deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10196
Published: 2021-03-19
Description: A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-665
References: https://bugzilla.redhat.com/show_bug.cgi?id=1567245; https://www.npmjs.com/advisories/607; https://bugzilla.redhat.com/show_bug.cgi?id=1567245
CVE: CVE-2019-10200
Published: 2021-03-19
Description: A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. With access to the security credentials, the user then has access to the entire infrastructure. Impact to data and system availability is high.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1730161; https://github.com/openshift/cluster-kube-apiserver-operator/pull/524; https://bugzilla.redhat.com/show_bug.cgi?id=1730161
CVE: CVE-2019-10225
Published: 2021-03-19
Description: A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=1743073; https://bugzilla.redhat.com/show_bug.cgi?id=1743073
CVE: CVE-2019-14828
Published: 2021-03-19
Description: A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that role.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://moodle.org/mod/forum/discuss.php?d=391031; https://moodle.org/mod/forum/discuss.php?d=391031
CVE: CVE-2019-14829
Published: 2021-03-19
Description: A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-573
References: https://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=208397c120b6bf74ca6a173e42cb527904c5ab42; https://moodle.org/mod/forum/discuss.php?d=391035; https://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=208397c120b6bf74ca6a173e42cb527904c5ab42
CVE: CVE-2019-14830
Published: 2021-03-19
Description: A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=d4985a77391123c5959db432c076328f8d5e3624; https://moodle.org/mod/forum/discuss.php?d=391036; https://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=d4985a77391123c5959db432c076328f8d5e3624
CVE: CVE-2019-14831
Published: 2021-03-19
Description: A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced subscription mode was enabled. If a forum's subscription mode was set to "forced subscription", the forum's subscribe link contained an open redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=32e2e06a8737afb07ee83abb3eacd39f8b181216; https://moodle.org/mod/forum/discuss.php?d=391037; https://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=32e2e06a8737afb07ee83abb3eacd39f8b181216
CVE: CVE-2021-21267
Published: 2021-03-19
Description: Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation is vulnerable to a denial-of-service attack where some input (for example `a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`) will freeze the program or web browser page executing the code. This affects any current schema-inspector users using any version to validate email addresses. Users who do not do email validation, and instead do other types of validation (like string min or max length, etc), are not affected. Users should upgrade to version 2.0.0, which uses a regex expression that isn't vulnerable to ReDoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-400
References: https://gist.github.com/mattwelke/b7f42424680a57b8161794ad1737cd8f; https://github.com/schema-inspector/schema-inspector/security/advisories/GHSA-f38p-c2gq-4pmr; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-28950
Published: 2021-03-20
Description: An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-834
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed; https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
CVE: CVE-2021-28951
Published: 2021-03-20
Description: An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3ebba796fa251d042be42b929a2d916ee5c34a49; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VCKIOXCOZGXBEZMO5LGGV5MWCHO6FT3/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTRNPQTZ4GVS46SZ4OBXY5YDOGVPSTGQ/
CVE: CVE-2021-28117
Published: 2021-03-20
Description: libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)
CVSS Score: 7.5 (HIGH)
References: https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356; https://github.com/KDE/discover/releases; https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec[PII_REDACTED]e60
CVE: CVE-2021-28952
Published: 2021-03-20
Description: An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This has been fixed in 5.12-rc4.)
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1c668e1c0a0f74472469cd514f40c9012b324c31; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VCKIOXCOZGXBEZMO5LGGV5MWCHO6FT3/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTRNPQTZ4GVS46SZ4OBXY5YDOGVPSTGQ/
CVE: CVE-2020-27170
Published: 2021-03-20
Description: An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-203
References: http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html; http://www.openwall.com/lists/oss-security/2021/03/24/4; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
CVE: CVE-2020-27171
Published: 2021-03-20
Description: An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-193
References: http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html; http://www.openwall.com/lists/oss-security/2021/03/24/5; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
CVE: CVE-2021-28953
Published: 2021-03-21
Description: The unofficial C/C++ Advanced Lint extension before 1.9.0 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted repository.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/jbenden/vscode-c-cpp-flylint/compare/v1.8.2...v1.9.0; https://marketplace.visualstudio.com/items?itemName=jbenden.c-cpp-flylint; https://vuln.ryotak.me/advisories/16
CVE: CVE-2021-28954
Published: 2021-03-21
Description: In Chris Walz bit before 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/chriswalz/bit/releases/tag/v1.0.5; https://vuln.ryotak.me/advisories/17; https://github.com/chriswalz/bit/releases/tag/v1.0.5
CVE: CVE-2021-28957
Published: 2021-03-21
Description: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugs.launchpad.net/lxml/+bug/1888153; https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999; https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270
CVE: CVE-2021-28961
Published: 2021-03-21
Description: applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/openwrt/luci/commit/9df7ea4d66644df69fcea18b36bc465912ffc; https://openwrt.org/advisory/2021-08-01-3; https://github.com/openwrt/luci/commit/9df7ea4d66644df69fcea18b36bc465912ffc
CVE: CVE-2021-23360
Published: 2021-03-21
Description: This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/ssnau/killport/blob/5268f23ea8f152e47182b263d8f7ef20c12a9f28/index.js%23L9; https://github.com/ssnau/killport/commit/bec8e371f170a12e11cd222ffc7a6e1ae9942638; https://snyk.io/vuln/SNYK-JS-KILLPORT-1078535
CVE: CVE-2020-13963
Published: 2021-03-21
Description: SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for admin is hardcoded in the installation code, and there is no key for publicsp (which is a guest account).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cwe.mitre.org/data/definitions/321.html; https://forum.soplanning.org/viewforum.php?f=8; https://labs.integrity.pt/advisories/cve-2020-13963/
CVE: CVE-2021-26069
Published: 2021-03-22
Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information Disclosure vulnerability in the /rest/api/1.0/issues/{id}/ActionsAndOperations API endpoint. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://jira.atlassian.com/browse/JRASERVER-72010; https://jira.atlassian.com/browse/JRASERVER-72010
CVE: CVE-2021-26070
Published: 2021-03-22
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `makeRequest` gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: https://jira.atlassian.com/browse/JRASERVER-72029; https://jira.atlassian.com/browse/JRASERVER-72029
CVE: CVE-2021-28955
Published: 2021-03-22
Description: git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on Windows).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-427
References: https://github.com/MichaelMure/git-bug/security/advisories/GHSA-m898-h4pm-pqfr; https://vuln.ryotak.me/advisories/18; https://github.com/MichaelMure/git-bug/security/advisories/GHSA-m898-h4pm-pqfr
CVE: CVE-2021-28956
Published: 2021-03-22
Description: The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 8.8 (HIGH)
References: https://github.com/glen-84/vscode-sass-lint/compare/v1.0.6...v1.0.7; https://github.com/glen-84/vscode-sass-lint/releases; https://marketplace.visualstudio.com/items/glen-84.sass-lint/changelog
CVE: CVE-2021-28963
Published: 2021-03-22
Description: Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://bugs.debian.org/985405; https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=d1dbebfadc1bdb824fea63843c4c38fa69e54379; https://issues.shibboleth.net/jira/browse/SSPCPP-922
CVE: CVE-2021-21437
Published: 2021-03-22
Description: Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions
CVSS Score: 3.5 (LOW)
CWE: CWE-264, CWE-862
References: https://otrs.com/release-notes/otrs-security-advisory-2021-07/; https://otrs.com/release-notes/otrs-security-advisory-2021-07/
CVE: CVE-2021-21438
Published: 2021-03-22
Description: Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions.
CVSS Score: 3.5 (LOW)
CWE: CWE-264, CWE-276
References: https://otrs.com/release-notes/otrs-security-advisory-2021-08/; https://otrs.com/release-notes/otrs-security-advisory-2021-08/
CVE: CVE-2021-28964
Published: 2021-03-22
Description: A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dbcc7d57bffc0c8cac9dac11bec548597d59a6a5; https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html; https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
CVE: CVE-2020-28501
Published: 2021-03-22
Description: This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/JefferyHus/es6-crawler-detect/pull/27; https://snyk.io/vuln/SNYK-JS-ES6CRAWLERDETECT-1051529; https://github.com/JefferyHus/es6-crawler-detect/pull/27
CVE: CVE-2021-26295
Published: 2021-03-22
Description: Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html; https://lists.apache.org/thread.html/r078351a876ed284ba667b33aba29428d7308a5bd4df78f14a3df6661%40%3Cnotifications.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0%40%3Cdev.ofbiz.apache.org%3E
CVE: CVE-2021-27962
Published: 2021-03-22
Description: Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.
CVSS Score: 7.1 (HIGH)
References: http://www.openwall.com/lists/oss-security/2021/03/19/5; https://community.grafana.com; https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
CVE: CVE-2021-28146
Published: 2021-03-22
Description: The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team permissions that the user isn't supposed to have.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724; https://community.grafana.com/t/release-notes-v6-7-x/27119; https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
CVE: CVE-2021-27308
Published: 2021-03-22
Description: A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162946/4Images-1.8-Cross-Site-Scripting.html; https://github.com/4images/4images/issues/3; http://packetstormsecurity.com/files/162946/4Images-1.8-Cross-Site-Scripting.html
CVE: CVE-2021-28147
Published: 2021-03-22
Description: The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.
CVSS Score: 6.5 (MEDIUM)
References: https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724; https://community.grafana.com/t/release-notes-v6-7-x/27119; https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
CVE: CVE-2021-28148
Published: 2021-03-22
Description: One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724; https://community.grafana.com/t/release-notes-v6-7-x/27119; https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
CVE: CVE-2021-28968
Published: 2021-03-22
Description: An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authentication) injecting arbitrary JavaScript into any forum message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://punbb.informer.com/; https://punbb.informer.com/
CVE: CVE-2020-4882
Published: 2021-03-22
Description: IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data . This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 190852.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190852; https://www.ibm.com/support/pages/node/6430643; https://exchange.xforce.ibmcloud.com/vulnerabilities/190852
CVE: CVE-2021-27593
Published: 2021-03-22
Description: When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 3.3 (LOW)
References: https://launchpad.support.sap.com/#/notes/3035472; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/3035472
CVE: CVE-2021-27594
Published: 2021-03-22
Description: When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 3.3 (LOW)
References: https://launchpad.support.sap.com/#/notes/3035472; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/3035472
CVE: CVE-2021-27595
Published: 2021-03-22
Description: When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 3.3 (LOW)
References: https://launchpad.support.sap.com/#/notes/3035472; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/3035472
CVE: CVE-2021-27596
Published: 2021-03-22
Description: When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 3.3 (LOW)
References: https://launchpad.support.sap.com/#/notes/3035472; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107; https://launchpad.support.sap.com/#/notes/3035472