deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-38655
Published: 2021-09-15
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38655; https://www.zerodayinitiative.com/advisories/ZDI-21-1080/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38655
CVE: CVE-2021-38656
Published: 2021-09-15
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38656; https://www.zerodayinitiative.com/advisories/ZDI-21-1082/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38656
CVE: CVE-2021-38657
Published: 2021-09-15
Description: Microsoft Office Graphics Component Information Disclosure Vulnerability
CVSS Score: 6.1 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38657; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38657
CVE: CVE-2021-38658
Published: 2021-09-15
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38658; https://www.zerodayinitiative.com/advisories/ZDI-21-1083/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38658
CVE: CVE-2021-38659
Published: 2021-09-15
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38659; https://www.zerodayinitiative.com/advisories/ZDI-21-1084/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38659
CVE: CVE-2021-38660
Published: 2021-09-15
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38660; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38660
CVE: CVE-2021-38661
Published: 2021-09-15
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38661; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38661
CVE: CVE-2021-38667
Published: 2021-09-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38667; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38667
CVE: CVE-2021-38669
Published: 2021-09-15
Description: Microsoft Edge (Chromium-based) Tampering Vulnerability
CVSS Score: 6.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38669; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38669
CVE: CVE-2021-38671
Published: 2021-09-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38671; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38671
CVE: CVE-2021-3780
Published: 2021-09-15
Description: peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/chocobozzz/peertube/commit/0ea2f79d45b301fcd660efc894469a99b2239bf6; https://huntr.dev/bounties/282807a8-4bf5-4fe2-af62-e05f945b3d65; https://github.com/chocobozzz/peertube/commit/0ea2f79d45b301fcd660efc894469a99b2239bf6
CVE: CVE-2021-3783
Published: 2021-09-15
Description: yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4; https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a3-ff4b78004984; https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4
CVE: CVE-2021-3785
Published: 2021-09-15
Description: yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff; https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638; https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff
CVE: CVE-2021-40440
Published: 2021-09-15
Description: Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40440; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40440
CVE: CVE-2021-40444
Published: 2021-09-15
Description: <p>Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.</p>
<p>An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p>
<p>Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”.</p>
<p>Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.</p>
<p>Please see the <strong>Mitigations</strong> and <strong>Workaround</strong> sections for important information about steps you can take to protect your system from this vulnerability.</p>
<p><strong>UPDATE</strong> September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.</p>

CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.html; http://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.html; http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html
CVE: CVE-2021-40447
Published: 2021-09-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40447; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40447
CVE: CVE-2021-40448
Published: 2021-09-15
Description: Microsoft Accessibility Insights for Android Information Disclosure Vulnerability
CVSS Score: 6.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40448; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40448
CVE: CVE-2021-41061
Published: 2021-09-15
Description: In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component allows attackers to break encryption by triggering reboots.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-330
References: https://github.com/RIOT-OS/RIOT/issues/16844; https://github.com/RIOT-OS/RIOT/issues/16844
CVE: CVE-2020-3960
Published: 2021-09-15
Description: VMware ESXi (6.7 before ESXi[PII_REDACTED]01-SG and 6.5 before ESXi[PII_REDACTED]01-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an out-of-bounds read vulnerability in NVMe functionality. A malicious actor with local non-administrative access to a virtual machine with a virtual NVMe controller present may be able to read privileged information contained in physical memory.
CVSS Score: 8.4 (HIGH)
CWE: CWE-125
References: https://www.vmware.com/security/advisories/VMSA-2020-0012.html; https://www.vmware.com/security/advisories/VMSA-2020-0012.html
CVE: CVE-2021-27662
Published: 2021-09-15
Description: The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01
CVSS Score: 8.6 (HIGH)
CWE: CWE-294, CWE-294
References: https://us-cert.gov/ics/advisories; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://us-cert.gov/ics/advisories
CVE: CVE-2021-30137
Published: 2021-09-15
Description: Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.
CVSS Score: 7.7 (HIGH)
CWE: CWE-611
References: https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2021-30137.pdf; https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2021-30137.pdf
CVE: CVE-2021-39307
Published: 2021-09-15
Description: PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://research.nccgroup.com/2021/09/14/technical-advisory-pdftron-javascript-urls-allowed-in-webviewer-ui-cve-2021-39307/; https://www.pdftron.com/webviewer/; https://research.nccgroup.com/2021/09/14/technical-advisory-pdftron-javascript-urls-allowed-in-webviewer-ui-cve-2021-39307/
CVE: CVE-2021-3794
Published: 2021-09-15
Description: vuelidate is vulnerable to Inefficient Regular Expression Complexity
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d; https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7; https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d
CVE: CVE-2021-3796
Published: 2021-09-15
Description: vim is vulnerable to Use After Free
CVSS Score: 7.3 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2021/10/01/1; https://github.com/vim/vim/commit/35a9a00afcb20897d462a766793ff45534810dc3; https://huntr.dev/bounties/ab60b7f3-6fb1-4ac2-a4fa-4d592e08008d
CVE: CVE-2021-3797
Published: 2021-09-15
Description: hestiacp is vulnerable to Use of Wrong Operator in String Comparison
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-597
References: https://github.com/hestiacp/hestiacp/commit/fc68baff4f94b59e38316f886d0ce47d337042f7; https://huntr.dev/bounties/c24fb15c-3c84-45c8-af04-a660f8da388f; https://github.com/hestiacp/hestiacp/commit/fc68baff4f94b59e38316f886d0ce47d337042f7
CVE: CVE-2021-3801
Published: 2021-09-15
Description: prism is vulnerable to Inefficient Regular Expression Complexity
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333
References: https://github.com/prismjs/prism/commit/0ff371bb4775a131634f47d0fe85794c547232f9; https://huntr.dev/bounties/8c16ab31-6eb6-46d1-b9a4-387222fe1b8a; https://github.com/prismjs/prism/commit/0ff371bb4775a131634f47d0fe85794c547232f9
CVE: CVE-2021-40845
Published: 2021-09-15
Description: The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/164149/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html; http://packetstormsecurity.com/files/164160/Zenitel-AlphaCom-XE-Audio-Server-11.2.3.10-Shell-Upload.html; https://github.com/ricardojoserf/CVE-2021-40845
CVE: CVE-2021-41076
Published: 2021-09-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-19146
Published: 2021-09-15
Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.seebug.org/vuldb/ssvid-97884; https://www.seebug.org/vuldb/ssvid-97884
CVE: CVE-2020-19147
Published: 2021-09-15
Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.seebug.org/vuldb/ssvid-97883; https://www.seebug.org/vuldb/ssvid-97883
CVE: CVE-2020-19148
Published: 2021-09-15
Description: Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/jfinal_cms/front/person/profile.html'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.seebug.org/vuldb/ssvid-97879; https://www.seebug.org/vuldb/ssvid-97879
CVE: CVE-2020-19150
Published: 2021-09-15
Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://www.seebug.org/vuldb/ssvid-97885; https://www.seebug.org/vuldb/ssvid-97885
CVE: CVE-2020-19151
Published: 2021-09-15
Description: Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.seebug.org/vuldb/ssvid-97881; https://www.seebug.org/vuldb/ssvid-97881
CVE: CVE-2020-19154
Published: 2021-09-15
Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.seebug.org/vuldb/ssvid-97882; https://www.seebug.org/vuldb/ssvid-97882
CVE: CVE-2020-19155
Published: 2021-09-15
Description: Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-668
References: https://cwe.mitre.org/data/definitions/73.html; https://www.seebug.org/vuldb/ssvid-97886; https://cwe.mitre.org/data/definitions/73.html
CVE: CVE-2020-19156
Published: 2021-09-15
Description: Cross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' parameter of the 'Add New Connections' component when the 'save()' function is called.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.seebug.org/vuldb/ssvid-97852; https://www.seebug.org/vuldb/ssvid-97852
CVE: CVE-2020-19157
Published: 2021-09-15
Description: Cross Site Scripting (CSS) in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '/index.php?m=ucenter&a=index'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/TL-swallow/swallow/issues/14; https://github.com/TL-swallow/swallow/issues/14
CVE: CVE-2020-19158
Published: 2021-09-15
Description: Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin/#/app/config/'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/TL-swallow/swallow/blob/master/S-CMS%20XSS1.docx; https://github.com/TL-swallow/swallow/blob/master/S-CMS%20XSS1.docx
CVE: CVE-2020-19159
Published: 2021-09-15
Description: Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/TL-swallow/swallow/blob/master/laikecsrf; https://github.com/TL-swallow/swallow/blob/master/laikecsrf
CVE: CVE-2021-21798
Published: 2021-09-15
Description: An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a stack variable to go out of scope, resulting in the application dereferencing a stale pointer. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-562
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1267; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1267
CVE: CVE-2021-38156
Published: 2021-09-15
Description: In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://raxis.com/blog/cve-2021-38156; https://www.nagios.com/downloads/nagios-xi/change-log/; https://raxis.com/blog/cve-2021-38156
CVE: CVE-2021-39189
Published: 2021-09-15
Description: Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://github.com/pimcore/pimcore/pull/10223.patch; https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce; https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9
CVE: CVE-2021-27044
Published: 2021-09-15
Description: A Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through maliciously crafted DLL files or information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001
CVE: CVE-2021-40157
Published: 2021-09-15
Description: A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review version 1.5.0 and prior causing it to run arbitrary code on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001
CVE: CVE-2021-39209
Published: 2021-09-15
Description: GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in many places. This could allow a malicious actor to perform many actions on GLPI. This issue is fixed in version 9.5.6. There are no workarounds aside from upgrading.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/glpi-project/glpi/releases/tag/9.5.6; https://github.com/glpi-project/glpi/security/advisories/GHSA-5qpf-32w7-c56p; https://github.com/glpi-project/glpi/releases/tag/9.5.6
CVE: CVE-2020-21121
Published: 2021-09-15
Description: Pligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue parameter in the admin_update_module_widgets.php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Kliqqi-CMS/Kliqqi-CMS/issues/259; https://github.com/Kliqqi-CMS/Kliqqi-CMS/issues/259
CVE: CVE-2020-21122
Published: 2021-09-15
Description: UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/youseries/ureport/issues/483; https://github.com/youseries/ureport/issues/483
CVE: CVE-2020-21124
Published: 2021-09-15
Description: UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/youseries/ureport/issues/484; https://github.com/youseries/ureport/issues/484
CVE: CVE-2020-21125
Published: 2021-09-15
Description: An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/youseries/ureport/issues/485; https://github.com/youseries/ureport/issues/485
CVE: CVE-2020-21126
Published: 2021-09-15
Description: MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Echox1/metinfo_csrf/issues/1; https://github.com/Echox1/metinfo_csrf/issues/1
CVE: CVE-2020-21127
Published: 2021-09-15
Description: MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/T3qui1a/metinfo_sqlinjection/issues/1; https://github.com/T3qui1a/metinfo_sqlinjection/issues/1
CVE: CVE-2021-27045
Published: 2021-09-15
Description: A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the PDF file. This vulnerability can be exploited to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0008; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0008
CVE: CVE-2021-27046
Published: 2021-09-15
Description: A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution through maliciously crafted DLL files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0008; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0008
CVE: CVE-2021-37412
Published: 2021-09-15
Description: The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-040.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-040.txt