deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-0318
Published: 2021-01-11
Description: In appendEventsToCacheLocked of SensorEventConnection.cpp, there is a possible out of bounds write due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-9, Android-8.1, Android-10, Android-11; Android ID: A-168211968.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0319
Published: 2021-01-11
Description: In checkCallerIsSystemOr of CompanionDeviceManagerService.java, there is a possible way to get a nearby Bluetooth device's MAC address without appropriate permissions due to a permissions bypass. This could lead to local escalation of privilege that grants access to nearby MAC addresses, with User execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, Android-11; Android ID: A-167244818.
CVSS Score: 7.3 (HIGH)
CWE: CWE-863
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0320
Published: 2021-01-11
Description: In is_device_locked and set_device_locked of keystore_keymaster_enforcement.h, there is a possible bypass of lockscreen requirements for keyguard bound keys due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Android ID: A-169933423.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0321
Published: 2021-01-11
Description: In enforceDumpPermissionForPackage of ActivityManagerService.java, there is a possible way to determine if a package is installed due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Android ID: A-166667403.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2021-0322
Published: 2021-01-11
Description: In onCreate of SlicePermissionActivity.java, there is a possible misleading string displayed due to improper input validation. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.Product: Android; Versions: Android-10, Android-11, Android-9; Android ID: A-159145361.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2021-01-01; https://source.android.com/security/bulletin/2021-01-01
CVE: CVE-2020-16146
Published: 2021-01-12
Description: Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in BluFi provisioning in btc_blufi_recv_handler function in blufi_prf.c. An attacker can send a crafted BluFi protocol Write Attribute command to characteristic 0xFF01. With manipulated packet fields, there is a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/espressif/esp-idf; https://github.com/pokerfacett/MY_CVE_CREDIT/blob/master/CVE-2020-16146.md; https://github.com/espressif/esp-idf
CVE: CVE-2020-26050
Published: 2021-01-12
Description: SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted openssl configuration file. This issue is similar to CVE-2019-12572.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://thebinary0x1.medium.com/cve-2020-26050-safervpn-for-windows-local-privilege-escalation-da069bb1373c; https://vimeo.com/459654003; https://www.safervpn.com/blog/updates-to-the-safervpn-windows-application/
CVE: CVE-2020-27637
Published: 2021-01-12
Description: The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://labs.bishopfox.com/advisories/cran-version-4.0.2; https://security.gentoo.org/glsa/202401-07; https://www.r-project.org/foundation/
CVE: CVE-2020-24700
Published: 2021-01-12
Description: OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2021/Jul/33
CVE: CVE-2020-24701
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2021/Jul/33
CVE: CVE-2020-35653
Published: 2021-01-12
Description: In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/
CVE: CVE-2020-35654
Published: 2021-01-12
Description: In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/
CVE: CVE-2020-35655
Published: 2021-01-12
Description: In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-125
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/; https://pillow.readthedocs.io/en/stable/releasenotes/index.html
CVE: CVE-2021-23239
Published: 2021-01-12
Description: The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.
CVSS Score: 2.5 (LOW)
CWE: CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2021-23239; https://lists.debian.org/debian-lts-announce/2022/11/msg00007.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE42Y35SMJOLONAIBNYNFC7J44UUZ2Y6/
CVE: CVE-2021-23240
Published: 2021-01-12
Description: selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2021-23240; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2020-14274
Published: 2021-01-12
Description: Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086183; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086183
CVE: CVE-2020-14275
Published: 2021-01-12
Description: Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086271; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086271
CVE: CVE-2020-14341
Published: 2021-01-12
Description: The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may glean information about hosts and ports which they do not have access to scan directly.
CVSS Score: 2.7 (LOW)
CWE: CWE-385
References: https://bugzilla.redhat.com/show_bug.cgi?id=1860138; https://bugzilla.redhat.com/show_bug.cgi?id=1860138
CVE: CVE-2020-25657
Published: 2021-01-12
Description: A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-385
References: https://bugzilla.redhat.com/show_bug.cgi?id=1889823; https://bugzilla.redhat.com/show_bug.cgi?id=1889823
CVE: CVE-2020-26712
Published: 2021-01-12
Description: REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can exploit and compromise all databases.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/vuongdq54/RedCap; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/; https://www.project-redcap.org/
CVE: CVE-2020-26713
Published: 2021-01-12
Description: REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/vuongdq54/RedCap; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/; https://www.project-redcap.org/
CVE: CVE-2020-35458
Published: 2021-01-12
Description: An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2021/01/12/3; https://bugzilla.suse.com/show_bug.cgi?id=1179998; https://github.com/ClusterLabs/hawk/releases
CVE: CVE-2020-35459
Published: 2021-01-12
Description: An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2021/01/12/3; https://bugzilla.suse.com/show_bug.cgi?id=1179999; https://github.com/ClusterLabs/crmsh/blob/a403aa15f3ea575adfe5e43bf2a31c9f9094fcda/crmsh/history.py#L476
CVE: CVE-2020-4673
Published: 2021-01-12
Description: IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186286; https://www.ibm.com/support/pages/node/6402481; https://exchange.xforce.ibmcloud.com/vulnerabilities/186286
CVE: CVE-2020-4674
Published: 2021-01-12
Description: IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-Force ID: 186287.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186287; https://www.ibm.com/support/pages/node/6402483; https://exchange.xforce.ibmcloud.com/vulnerabilities/186287
CVE: CVE-2020-4838
Published: 2021-01-12
Description: IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190036.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190036; https://www.ibm.com/support/pages/node/6402719; https://exchange.xforce.ibmcloud.com/vulnerabilities/190036
CVE: CVE-2021-21445
Published: 2021-01-12
Description: SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attacks, including cross-site scripting and page hijacking.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-444
References: https://launchpad.support.sap.com/#/notes/2984034; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/2984034
CVE: CVE-2021-21446
Published: 2021-01-12
Description: SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, this has a high impact on the availability of the service.
CVSS Score: 7.5 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3000306; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3000306
CVE: CVE-2021-21447
Published: 2021-01-12
Description: SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2965154; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/2965154
CVE: CVE-2021-21448
Published: 2021-01-12
Description: SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on the client PC and not via Network and the attacker needs at least user authorization of the Operating System user of the victim.
CVSS Score: 6.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2992269; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/2992269
CVE: CVE-2021-21449
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21450
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21451
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21452
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21453
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21454
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21455
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21456
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21457
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21458
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21459
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21460
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617
CVE: CVE-2021-21461
Published: 2021-01-12
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/3002617; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476; https://launchpad.support.sap.com/#/notes/3002617