deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-20001
Published: 2021-02-12
Description: An issue was discovered in OpenZFS through 2.0.3. When an NFS share is exported to IPv6 addresses via the sharenfs feature, there is a silent failure to parse the IPv6 address data, and access is allowed to everyone. IPv6 restrictions from the configuration are not applied.
CVSS Score: 7.5 (HIGH)
References: https://github.com/openzfs/zfs/issues/1894#issuecomment-30693652; https://github.com/openzfs/zfs/releases; https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html
CVE: CVE-2020-13949
Published: 2021-02-12
Description: In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://lists.apache.org/thread.html/r01b34416677f1ba869525e1b891ac66fa6f88c024ee4d7cdea6b456b%40%3Cissues.hbase.apache.org%3E; https://lists.apache.org/thread.html/r02ba8db500d15a5949e9a[PII_REDACTED]002ba1cf1b361bdda52ed40ca%40%3Cissues.hbase.apache.org%3E; https://lists.apache.org/thread.html/r02f[PII_REDACTED]ae993eb83cdfb70c3cb65a355c913242c850f61f1b8%40%3Cissues.hbase.apache.org%3E
CVE: CVE-2021-22504
Published: 2021-02-12
Description: Arbitrary code execution vulnerability on Micro Focus Operations Bridge Manager product, affecting versions 10.1x, 10.6x, 2018.05, 2018.11, 2019.05, 2019.11, 2020.05, 2020.10. The vulnerability could allow remote attackers to execute arbitrary code on an OBM server.
CVSS Score: 9.8 (CRITICAL)
References: https://softwaresupport.softwaregrp.com/doc/KM03777855; https://softwaresupport.softwaregrp.com/doc/KM03777855
CVE: CVE-2021-22977
Published: 2021-02-12
Description: On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K14693346; https://support.f5.com/csp/article/K14693346
CVE: CVE-2021-22978
Published: 2021-02-12
Description: On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://support.f5.com/csp/article/K87502622; https://support.f5.com/csp/article/K87502622
CVE: CVE-2021-22984
Published: 2021-02-12
Description: On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense (versions prior to 14.1.0), or a Bot Defense profile (versions 14.1.0 and later), may subject clients and web servers to Open Redirection attacks. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://support.f5.com/csp/article/K33440533; https://support.f5.com/csp/article/K33440533
CVE: CVE-2021-26751
Published: 2021-02-12
Description: NeDi 1.9C allows an authenticated user to perform a SQL Injection in the Monitoring History function on the endpoint /Monitoring-History.php via the det HTTP GET parameter. This allows an attacker to access all the data in the database and obtain access to the NeDi application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://n4nj0.github.io/advisories/nedi-multiple-vulnerabilities-i/; https://n4nj0.github.io/advisories/nedi-multiple-vulnerabilities-i/
CVE: CVE-2021-26752
Published: 2021-02-12
Description: NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://n4nj0.github.io/advisories/nedi-multiple-vulnerabilities-i/; https://n4nj0.github.io/advisories/nedi-multiple-vulnerabilities-i/
CVE: CVE-2021-26753
Published: 2021-02-12
Description: NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-863
References: https://n4nj0.github.io/advisories/nedi-multiple-vulnerabilities-i/; https://n4nj0.github.io/advisories/nedi-multiple-vulnerabilities-i/
CVE: CVE-2021-27209
Published: 2021-02-13
Description: In the management interface on TP-Link Archer C5v 1.7_181221 devices, credentials are sent in a base64 format over cleartext HTTP.
CVSS Score: 7.1 (HIGH)
CWE: CWE-319
References: https://gokay.org/tp-link-archer-c5v-base64-cookie/; https://gokay.org/tp-link-archer-c5v-base64-cookie/
CVE: CVE-2021-27210
Published: 2021-02-13
Description: TP-Link Archer C5v 1.7_181221 devices allows remote attackers to retrieve cleartext credentials via [USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0 to the /cgi?1&5 URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://gokay.org/tp-links-archer-c5v-improper-authorization/; https://gokay.org/tp-links-archer-c5v-improper-authorization/
CVE: CVE-2021-27212
Published: 2021-02-14
Description: In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://bugs.openldap.org/show_bug.cgi?id=9454; https://git.openldap.org/openldap/openldap/-/commit/3539fc33212b528c56b716584f2c2994af7c30b0; https://git.openldap.org/openldap/openldap/-/commit/9badb73425a67768c09bcaed1a9c26c684af6c30
CVE: CVE-2019-25019
Published: 2021-02-14
Description: LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://community.limesurvey.org/release/191008/; https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release_notes.txt; https://community.limesurvey.org/release/191008/
CVE: CVE-2021-26929
Published: 2021-02-14
Description: An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of \x00\x00\x00 and \x01\x01\x01 interferes with XSS defenses.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162187/Webmail-Edition-5.2.22-XSS-Remote-Code-Execution.html; http://packetstormsecurity.com/files/162194/Horde-Groupware-Webmail-5.2.22-Cross-Site-Scripting.html; https://github.com/horde/webmail/releases
CVE: CVE-2021-27213
Published: 2021-02-14
Description: config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safe_load are not used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/cvandeplas/pystemon/commit/dbeb87afefdb63de2f4cff69b6f10c5965d14b54; https://www.huntr.dev/bounties/1-other-pystemon/; https://github.com/cvandeplas/pystemon/commit/dbeb87afefdb63de2f4cff69b6f10c5965d14b54
CVE: CVE-2020-36234
Published: 2021-02-15
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72059; https://jira.atlassian.com/browse/JRASERVER-72059
CVE: CVE-2020-36235
Published: 2021-02-15
Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-71950; https://jira.atlassian.com/browse/JRASERVER-71950
CVE: CVE-2020-36236
Published: 2021-02-15
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72015; https://jira.atlassian.com/browse/JRASERVER-72015
CVE: CVE-2020-36237
Published: 2021-02-15
Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-72064; https://jira.atlassian.com/browse/JRASERVER-72064
CVE: CVE-2020-29451
Published: 2021-02-15
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.14.1.
CVSS Score: 4.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-72000; https://jira.atlassian.com/browse/JRASERVER-72000
CVE: CVE-2020-7071
Published: 2021-02-15
Description: In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://bugs.php.net/bug.php?id=77423; https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html; https://security.gentoo.org/glsa/202105-23
CVE: CVE-2021-21702
Published: 2021-02-15
Description: In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugs.php.net/bug.php?id=80672; https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html; https://security.gentoo.org/glsa/202105-23
CVE: CVE-2020-28500
Published: 2021-02-15
Description: Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVSS Score: 5.3 (MEDIUM)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf; https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8; https://github.com/lodash/lodash/pull/5065
CVE: CVE-2021-23336
Published: 2021-02-15
Description: The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-444, CWE-444
References: http://www.openwall.com/lists/oss-security/2021/02/19/4; http://www.openwall.com/lists/oss-security/2021/05/01/2; https://github.com/python/cpython/pull/24297
CVE: CVE-2021-23337
Published: 2021-02-15
Description: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf; https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-25296
Published: 2021-02-15
Description: Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
CVSS Score: 8.8 (HIGH)
References: http://nagios.com; http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html; http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html
CVE: CVE-2021-25297
Published: 2021-02-15
Description: Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://nagios.com; http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html; http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html
CVE: CVE-2021-25298
Published: 2021-02-15
Description: Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://nagios.com; http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html; http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html
CVE: CVE-2021-25299
Published: 2021-02-15
Description: Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://nagios.com; http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html; https://assets.nagios.com/downloads/nagiosxi/versions.php
CVE: CVE-2020-35775
Published: 2021-02-15
Description: CITSmart before 9.1.2.23 allows LDAP Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://packetstormsecurity.com/files/162181/CITSmart-ITSM-9.1.2.22-LDAP-Injection.html; https://citsmart.com.br/solucoes/itsm-2/; https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html
CVE: CVE-2020-4954
Published: 2021-02-15
Description: IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could exploit this vulnerability to bypass authentication and gain access to a limited number of debug functions, such as logging levels. IBM X-Force ID: 192153.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192153; https://www.ibm.com/support/pages/node/6404966; https://exchange.xforce.ibmcloud.com/vulnerabilities/192153
CVE: CVE-2020-4955
Published: 2021-02-15
Description: IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper parameter validation. By creating an unspecified servlet request with specially crafted input parameters, an attacker could exploit this vulnerability to load a malicious .dll with elevated privileges. IBM X-Force ID: 192155.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192155; https://www.ibm.com/support/pages/node/6404966; https://exchange.xforce.ibmcloud.com/vulnerabilities/192155
CVE: CVE-2020-4956
Published: 2021-02-15
Description: IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a grossly large cache value and dumping that cached value to a file multiple times, a remote attacker could exploit this vulnerability to cause the consumption of all memory resources. IBM X-Force ID: 192156.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192156; https://www.ibm.com/support/pages/node/6404966; https://exchange.xforce.ibmcloud.com/vulnerabilities/192156
CVE: CVE-2020-29026
Published: 2021-02-15
Description: A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions to read and write arbitrary files in the Linux file system. This issue affects: GateManager all versions prior to 9.2c.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.secomea.com/support/cybersecurity-advisory/#2918; https://www.secomea.com/support/cybersecurity-advisory/#2918
CVE: CVE-2020-29031
Published: 2021-02-15
Description: An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c
CVSS Score: 7.1 (HIGH)
CWE: CWE-280, CWE-269
References: https://www.secomea.com/support/cybersecurity-advisory/#2920; https://www.secomea.com/support/cybersecurity-advisory/#2920
CVE: CVE-2021-23338
Published: 2021-02-15
Description: This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-502
References: https://github.com/418sec/huntr/pull/1329; https://snyk.io/vuln/SNYK-PYTHON-QLIB-1054635; https://github.com/418sec/huntr/pull/1329
CVE: CVE-2020-35512
Published: 2021-02-15
Description: A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://bugs.gentoo.org/755392; https://bugzilla.redhat.com/show_bug.cgi?id=1909101; https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128
CVE: CVE-2021-27218
Published: 2021-02-15
Description: An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681
References: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1942; https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1944; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2021-27219
Published: 2021-02-15
Description: An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681
References: https://gitlab.gnome.org/GNOME/glib/-/issues/2319; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E; https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html
CVE: CVE-2020-22425
Published: 2021-02-15
Description: Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://code610.blogspot.com/2020/04/postauth-sqli-in-centreon-1910-1el7.html%2C; https://github.com/c610/free/; https://code610.blogspot.com/2020/04/postauth-sqli-in-centreon-1910-1el7.html%2C
CVE: CVE-2020-22427
Published: 2021-02-15
Description: NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted, and the only option is to pay for a subscription service where technical details may be disclosed at an unspecified later time
CVSS Score: 7.2 (HIGH)
References: https://code610.blogspot.com/2020/03/postauth-rce-bugs-in-nagiosxi-5611.html; https://code610.blogspot.com/2020/03/postauth-rce-bugs-in-nagiosxi-5611.html
CVE: CVE-2020-24899
Published: 2021-02-15
Description: Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://code610.blogspot.com/2020/08/postauth-rce-in-nagios-572.html; https://code610.blogspot.com/2020/08/postauth-rce-in-nagios-572.html
CVE: CVE-2021-3375
Published: 2021-02-15
Description: ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://code610.blogspot.com/2021/01/crashing-activepresenter.html; https://code610.blogspot.com/2021/01/crashing-activepresenter.html
CVE: CVE-2021-27201
Published: 2021-02-15
Description: Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/MucahitSaratar/endian_firewall_authenticated_rce; https://sourceforge.net/projects/efw/files/Development/EFW-3.3.2/; https://www.endian.com/company/news/endian-community-releases-new-version-332-148/