021-10-12
Description: The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-613
References: https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214; https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214
CVE: CVE-2021-37732
Published: 2021-10-12
Description: A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.11 and below; Aruba Instant 8.6.x.x: 8.6.0.6 and below; Aruba Instant 8.7.x.x: 8.7.1.0 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf
CVE: CVE-2021-37734
Published: 2021-10-12
Description: A remote unauthorized read access to files vulnerability was discovered in Aruba Instant version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.19 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below; Aruba Instant 8.8.x.x: 8.8.0.0 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf
CVE: CVE-2021-37735
Published: 2021-10-12
Description: A remote denial of service vulnerability was discovered in Aruba Instant version(s): Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.10 and below; Aruba Instant 8.6.x.x: 8.6.0.4 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-134
References: https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf
CVE: CVE-2021-41136
Published: 2021-10-12
Description: Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with `puma`.
CVSS Score: 3.7 (LOW)
CWE: CWE-444
References: https://github.com/puma/puma/commit/436c71807f00e07070902a03f79fd3e130eb6b18; https://github.com/puma/puma/commit/acdc3ae571dfae0e045cf09a295280127db65c7f; https://github.com/puma/puma/commit/fb6ad8f8013ab5cdbb2f444cbfabd0b4fde71139
CVE: CVE-2021-41070
Published: 2021-10-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: non
CVE: CVE-2021-41071
Published: 2021-10-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2021-41796
Published: 2021-10-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: non
CVE: CVE-2021-41797
Published: 2021-10-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: non
CVE: CVE-2021-27003
Published: 2021-10-12
Description: Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a clickjacking attack.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1021
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-35494
Published: 2021-10-12
Description: The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-362
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35494; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-35495
Published: 2021-10-12
Description: The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.
CVSS Score: 9.0 (CRITICAL)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-35496
Published: 2021-10-12
Description: The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-3671
Published: 2021-10-12
Description: A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2013080%2C; https://bugzilla.samba.org/show_bug.cgi?id=14770%2C; https://github.com/heimdal/heimdal/commit/[PII_REDACTED]8d0a3636bc[PII_REDACTED]f0fb2ec83a
CVE: CVE-2021-40292
Published: 2021-10-12
Description: A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/zyx0814/dzzoffice/issues/195; https://github.com/zyx0814/dzzoffice/issues/195
CVE: CVE-2021-40618
Published: 2021-10-12
Description: An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in HoldAddressFields.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic/issues/193; https://github.com/OS4ED/openSIS-Classic/issues/193
CVE: CVE-2021-29644
Published: 2021-10-12
Description: Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. An attacker with network access to port 31016 may exploit this issue to execute code with unrestricted privileges on the underlying OS.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: https://www.hitachi.com/hirt/security/index.html; https://www.hitachi.com/hirt/security/index.html
CVE: CVE-2021-29645
Published: 2021-10-12
Description: Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
CVSS Score: 7.0 (HIGH)
References: https://www.hitachi.com/hirt/security/index.html; https://www.hitachi.com/hirt/security/index.html
CVE: CVE-2021-38862
Published: 2021-10-12
Description: IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207980.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/207980; https://www.ibm.com/support/pages/node/6497499; https://exchange.xforce.ibmcloud.com/vulnerabilities/207980
CVE: CVE-2021-38915
Published: 2021-10-12
Description: IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 209947.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209947; https://www.ibm.com/support/pages/node/6497499; https://exchange.xforce.ibmcloud.com/vulnerabilities/209947
CVE: CVE-2021-39184
Published: 2021-10-12
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling `contextIsolation` in one's app. One may also disable the functionality of the `createThumbnailFromPath` API if one does not need it.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-668, CWE-862
References: https://github.com/electron/electron/pull/30728; https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4; https://github.com/electron/electron/pull/30728
CVE: CVE-2021-42326
Published: 2021-10-12
Description: Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.
CVSS Score: 5.3 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2021/10/msg00013.html; https://www.redmine.org/news/133; https://www.redmine.org/projects/redmine/wiki/Changelog_4_1#415-2021-10-10
CVE: CVE-2021-42325
Published: 2021-10-12
Description: Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/164800/Froxlor-0.10.29.1-SQL-Injection.html; https://github.com/Froxlor/Froxlor/commit/eb592340b022298f62a0a3e8450dbfbe29585782; https://www.exploit-db.com/exploits/50502
CVE: CVE-2020-22673
Published: 2021-10-12
Description: Memory leak in the senc_Parse function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service (DoS) via a crafted input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/gpac/gpac/issues/1342; https://github.com/gpac/gpac/issues/1342
CVE: CVE-2020-22674
Published: 2021-10-12
Description: An issue was discovered in gpac 0.8.0. An invalid memory dereference exists in the function FixTrackID located in isom_intern.c, which allows attackers to cause a denial of service (DoS) via a crafted input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1346; https://github.com/gpac/gpac/issues/1346
CVE: CVE-2020-22675
Published: 2021-10-12
Description: An issue was discovered in gpac 0.8.0. The GetGhostNum function in stbl_read.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1344; https://github.com/gpac/gpac/issues/1344
CVE: CVE-2020-22677
Published: 2021-10-12
Description: An issue was discovered in gpac 0.8.0. The dump_data_hex function in box_dump.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1341; https://github.com/gpac/gpac/issues/1341
CVE: CVE-2020-22678
Published: 2021-10-12
Description: An issue was discovered in gpac 0.8.0. The gf_media_nalu_remove_emulation_bytes function in av_parsers.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1339; https://github.com/gpac/gpac/issues/1339
CVE: CVE-2020-22679
Published: 2021-10-12
Description: Memory leak in the sgpd_parse_entry function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service (DoS) via a crafted input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/gpac/gpac/issues/1345; https://github.com/gpac/gpac/issues/1345
CVE: CVE-2021-3321
Published: 2021-10-12
Description: Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions >= >=2.4.0 contain Integer Overflow to Buffer Overflow (CWE-680). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99
CVSS Score: 7.5 (HIGH)
CWE: CWE-680, CWE-191
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99
CVE: CVE-2021-3322
Published: 2021-10-12
Description: Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions >= >=2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3
CVE: CVE-2021-3323
Published: 2021-10-12
Description: Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Zephyr versions >= >=2.4.0 contain Integer Underflow (Wrap or Wraparound) (CWE-191). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-89j6-qpxf-pfpc
CVSS Score: 8.3 (HIGH)
CWE: CWE-191, CWE-191
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-89j6-qpxf-pfpc; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-89j6-qpxf-pfpc
CVE: CVE-2021-3330
Published: 2021-10-12
Description: RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr. Zephyr versions >= >=2.4.0 contain Out-of-bounds Write (CWE-787). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj4r-373f-9456
CVSS Score: 7.1 (HIGH)
CWE: CWE-787, CWE-787
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj4r-373f-9456; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj4r-373f-9456
CVE: CVE-2021-20031
Published: 2021-10-12
Description: A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: http://packetstormsecurity.com/files/164502/Sonicwall-SonicOS-7.0-Host-Header-Injection.html; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0019; http://packetstormsecurity.com/files/164502/Sonicwall-SonicOS-7.0-Host-Header-Injection.html
CVE: CVE-2021-26427
Published: 2021-10-13
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 9.0 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26427; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26427
CVE: CVE-2021-26441
Published: 2021-10-13
Description: Storage Spaces Controller Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26441; https://www.zerodayinitiative.com/advisories/ZDI-21-1157/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26441
CVE: CVE-2021-26442
Published: 2021-10-13
Description: Windows HTTP.sys Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26442; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26442
CVE: CVE-2021-34453
Published: 2021-10-13
Description: Microsoft Exchange Server Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34453; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34453