deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-34737
Published: 2021-09-09
Description: A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process, resulting in a denial of service (DoS) condition. This vulnerability exists because certain DHCPv4 messages are improperly validated when they are processed by an affected device. An attacker could exploit this vulnerability by sending a malformed DHCPv4 message to an affected device. A successful exploit could allow the attacker to cause a NULL pointer dereference, resulting in a crash of the dhcpd process. While the dhcpd process is restarting, which may take up to approximately two minutes, DHCPv4 server services are unavailable on the affected device. This could temporarily prevent network access to clients that join the network during that time period. Note: Only the dhcpd process crashes and eventually restarts automatically. The router does not reload.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dhcp-dos-pjPVReLU; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dhcp-dos-pjPVReLU
CVE: CVE-2021-34771
Published: 2021-09-09
Description: A vulnerability in the Cisco IOS XR Software CLI could allow an authenticated, local attacker to view more information than their privileges allow. This vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this vulnerability by running a specific command. A successful exploit could allow the attacker to view sensitive configuration information that their privileges might not otherwise allow them to access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-201, CWE-200
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-infodisc-CjLdGMc5; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-infodisc-CjLdGMc5
CVE: CVE-2021-34785
Published: 2021-09-09
Description: Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-620, CWE-287
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-dJ9JT67N; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-dJ9JT67N
CVE: CVE-2021-34786
Published: 2021-09-09
Description: Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-620, CWE-287
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-dJ9JT67N; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-dJ9JT67N
CVE: CVE-2021-1909
Published: 2021-09-09
Description: Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.3 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1933
Published: 2021-09-09
Description: UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1934
Published: 2021-09-09
Description: Possible memory corruption due to improper check when application loader object is explicitly destructed while application is unloading in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
CVSS Score: 8.4 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1935
Published: 2021-09-09
Description: Possible null pointer dereference due to lack of validation check for passed pointer during key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.1 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1941
Published: 2021-09-09
Description: Possible buffer over read issue due to improper length check on WPA IE string sent by peer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1946
Published: 2021-09-09
Description: Null Pointer Dereference may occur due to improper validation while processing crafted SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1948
Published: 2021-09-09
Description: Possible out of bound read due to lack of length check of data while parsing the beacon or probe response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1952
Published: 2021-09-09
Description: Possible buffer over read occurs due to lack of length check of request buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1956
Published: 2021-09-09
Description: Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 6.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1957
Published: 2021-09-09
Description: Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 6.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1958
Published: 2021-09-09
Description: A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-362
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1960
Published: 2021-09-09
Description: Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1961
Published: 2021-09-09
Description: Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1962
Published: 2021-09-09
Description: Buffer Overflow while processing IOCTL for getting peripheral endpoint information there is no proper validation for input maximum endpoint pair and its size in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1963
Published: 2021-09-09
Description: Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1971
Published: 2021-09-09
Description: Possible assertion due to lack of physical layer state validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-1974
Published: 2021-09-09
Description: Possible buffer over read due to lack of alignment between map or unmap length of IPA SMMU and WLAN SMMU in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-30290
Published: 2021-09-09
Description: Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-367, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-30294
Published: 2021-09-09
Description: Potential null pointer dereference in KGSL GPU auxiliary command due to improper validation of user input in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-30295
Published: 2021-09-09
Description: Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2021-bulletin
CVE: CVE-2021-36161
Published: 2021-09-09
Description: Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://lists.apache.org/thread.html/r40212261fd5d638074b65f22ac73eebe93ace310c79d4cfcca4863da%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/r40212261fd5d638074b65f22ac73eebe93ace310c79d4cfcca4863da%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2021-37579
Published: 2021-09-09
Description: The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread.html/r898afa109cdbb4b[PII_REDACTED]8ff0718152ebe1d3d6dfc7202d958bc%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/r898afa109cdbb4b[PII_REDACTED]8ff0718152ebe1d3d6dfc7202d958bc%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2021-20117
Published: 2021-09-09
Description: Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. This is different than CVE-2021-20118.
CVSS Score: 6.7 (MEDIUM)
References: https://www.tenable.com/security/tns-2021-15; https://www.tenable.com/security/tns-2021-15
CVE: CVE-2021-20118
Published: 2021-09-09
Description: Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. This is different than CVE-2021-20117.
CVSS Score: 6.7 (MEDIUM)
References: https://www.tenable.com/security/tns-2021-15; https://www.tenable.com/security/tns-2021-15
CVE: CVE-2021-26603
Published: 2021-09-09
Description: A heap overflow issue was found in ARK library of bandisoft Co., Ltd when the Ark_DigPathA function parsed a file path. This vulnerability is due to missing support for string length check.
CVSS Score: 8.6 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36237; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36237
CVE: CVE-2021-36870
Published: 2021-09-09
Description: Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulnerable parameters: &dataset_name, &wpgmza_gdpr_retention_purpose, &wpgmza_gdpr_company_name, &name #2, &name, &polyname #2, &polyname, &address.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-google-maps/wordpress-wp-google-maps-plugin-8-1-12-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/wp-google-maps/#developers; https://patchstack.com/database/vulnerability/wp-google-maps/wordpress-wp-google-maps-plugin-8-1-12-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2021-36871
Published: 2021-09-09
Description: Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name, Value > &attributes[], Name > &attributes[], &icons[], &names[], &description, &link, &title.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-google-maps-pro/wordpress-wp-google-maps-pro-premium-plugin-8-1-11-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities; https://www.wpgmaps.com/documentation/pro-changelog/; https://patchstack.com/database/vulnerability/wp-google-maps-pro/wordpress-wp-google-maps-pro-premium-plugin-8-1-11-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2021-38408
Published: 2021-09-09
Description: A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-245-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-245-03
CVE: CVE-2021-39458
Published: 2021-09-09
Description: Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environment variables.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: https://github.com/evildrummer/CVE-2021-XYZ2; https://github.com/evildrummer/MyOwnCVEs/tree/main/CVE-2021-39458; https://github.com/evildrummer/CVE-2021-XYZ2
CVE: CVE-2021-39459
Published: 2021-09-09
Description: Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module containing malicious PHP code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://github.com/evildrummer/CVE-2021-XYZ; https://github.com/evildrummer/MyOwnCVEs/tree/main/CVE-2021-39459; https://github.com/evildrummer/CVE-2021-XYZ
CVE: CVE-2021-40222
Published: 2021-09-09
Description: Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web application fails to sanitize user input on Network TCP/IP configuration page. This allows the attacker to inject commands as root on the device which will be executed once the data is received.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://github.com/asang17/CVE-2021-RCE; https://github.com/asang17/CVE-2021-RCE
CVE: CVE-2021-40223
Published: 2021-09-09
Description: Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configuration (User Configuration dialog, Task Configuration dialog and set logging filter dialog). This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts). The XSS payload will be triggered when the user accesses some specific sections of the application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/asang17/CVE-2021-XSS; https://github.com/asang17/CVE-2021-XSS
CVE: CVE-2020-7873
Published: 2021-09-09
Description: Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494, CWE-494
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36233; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36233
CVE: CVE-2020-7874
Published: 2021-09-09
Description: Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494, CWE-494
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36235; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36235
CVE: CVE-2021-26608
Published: 2021-09-09
Description: An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash.
CVSS Score: 8.8 (HIGH)
CWE: CWE-353, CWE-345
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36239; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36239
CVE: CVE-2021-28493
Published: 2021-09-09
Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute commands despite not having the privileges to do so. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.32.0 and prior releases
CVSS Score: 8.4 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.arista.com/en/support/advisories-notices/security-advisories/12915-security-advisory-67; https://www.arista.com/en/support/advisories-notices/security-advisories/12915-security-advisory-67
CVE: CVE-2021-28494
Published: 2021-09-09
Description: In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unprivileged users who are accessing the Web UI. This issue affects: Arista Metamako Operating System MOS-0.34.0 and prior releases
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.arista.com/en/support/advisories-notices/security-advisories/12916-security-advisory-68; https://www.arista.com/en/support/advisories-notices/security-advisories/12916-security-advisory-68