deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1101
Published: 2021-07-21
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may lead to denial of service. This affects vGPU version 12.x (prior to 12.3), version 11.x (prior to 11.5) and version 8.x (prior 8.8).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5211; https://nvidia.custhelp.com/app/answers/detail/a_id/5211
CVE: CVE-2021-1102
Published: 2021-07-21
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can lead to floating point exceptions, which may lead to denial of service. This affects vGPU version 12.x (prior to 12.3), version 11.x (prior to 11.5) and version 8.x (prior 8.8).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5211; https://nvidia.custhelp.com/app/answers/detail/a_id/5211
CVE: CVE-2021-1103
Published: 2021-07-21
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may lead to denial of service. This affects vGPU version 12.x (prior to 12.3), version 11.x (prior to 11.5) and version 8.x (prior 8.8).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5211; https://nvidia.custhelp.com/app/answers/detail/a_id/5211
CVE: CVE-2021-23409
Published: 2021-07-21
Description: The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.
CVSS Score: 7.5 (HIGH)
References: https://github.com/pires/go-proxyproto/issues/65; https://github.com/pires/go-proxyproto/pull/74; https://github.com/pires/go-proxyproto/pull/74/commits/cdc63867da24fc609b727231f682670d0d1cd346
CVE: CVE-2020-19609
Published: 2021-07-21
Description: Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when parsing TIFF files allowing attackers to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://git.ghostscript.com/?p=mupdf.git%3Bh=b7892cdc7fae62aa57d63ae62144e1f11b5f9275; https://bugs.ghostscript.com/show_bug.cgi?id=701176; https://bugs.ghostscript.com/show_bug.cgi?id=703076
CVE: CVE-2020-20219
Published: 2021-07-21
Description: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/igmp-proxy process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://mikrotik.com/; https://seclists.org/fulldisclosure/2021/May/2; https://mikrotik.com/
CVE: CVE-2020-20221
Published: 2021-07-21
Description: Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://cwe.mitre.org/data/definitions/400.html; https://seclists.org/fulldisclosure/2020/May/30; https://seclists.org/fulldisclosure/2021/May/1
CVE: CVE-2020-20262
Published: 2021-07-21
Description: Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/nova/bin/ipsec process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/cq674350529/pocs_slides/blob/master/pocs/MikroTik/vul_ipsec/README.md; https://seclists.org/fulldisclosure/2021/May/2; https://github.com/cq674350529/pocs_slides/blob/master/pocs/MikroTik/vul_ipsec/README.md
CVE: CVE-2020-21932
Published: 2021-07-21
Description: A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass login and obtain a partially authorized token and uid.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/cc-crack/router/blob/master/motocx2.md; https://l0n0l.xyz/post/motocx2/; https://github.com/cc-crack/router/blob/master/motocx2.md
CVE: CVE-2020-21933
Published: 2021-07-21
Description: An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private key could be found in the log tar package.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://github.com/cc-crack/router/blob/master/motocx2.md; https://l0n0l.xyz/post/motocx2/; https://github.com/cc-crack/router/blob/master/motocx2.md
CVE: CVE-2020-21934
Published: 2021-07-21
Description: An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where authentication to download the Syslog could be bypassed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/cc-crack/router/blob/master/motocx2.md; https://l0n0l.xyz/post/motocx2/; https://github.com/cc-crack/router/blob/master/motocx2.md
CVE: CVE-2020-21935
Published: 2021-07-21
Description: A command injection vulnerability in HNAP1/GetNetworkTomographySettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/cc-crack/router/blob/master/motocx2.md; https://l0n0l.xyz/post/motocx2/; https://github.com/cc-crack/router/blob/master/motocx2.md
CVE: CVE-2020-21936
Published: 2021-07-21
Description: An issue in HNAP1/GetMultipleHNAPs of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to access the components GetStationSettings, GetWebsiteFilterSettings and GetNetworkSettings without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://github.com/cc-crack/router/blob/master/motocx2.md; https://l0n0l.xyz/post/motocx2/; https://github.com/cc-crack/router/blob/master/motocx2.md
CVE: CVE-2020-21937
Published: 2021-07-21
Description: An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrary system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://cwe.mitre.org/data/definitions/78.html; https://github.com/cc-crack/router/blob/master/motocx2.md; https://l0n0l.xyz/post/motocx2/
CVE: CVE-2020-23282
Published: 2021-07-21
Description: SQL injection in Logon Page in MV's mConnect application, v02.001.00, allows an attacker to use a non existing user with a generic password to connect to the application and get access to unauthorized information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/ifmacedo/mconnect/blob/main/SQLinjection; https://www.linkedin.com/pulse/mconnect-mv-sql-injection-parcial-iran/; https://github.com/ifmacedo/mconnect/blob/main/SQLinjection
CVE: CVE-2020-23283
Published: 2021-07-21
Description: Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute force.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://github.com/ifmacedo/mconnect/blob/main/bruteforce; https://www.linkedin.com/pulse/descobrindo-usu%C3%A1rios-brute-force-iran/; https://github.com/ifmacedo/mconnect/blob/main/bruteforce
CVE: CVE-2021-20106
Published: 2021-07-21
Description: Nessus Agent versions 8.2.5 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user to upload a specially crafted file that could lead to gaining administrator privileges on the Nessus host.
CVSS Score: 6.5 (MEDIUM)
References: https://www.tenable.com/security/tns-2021-13; https://www.tenable.com/security/tns-2021-13
CVE: CVE-2021-21406
Published: 2021-07-21
Description: Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://github.com/Combodo/iTop/security/advisories/GHSA-pf95-6h7q-q85x; https://github.com/Combodo/iTop/security/advisories/GHSA-pf95-6h7q-q85x
CVE: CVE-2021-22145
Published: 2021-07-21
Description: A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-209
References: http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html; https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177; https://gist.github.com/lucasdrufva/f9c5d7c9e26ee087b736d727953afd34
CVE: CVE-2021-22146
Published: 2021-07-21
Description: All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/163655/Elasticsearch-ECE-7.13.3-Database-Disclosure.html; https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-22706
Published: 2021-07-21
Description: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to impersonate the user who manages the charging station or carry out actions on their behalf when crafted malicious parameters are submitted to the charging station web server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22707
Published: 2021-07-21
Description: A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22708
Published: 2021-07-21
Description: A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to craft a malicious firmware package and bypass the signature verification mechanism.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22721
Published: 2021-07-21
Description: A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to get limited knowledge of javascript code when crafted malicious parameters are submitted to the charging station web server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22722
Published: 2021-07-21
Description: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Stored Cross-site Scripting') vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could cause code injection when importing a CSV file or changing station parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22723
Published: 2021-07-21
Description: A CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting) through Cross-Site Request Forgery (CSRF) vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to impersonate the user who manages the charging station or carry out actions on their behalf when crafted malicious parameters are submitted to the charging station web server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22726
Published: 2021-07-21
Description: A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to perform unintended actions or access to data when crafted malicious parameters are submitted to the charging station web server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22727
Published: 2021-07-21
Description: A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to gain unauthorized access to the charging station web server
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-331
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22728
Published: 2021-07-21
Description: A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could cause disclosure of encrypted credentials when consulting the maintenance report.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22729
Published: 2021-07-21
Description: A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to gain unauthorized administrative privileges when accessing to the charging station web server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22730
Published: 2021-07-21
Description: A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could an attacker to gain unauthorized administrative privileges when accessing to the charging station web server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22770
Published: 2021-07-21
Description: A CWE-200: Information Exposure vulnerability exists in Easergy T300 with firmware V2.7.1 and older that exposes sensitive information to an actor not explicitly authorized to have access to that information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-02; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-02
CVE: CVE-2021-22771
Published: 2021-07-21
Description: A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmware V2.7.1 and older that would allow arbitrary command execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1236
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-02; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-02
CVE: CVE-2021-22772
Published: 2021-07-21
Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104) SC2-04IEC-07000100 and earlier), and Easergy T200 ((DNP3) SC2-04DNP-07000102 and earlier) that could cause unauthorized operation when authentication is bypassed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-05; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-05
CVE: CVE-2021-22773
Published: 2021-07-21
Description: A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker connected to the charging station web server to modify the password of a user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-620
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22774
Published: 2021-07-21
Description: A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could lead an attacker to get knowledge of charging station user account credentials using dictionary attacks techniques.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
CVE: CVE-2021-22777
Published: 2021-07-21
Description: A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-03; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-03
CVE: CVE-2021-22784
Published: 2021-07-21
Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attacker to use a crafted webpage to obtain remote access to the system.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-306
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-04; https://www.tenable.com/security/research/tra-2021-50; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-04
CVE: CVE-2021-23411
Published: 2021-07-21
Description: Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result in the output (an anchor a tag) containing undesirable Javascript code that can be executed upon user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/alexcorvi/anchorme.js/blob/gh-pages/src/transform.ts%23L81; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1320695; https://snyk.io/vuln/SNYK-JS-ANCHORME-1311008
CVE: CVE-2021-25695
Published: 2021-07-21
Description: The USB vHub in the Teradici PCOIP Software Agent prior to version 21.07.0 would accept commands from any program, which may allow an attacker to elevate privileges by changing the flow of program execution within the vHub driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-782
References: https://advisory.teradici.com/security-advisories/100/; https://advisory.teradici.com/security-advisories/100/
CVE: CVE-2021-25698
Published: 2021-07-21
Description: The OpenSSL component of the Teradici PCoIP Standard Agent prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attacker to elevate to the privileges of the running process via placing a specially crafted dll in a build configuration directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://advisory.teradici.com/security-advisories/102/; https://advisory.teradici.com/security-advisories/102/
CVE: CVE-2021-25699
Published: 2021-07-21
Description: The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attacker to elevate to the privileges of the running process via placing a specially crafted dll in a build configuration directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://advisory.teradici.com/security-advisories/102/; https://advisory.teradici.com/security-advisories/102/
CVE: CVE-2021-25701
Published: 2021-07-21
Description: The fUSBHub driver in the PCoIP Software Client prior to version 21.07.0 had an error in object management during the handling of a variety of IOCTLs, which allowed an attacker to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://advisory.teradici.com/security-advisories/103/; https://advisory.teradici.com/security-advisories/103/
CVE: CVE-2021-2334
Published: 2021-07-21
Description: Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition Data Redaction. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database - Enterprise Edition Data Redaction accessible data. CVSS 3.1 Base Score 3.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).
CVSS Score: 3.5 (LOW)
References: https://www.oracle.com/security-alerts/cpujul2021.html; https://www.oracle.com/security-alerts/cpujul2021.html