deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21374
Published: 2021-03-26
Description: Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-348, CWE-349, CWE-599, CWE-295
References: https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/; https://github.com/nim-lang/Nim/pull/16940; https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
CVE: CVE-2021-21396
Published: 2021-03-26
Description: wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the `GET /users/list-clients` endpoint. The endpoint could be used by any logged in user who could request client details of any other user (no connection required) as far as they can find their User ID. The exposed metadata included id, class, type, location, time, and cookie. A user on a Wire backend could use this endpoint to find registration time and location for each device for a given list of users. As a workaround, remove `/list-clients` from nginx config. This has been fixed in version 2021-03-02.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/wireapp/wire-server/commit/7ba2bf[PII_REDACTED]cf215e0b2c354d4d08cd3421; https://github.com/wireapp/wire-server/releases/tag/v2021-03-02; https://github.com/wireapp/wire-server/security/advisories/GHSA-qx8q-rhq2-rg4j
CVE: CVE-2021-29264
Published: 2021-03-26
Description: An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver allows attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled, aka CID-d8861bab48b6.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d8861bab48b6c1fc3cdbcab8ff9d1eaea43afe7f; https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d8861bab48b6c1fc3cdbcab8ff9d1eaea43afe7f
CVE: CVE-2021-29265
Published: 2021-03-26
Description: An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.7; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9380afd6df70e24eacbdbde33afc6a3950965d22; https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
CVE: CVE-2021-29266
Published: 2021-03-26
Description: An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.9; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f6bbf0010ba004f5e90c7aefdebc0ee4bd3283b9; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-29249
Published: 2021-03-26
Description: BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://blog.btcpayserver.org/btcpay-server-1-0-6-0/; https://github.com/btcpayserver/btcpayserver/releases; https://blog.btcpayserver.org/btcpay-server-1-0-6-0/
CVE: CVE-2021-29271
Published: 2021-03-27
Description: remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/umputun/remark42/compare/v1.6.0...v1.6.1; https://vuln.ryotak.me/advisories/19; https://github.com/umputun/remark42/compare/v1.6.0...v1.6.1
CVE: CVE-2021-29272
Published: 2021-03-27
Description: bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/microcosm-cc/bluemonday/releases/tag/v1.0.5; https://vuln.ryotak.me/advisories/4; https://github.com/microcosm-cc/bluemonday/releases/tag/v1.0.5
CVE: CVE-2021-29274
Published: 2021-03-29
Description: Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.redmine.org/issues/33846; https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://www.redmine.org/issues/33846
CVE: CVE-2021-28936
Published: 2021-03-29
Description: The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted HTTP GET request. The administrator username has to be known (default:admin) whereas no previous authentication is required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://acexy.com; http://wireless-n.com; https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990
CVE: CVE-2021-28937
Published: 2021-03-29
Description: The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password in plaintext. The page can be intercepted on HTTP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://acexy.com; https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990; http://acexy.com
CVE: CVE-2021-23358
Published: 2021-03-29
Description: The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
CVSS Score: 3.3 (LOW)
CWE: CWE-94
References: https://github.com/jashkenas/underscore/blob/master/modules/template.js%23L71; https://lists.apache.org/thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1%40%3Cissues.cordova.apache.org%3E; https://lists.apache.org/thread.html/r770f[PII_REDACTED]17b117ab4472b0a32c266ee4abbafda28b8a6f9306%40%3Cissues.cordova.apache.org%3E
CVE: CVE-2019-5317
Published: 2021-03-29
Description: A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.15 and below; Aruba Instant 8.3.x: 8.3.0.11 and below; Aruba Instant 8.4.x: 8.4.0.5 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2020-7850
Published: 2021-03-29
Description: NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-88, CWE-88
References: http://help.neobizbox.com/; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35982; http://help.neobizbox.com/
CVE: CVE-2021-21727
Published: 2021-03-29
Description: A ZTE product has a DoS vulnerability. A remote attacker can amplify traffic by sending carefully constructed IPv6 packets to the affected devices, which eventually leads to device denial of service. This affects:<ZXHN F623><All versions up to V6.0.0P3T33>
CVSS Score: 7.5 (HIGH)
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014744; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014744
CVE: CVE-2021-27352
Published: 2021-03-29
Description: An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site after a successful login.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://drive.google.com/file/d/1kSDlPASBCgJEINxTSIsjMWrU4u4T5XCc/view?usp=sharing; https://github.com/xoffense/POC/blob/main/Ilch%202.1.42%20Open%20redirect; https://www.ilch.de/
CVE: CVE-2021-29267
Published: 2021-03-29
Description: Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Security-AVS/CVE-2021-29267; https://sherlockim.ae; https://github.com/Security-AVS/CVE-2021-29267
CVE: CVE-2020-25217
Published: 2021-03-29
Description: Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cwe.mitre.org/data/definitions/77.html; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0001/FEYE-2021-0001.md; https://cwe.mitre.org/data/definitions/77.html
CVE: CVE-2020-25218
Published: 2021-03-29
Description: Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://cwe.mitre.org/data/definitions/306.html; https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0002/FEYE-2021-0002.md; https://cwe.mitre.org/data/definitions/306.html
CVE: CVE-2021-28670
Published: 2021-03-29
Description: Xerox AltaLink B8045/B8090 before 103[PII_REDACTED]0, C8030/C8035 before 103[PII_REDACTED]0, C8045/C8055 before 103[PII_REDACTED]0 and C8070 before 103[PII_REDACTED]0 allow unauthorized users, by leveraging the Scan To Mailbox feature, to delete arbitrary files from the disk.
CVSS Score: 9.1 (CRITICAL)
References: https://securitydocs.business.xerox.com/wp-content/uploads/2020/12/cert_Security_Mini_Bulletin_XRX20X_for_ALB80xx-C80xxv.pdf; https://securitydocs.business.xerox.com/wp-content/uploads/2020/12/cert_Security_Mini_Bulletin_XRX20X_for_ALB80xx-C80xxv.pdf
CVE: CVE-2021-29416
Published: 2021-03-29
Description: An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a request that does not respect its upstream proxy configuration. This could leak NetNTLM hashes on Windows systems that fail to block outbound SMB.
CVSS Score: 6.5 (MEDIUM)
References: https://hackerone.com/reports/1054382; https://portswigger.net/burp/releases/professional-community-2020-12?requestededition=professional; https://hackerone.com/reports/1054382
CVE: CVE-2021-29417
Published: 2021-03-29
Description: gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/liamg/gitjacker/compare/v0.0.3...v0.1.0; https://github.com/liamg/gitjacker/releases/tag/v0.1.0; https://vuln.ryotak.me/advisories/5
CVE: CVE-2020-24635
Published: 2021-03-29
Description: A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aruba Instant 8.7.x: 8.7.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2020-24636
Published: 2021-03-29
Description: A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aruba Instant 8.7.x: 8.7.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2020-25577
Published: 2021-03-29
Description: In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 rtsold(8) does not verify that the RDNSS option does not extend past the end of the received packet before processing its contents. While the kernel currently ignores such malformed packets, it passes them to userspace programs. Any programs expecting the kernel to do validation may be vulnerable to an overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc
CVE: CVE-2020-25583
Published: 2021-03-29
Description: In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 when processing a DNSSL option, rtsold(8) decodes domain name labels per an encoding specified in RFC 1035 in which the first octet of each label contains the label's length. rtsold(8) did not validate label lengths correctly and could overflow the destination buffer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc
CVE: CVE-2020-35137
Published: 2021-03-29
Description: The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in com/mobileiron/registration/RegisterActivity.java and can be used for api/v1/gateway/customers/servers requests. NOTE: Vendor states that this is an opt-in feature to the product - it is not enabled by default and customers cannot enable it without an explicit email to support. At this time, they do not plan change to make any changes to this feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://github.com/optiv/rustyIron; https://play.google.com/store/apps/details?id=com.mobileiron&hl=en_US&gl=US; https://www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration
CVE: CVE-2020-35138
Published: 2021-03-29
Description: The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in the com/mobileiron/common/utils/C4928m.java file. NOTE: It has been asserted that there is no causality or connection between credential encryption and the MiTM attack
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/optiv/rustyIron; https://play.google.com/store/apps/details?id=com.mobileiron&hl=en_US&gl=US; https://www.ivanti.com/blog/a-warranted-response-to-inaccurate-optiv-research
CVE: CVE-2021-25143
Published: 2021-03-29
Description: A remote denial of service (dos) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.9 and below; Aruba Instant 8.6.x: 8.6.0.4 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2021-25144
Published: 2021-03-29
Description: A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf
CVE: CVE-2021-26714
Published: 2021-03-29
Description: The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insufficient access control. A successful exploit could allow an attacker to view and modify application data via Directory Traversal.
CVSS Score: 9.8 (CRITICAL)
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0003; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0003
CVE: CVE-2021-28668
Published: 2021-03-29
Description: Xerox AltaLink B80xx before 103[PII_REDACTED]0, C8030/C8035 before 103[PII_REDACTED]0, C8045/C8055 before 103[PII_REDACTED]0 and C8070 before 103[PII_REDACTED]0 has several SQL injection vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://securitydocs.business.xerox.com/wp-content/uploads/2020/09/cert_Security_Mini_Bulletin_XRX20R_for_ALB80xx-C80xx-2.pdf; https://securitydocs.business.xerox.com/wp-content/uploads/2020/09/cert_Security_Mini_Bulletin_XRX20R_for_ALB80xx-C80xx-2.pdf
CVE: CVE-2021-28669
Published: 2021-03-29
Description: Xerox AltaLink B80xx before 103[PII_REDACTED]0, C8030/C8035 before 103[PII_REDACTED]0, C8045/C8055 before 103[PII_REDACTED]0 and C8070 before 103[PII_REDACTED]0 provide the ability to set configuration attributes without administrative rights.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://securitydocs.business.xerox.com/wp-content/uploads/2020/09/cert_Security_Mini_Bulletin_XRX20R_for_ALB80xx-C80xx-2.pdf; https://securitydocs.business.xerox.com/wp-content/uploads/2020/09/cert_Security_Mini_Bulletin_XRX20R_for_ALB80xx-C80xx-2.pdf
CVE: CVE-2021-28673
Published: 2021-03-29
Description: Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), WorkCentre 6515 before 65.61.23 and 65.59.11 (Bridge), VersaLink B400 before 37.61.23 and 37.59.01 (Bridge), B405 before 38.61.23 and 38.59.01 (Bridge), B600/B610 before 32.61.23 and 32.59.01 (Bridge), B605/B615 before 33.61.23 and 33.59.01 (Bridge), B7025/30/35 before 58.61.23 and 58.59.11 (Bridge), C400 before 67.61.23 and 67.59.01 (Bridge), C405 before 68.61.23 and 68.59.01 (Bridge), C500/C600 before 61.61.23 and 61.59.01 (Bridge), C505/C605 before 62.61.23 and 62.59.11 (Bridge), C7000 before 56.61.23 and 56.59.01 (Bridge), C7020/25/30 before 57.61.23 and 57.59.01 (Bridge), C8000/C9000 before 70.61.23 and 70.59.01 (Bridge), allows remote attackers with "a weaponized clone file" to execute arbitrary commands in the Web User Interface.
CVSS Score: 9.8 (CRITICAL)
References: https://securitydocs.business.xerox.com/wp-content/uploads/2020/06/cert_Security_Mini_Bulletin_XRX20K_for_PH6510_WC6515_VLB4xx_C4xx_B6XX_B70xx_C5xx_C6xx_C7xxx.pdf; https://securitydocs.business.xerox.com/wp-content/uploads/2020/06/cert_Security_Mini_Bulletin_XRX20K_for_PH6510_WC6515_VLB4xx_C4xx_B6XX_B70xx_C5xx_C6xx_C7xxx.pdf
CVE: CVE-2021-3391
Published: 2021-03-29
Description: MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/optiv/rustyIron; https://www.mobileiron.com/en/blog/mobileiron-security-updates-available; https://www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration
CVE: CVE-2021-27239
Published: 2021-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the upnpd service, which listens on UDP port 1900 by default. A crafted MX header field in an SSDP message can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11851.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://kb.netgear.com/000062820/Security-Advisory-for-Stack-based-Buffer-Overflow-Remote-Code-Execution-Vulnerability-on-Some-Routers-PSV-2020-0432; https://www.zerodayinitiative.com/advisories/ZDI-21-206/; https://kb.netgear.com/000062820/Security-Advisory-for-Stack-based-Buffer-Overflow-Remote-Code-Execution-Vulnerability-on-Some-Routers-PSV-2020-0432
CVE: CVE-2021-27240
Published: 2021-03-29
Description: This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DataGridService WCF service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of Administrator. Was ZDI-CAN-12009.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://www.zerodayinitiative.com/advisories/ZDI-21-207/; https://www.zerodayinitiative.com/advisories/ZDI-21-207/
CVE: CVE-2021-27241
Published: 2021-03-29
Description: This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Build 20.8.5653.561). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AvastSvc.exe module. By creating a directory junction, an attacker can abuse the service to delete a directory. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12082.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-21-208/; https://www.zerodayinitiative.com/advisories/ZDI-21-208/