deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-32795
Published: 2021-07-26
Description: ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service (aka DoS) vulnerability which allows attacker to remotely crash running ASF instance through sending a specifically-crafted Steam chat message exists. The user sending the message does not need to be authorized within the bot or ASF process. The attacker needs to know ASF's `CommandPrefix` in advance, but majority of ASF setups run with an unchanged default value. This attack does not allow attacker to gain any potentially-sensitive information, such as logins or passwords, does not allow to execute arbitrary commands and otherwise exploit the crash further. The issue is patched in ASF V4.3.1.0. The only workaround which guarantees complete protection is running all bots with `OnlineStatus` of `0` (Offline). In this setup, ASF is able to ignore even the specifically-crafted message without attempting to interpret it.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/JustArchiNET/ArchiSteamFarm/commit/4cd581ec041912cf199c5512fe6d1dcaec0594c0; https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-5v34-4prm-9474; https://steamcommunity.com/groups/archiasf/discussions/1/[PII_REDACTED]969570844/
CVE: CVE-2020-23240
Published: 2021-07-26
Description: Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12321; http://dev.cmsmadesimple.org/bug/view/12321
CVE: CVE-2020-23241
Published: 2021-07-26
Description: Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12322; http://dev.cmsmadesimple.org/bug/view/12322
CVE: CVE-2020-23242
Published: 2021-07-26
Description: Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/NavigateCMS/Navigate-CMS/issues/16; https://github.com/NavigateCMS/Navigate-CMS/issues/16
CVE: CVE-2020-23243
Published: 2021-07-26
Description: Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/NavigateCMS/Navigate-CMS/issues/18; https://github.com/NavigateCMS/Navigate-CMS/issues/18
CVE: CVE-2021-37555
Published: 2021-07-26
Description: TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is used on port 23 with the default password of 059AnkJ for the root account. The user can then download the filesystem through preinstalled BusyBox utilities (e.g., tar and nc).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://urn.kb.se/resolve?urn=urn:nbn:se:kth:diva-296520; http://urn.kb.se/resolve?urn=urn:nbn:se:kth:diva-296520
CVE: CVE-2020-18428
Published: 2021-07-26
Description: tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which can lead to a denial of service (DOS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_65f9859; https://github.com/syoyo/tinyexr/issues/109; https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_65f9859
CVE: CVE-2020-18430
Published: 2021-07-26
Description: tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which can lead to a denial of service (DOS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_65f9859; https://github.com/syoyo/tinyexr/issues/108; https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_65f9859
CVE: CVE-2021-37576
Published: 2021-07-26
Description: arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2021/07/27/2; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f62f3c20647ebd5fb6ecb8f0b477b9281c44c10a; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDFA7DSQIPM7XPNXJBXFWXHJFVUBCAG6/
CVE: CVE-2021-20399
Published: 2021-07-27
Description: IBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196073.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196073; https://www.ibm.com/support/pages/node/6475263; https://exchange.xforce.ibmcloud.com/vulnerabilities/196073
CVE: CVE-2021-20562
Published: 2021-07-27
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199232.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164782/IBM-Sterling-B2B-Integrator-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2021/Nov/16; https://exchange.xforce.ibmcloud.com/vulnerabilities/199232
CVE: CVE-2021-34432
Published: 2021-07-27
Description: In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=574141; https://bugs.eclipse.org/bugs/show_bug.cgi?id=574141
CVE: CVE-2021-32748
Published: 2021-07-27
Description: Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") protocol to communicate with the Collabora Editor, the communication between these two services was not protected by a credentials or IP check. Whilst this does not result in gaining access to data that the user has not yet access to, it can result in a bypass of any enforced watermark on documents as described on the [Nextcloud Virtual Data Room](https://nextcloud.com/virtual-data-room/) website and [our documentation](https://portal.nextcloud.com/article/nextcloud-and-virtual-data-room-configuration-59.html). The Nextcloud Richdocuments releases 3.8.3 and 4.2.0 add an additional admin settings for an allowlist of IP addresses that can access the WOPI API. We recommend upgrading and configuring the allowlist to a list of Collabora servers. There is no known workaround. Note that this primarily results a bypass of any configured watermark or download protection using File Access Control. If you do not require or rely on these as a security feature no immediate action is required on your end.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/nextcloud/richdocuments/pull/1640; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24x8-h6m2-9jf2; https://hackerone.com/reports/1194606
CVE: CVE-2021-32788
Published: 2021-07-27
Description: Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the last post in a post stream, deleting the last post will result in the creator of the whisper post to be revealed to non-staff users as the last poster of the topic.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5; https://github.com/discourse/discourse/commit/dbdf61196d9e964e8823793d2e7f856595fea4d9; https://github.com/discourse/discourse/security/advisories/GHSA-v6xg-q577-vc92
CVE: CVE-2021-32796
Published: 2021-07-27
Description: xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116, CWE-91, CWE-116
References: https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8b; https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q; https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
CVE: CVE-2020-26180
Published: 2021-07-28
Description: Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport user account. A remote malicious user with low privileges may gain access to data stored on the /ifs directory through most protocols.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.dell.com/support/security/en-us/details/546591/DSA-2020-225-Dell-EMC-Isilon-OneFS-and-Dell-EMC-PowerScale-OneFS-Security-Update-for-remotesuppor; https://www.dell.com/support/security/en-us/details/546591/DSA-2020-225-Dell-EMC-Isilon-OneFS-and-Dell-EMC-PowerScale-OneFS-Security-Update-for-remotesuppor
CVE: CVE-2020-5341
Published: 2021-07-28
Description: Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 and 2.4.1 contain a Deserialization of Untrusted Data Vulnerability. A remote unauthenticated attacker could exploit this vulnerability to send a serialized payload that would execute code on the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.dell.com/support/security/en-us/details/541677/DSA-2020-057-Dell-EMC-Avamar-Server-Deserialization-of-Untrusted-Data-Vulnerability; https://www.dell.com/support/security/en-us/details/541677/DSA-2020-057-Dell-EMC-Avamar-Server-Deserialization-of-Untrusted-Data-Vulnerability
CVE: CVE-2020-5351
Published: 2021-07-28
Description: Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-259
References: https://www.dell.com/support/security/en-us/details/542649/DSA-2020-080-Dell-EMC-Data-Protection-Advisor-Hard-Coded-Credential-Vulnerability; https://www.dell.com/support/security/en-us/details/542649/DSA-2020-080-Dell-EMC-Data-Protection-Advisor-Hard-Coded-Credential-Vulnerability
CVE: CVE-2021-23414
Published: 2021-07-28
Description: This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
CVE: CVE-2021-32000
Published: 2021-07-28
Description: A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files. This issue affects: SUSE Linux Enterprise Server 12 SP3 clone-master-clean-up version 1.6-4.6.1 and prior versions. SUSE Linux Enterprise Server 15 SP1 clone-master-clean-up version 1.6-3.9.1 and prior versions. openSUSE Factory clone-master-clean-up version 1.6-1.4 and prior versions.
CVSS Score: 3.2 (LOW)
CWE: CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=1181050; https://bugzilla.suse.com/show_bug.cgi?id=1181050
CVE: CVE-2021-32001
Published: 2021-07-28
Description: K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://bugzilla.suse.com/show_bug.cgi?id=1188453; https://bugzilla.suse.com/show_bug.cgi?id=1188453
CVE: CVE-2020-4974
Published: 2021-07-28
Description: IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192434; https://www.ibm.com/support/pages/node/6475919; https://exchange.xforce.ibmcloud.com/vulnerabilities/192434
CVE: CVE-2020-5004
Published: 2021-07-28
Description: IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192957.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192957; https://www.ibm.com/support/pages/node/6475919; https://exchange.xforce.ibmcloud.com/vulnerabilities/192957
CVE: CVE-2021-23415
Published: 2021-07-28
Description: This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/mguinness/elFinder.AspNet/commit/675049b39284a9e84f0915c71d688da8ebc7d720; https://snyk.io/vuln/SNYK-DOTNET-ELFINDERASPNET-1315153; https://github.com/mguinness/elFinder.AspNet/commit/675049b39284a9e84f0915c71d688da8ebc7d720
CVE: CVE-2021-23416
Published: 2021-07-28
Description: This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/magynhard/curly-bracket-parser/blob/master/src/curly-bracket-parser/curly-bracket-parser.js%23L31; https://snyk.io/vuln/SNYK-JS-CURLYBRACKETPARSER-1297106; https://github.com/magynhard/curly-bracket-parser/blob/master/src/curly-bracket-parser/curly-bracket-parser.js%23L31
CVE: CVE-2021-23417
Published: 2021-07-28
Description: All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1321
References: https://github.com/jesusgm/deepmergefn/blob/master/index.js%23L6; https://snyk.io/vuln/SNYK-JS-DEEPMERGEFN-1310984; https://github.com/jesusgm/deepmergefn/blob/master/index.js%23L6
CVE: CVE-2021-37578
Published: 2021-07-29
Description: Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. For both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.openwall.com/lists/oss-security/2021/07/29/1; https://lists.apache.org/thread.html/r82047b3ba774cf870ea8e1e9ec51c6107f6cd056d4e36608148c6e71%40%3Cprivate.juddi.apache.org%3E; http://www.openwall.com/lists/oss-security/2021/07/29/1
CVE: CVE-2020-36239
Published: 2021-07-29
Description: Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011[0][1], could execute arbitrary code of their choice in Jira through deserialization due to a missing authentication vulnerability. While Atlassian strongly suggests restricting access to the Ehcache ports to only Data Center instances, fixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service. [0] In Jira Data Center, Jira Core Data Center, and Jira Software Data Center versions prior to 7.13.1, the Ehcache object port can be randomly allocated. [1] In Jira Service Management Data Center versions prior to 3.16.1, the Ehcache object port can be randomly allocated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862, CWE-306, CWE-862
References: https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-2[PII_REDACTED].html; https://jira.atlassian.com/browse/JRASERVER-72566; https://jira.atlassian.com/browse/JSDSERVER-8454
CVE: CVE-2021-20505
Published: 2021-07-29
Description: The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to perform a series of PowerVM service procedures to decrypt the captured migration traffic IBM X-Force ID: 198232
CVSS Score: 4.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198232; https://www.ibm.com/support/pages/node/6475619; https://exchange.xforce.ibmcloud.com/vulnerabilities/198232
CVE: CVE-2020-5329
Published: 2021-07-29
Description: Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.dell.com/support/security/en-us/details/541529/DSA-2020-046-Dell-EMC-Avamar-Server-Open-Redirect-Vulnerability; https://www.dell.com/support/security/en-us/details/541529/DSA-2020-046-Dell-EMC-Avamar-Server-Open-Redirect-Vulnerability
CVE: CVE-2020-5353
Published: 2021-07-29
Description: The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifier (UID) over NFS to rewrite sensitive files to gain administrative access to the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://support.emc.com/kb/542721; https://support.emc.com/kb/542721
CVE: CVE-2021-21538
Published: 2021-07-29
Description: Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the virtual console.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.dell.com/support/kbdoc/000186420; https://www.dell.com/support/kbdoc/000186420
CVE: CVE-2021-21546
Published: 2021-07-29
Description: Dell EMC NetWorker versions 18.x,19.x prior to 19.3.0.4 and 19.4.0.0 contain an Information Disclosure in Log Files vulnerability. A local low-privileged user of the Networker server could potentially exploit this vulnerability to read plain-text credentials from server log files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000185470/dsa-2021-081-dell-emc-networker-security-update-for-a-clear-text-vulnerability; https://www.dell.com/support/kbdoc/en-us/000185470/dsa-2021-081-dell-emc-networker-security-update-for-a-clear-text-vulnerability
CVE: CVE-2021-23418
Published: 2021-07-29
Description: The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-611
References: https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94; https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a; https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32
CVE: CVE-2021-25273
Published: 2021-07-29
Description: Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2021/Dec/3; https://community.sophos.com/utm-firewall/b/blog/posts/utm-up2date-9-706-released; http://seclists.org/fulldisclosure/2021/Dec/3
CVE: CVE-2021-36741
Published: 2021-07-29
Description: An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://success.trendmicro.com/jp/solution/000287796; https://success.trendmicro.com/jp/solution/000287815; https://success.trendmicro.com/solution/000287819
CVE: CVE-2021-36742
Published: 2021-07-29
Description: A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://success.trendmicro.com/jp/solution/000287796; https://success.trendmicro.com/jp/solution/000287815; https://success.trendmicro.com/solution/000287819
CVE: CVE-2021-29736
Published: 2021-07-30
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201300; https://www.ibm.com/support/pages/node/6476678; https://exchange.xforce.ibmcloud.com/vulnerabilities/201300