deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-11213
Published: 2021-01-21
Description: Out of bound reads might occur in while processing Service descriptor due to improper validation of length of fields in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-11214
Published: 2021-01-21
Description: Buffer over-read while processing NDL attribute if attribute length is larger than expected and then FW is treating it as more number of immutable schedules in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-11215
Published: 2021-01-21
Description: An out of bounds read can happen when processing VSA attribute due to improper minimum required length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-11216
Published: 2021-01-21
Description: Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-11217
Published: 2021-01-21
Description: A possible double free or invalid memory access in audio driver while reading Speaker Protection parameters in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-11225
Published: 2021-01-21
Description: Out of bound access in WLAN driver due to lack of validation of array length before copying into array in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-3685
Published: 2021-01-21
Description: Pointer variable which is freed is not cleared can result in memory corruption and leads to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-3686
Published: 2021-01-21
Description: Possible memory out of bound issue during music playback when an incorrect bit stream content is copied into array without checking the length of array in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-3687
Published: 2021-01-21
Description: Local privilege escalation in admin services in Windows environment can occur due to an arbitrary read issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-3691
Published: 2021-01-21
Description: Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2020-bulletin
CVE: CVE-2020-26285
Published: 2021-01-21
Description: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
CVSS Score: 8.7 (HIGH)
CWE: CWE-22, CWE-434
References: https://github.com/OpenMage/magento-lts/commit/4132668f5009f17456fe644742026f56d2297586; https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10; https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hj6w-xrv3-wjj9
CVE: CVE-2020-26295
Published: 2021-01-21
Description: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
CVSS Score: 8.7 (HIGH)
CWE: CWE-22, CWE-434, CWE-22, CWE-434
References: https://github.com/OpenMage/magento-lts/commit/9cf8c0aa1d1306051a18ace08d40279dadc1fb35; https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10; https://github.com/OpenMage/magento-lts/security/advisories/GHSA-52c6-6v3v-f3fg
CVE: CVE-2020-4958
Published: 2021-01-21
Description: IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. IBM X-Force ID: 192209.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192209; https://www.ibm.com/support/pages/node/6403247; https://exchange.xforce.ibmcloud.com/vulnerabilities/192209
CVE: CVE-2020-4966
Published: 2021-01-21
Description: IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 192423.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-59
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192423; https://www.ibm.com/support/pages/node/6403233; https://exchange.xforce.ibmcloud.com/vulnerabilities/192423
CVE: CVE-2020-4968
Published: 2021-01-21
Description: IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192427.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192427; https://www.ibm.com/support/pages/node/6403241; https://exchange.xforce.ibmcloud.com/vulnerabilities/192427
CVE: CVE-2020-4969
Published: 2021-01-21
Description: IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192428; https://www.ibm.com/support/pages/node/6403257; https://exchange.xforce.ibmcloud.com/vulnerabilities/192428
CVE: CVE-2021-21238
Published: 2021-01-21
Description: PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347
References: https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14; https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0; https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9
CVE: CVE-2021-21239
Published: 2021-01-21
Description: PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347
References: https://github.com/IdentityPython/pysaml2/commit/46578df0695269a16f1c94171f1429873f90ed99; https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0; https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-5p3x-r448-pc62
CVE: CVE-2021-21253
Published: 2021-01-21
Description: OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables to crack passwords. This problem is fixed and published in version 1.1.2. A long randomly generated salt is added to the password hash function to better protect passwords stored in the voting system.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-759, CWE-916
References: https://github.com/dbijaya/OnlineVotingSystem/commit/0181cb[PII_REDACTED]c8eb3e44fcf6cb014ff90f09; https://github.com/dbijaya/OnlineVotingSystem/security/advisories/GHSA-wwg8-372v-v332; https://github.com/dbijaya/OnlineVotingSystem/commit/0181cb[PII_REDACTED]c8eb3e44fcf6cb014ff90f09
CVE: CVE-2020-8554
Published: 2021-01-21
Description: Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-283
References: https://github.com/kubernetes/kubernetes/issues/97076; https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8; https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2020-8567
Published: 2021-01-21
Description: Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384; https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY; https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384
CVE: CVE-2020-8568
Published: 2021-01-21
Description: Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-24, CWE-22
References: https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/378; https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/Cb9cvymTzl4; https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/378
CVE: CVE-2020-8569
Published: 2021-01-21
Description: Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, is automatically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an endless crashloop. Only the volume snapshot feature is affected by this vulnerability. When exploited, users can’t take snapshots of their volumes or delete the snapshots. All other Kubernetes functionality is not affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/kubernetes-csi/external-snapshotter/issues/380; https://groups.google.com/g/kubernetes-security-announce/c/1EzCr1qUxxU; https://github.com/kubernetes-csi/external-snapshotter/issues/380
CVE: CVE-2020-8570
Published: 2021-01-21
Description: Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://github.com/kubernetes-client/java/issues/1491; https://groups.google.com/g/kubernetes-security-announce/c/sd5h73sFPrg; https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2021-22847
Published: 2021-01-22
Description: Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/tw/cp-132-4316-298fc-1.html; https://www.twcert.org.tw/tw/cp-132-4316-298fc-1.html
CVE: CVE-2021-22849
Published: 2021-01-22
Description: Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS (Stored Cross-site scripting) attack.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4318-09cd3-1.html; https://www.twcert.org.tw/tw/cp-132-4318-09cd3-1.html
CVE: CVE-2020-28488
Published: 2021-01-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-4766
Published: 2021-01-22
Description: IBM MQ Internet Pass-Thru 2.1 and 9.2 could allow a remote user to cause a denial of service by sending malformed MQ data requests which would consume all available resources. IBM X-Force ID: 188093.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188903; https://www.ibm.com/support/pages/node/6406254; https://exchange.xforce.ibmcloud.com/vulnerabilities/188903
CVE: CVE-2021-21259
Published: 2021-01-22
Description: HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. As a workaround, disallow loading JavaScript from 3rd party sites using the `Content-Security-Policy` header. Note that this will break some embedded content.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: https://github.com/hackmdio/codimd/issues/1648; https://github.com/hedgedoc/hedgedoc/commit/35b0d39a12aa35f27fba8c1f50b1886706e7efef; https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2
CVE: CVE-2020-28487
Published: 2021-01-22
Description: This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/visjs/vis-timeline/issues/838; https://github.com/visjs/vis-timeline/pull/840; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVISJS-1063502
CVE: CVE-2021-21260
Published: 2021-01-22
Description: Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables an attacker takeover of the admin account through a payload that extracts a csrf token and sends a request to change password. It has been found that Item description is reflected without sanitization in app/items_view.php which enables the malicious scenario.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://github.com/bigprof-software/online-invoicing-system/releases/tag/4.2; https://github.com/bigprof-software/online-invoicing-system/security/advisories/GHSA-rm79-5596-r7q4; https://github.com/bigprof-software/online-invoicing-system/releases/tag/4.2
CVE: CVE-2021-21270
Published: 2021-01-22
Description: OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-319
References: https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42; https://github.com/OctopusDeploy/OctopusDSC/pull/270; https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002
CVE: CVE-2020-12511
Published: 2021-01-22
Description: Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://cert.vde.com/en-us/advisories/vde-2020-038; https://cert.vde.com/en-us/advisories/vde-2020-038
CVE: CVE-2020-12512
Published: 2021-01-22
Description: Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://cert.vde.com/en-us/advisories/vde-2020-038; https://cert.vde.com/en-us/advisories/vde-2020-038
CVE: CVE-2020-12513
Published: 2021-01-22
Description: Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://cert.vde.com/en-us/advisories/vde-2020-038; https://cert.vde.com/en-us/advisories/vde-2020-038
CVE: CVE-2020-12514
Published: 2021-01-22
Description: Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cert.vde.com/en-us/advisories/vde-2020-038; https://cert.vde.com/en-us/advisories/vde-2020-038
CVE: CVE-2020-12525
Published: 2021-01-22
Description: M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
CVSS Score: 7.3 (HIGH)
CWE: CWE-502, CWE-502
References: https://cert.vde.com/en-us/advisories/vde-2020-038; https://us-cert.cisa.gov/ics/advisories/icsa-21-021-05; https://cert.vde.com/en-us/advisories/vde-2020-038
CVE: CVE-2020-17532
Published: 2021-01-25
Description: When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-502
References: https://issues.apache.org/jira/browse/SCB-2145; https://seclists.org/oss-sec/2021/q1/60; https://issues.apache.org/jira/browse/SCB-2145