deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-40528
Published: 2021-09-06
Description: The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://eprint.iacr.org/2021/923; https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=3462280f2e23e16adf3ed5176e0f2413d8861320; https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1
CVE: CVE-2021-40529
Published: 2021-09-06
Description: The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://eprint.iacr.org/2021/923; https://github.com/randombit/botan/pull/2790; https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1
CVE: CVE-2021-40530
Published: 2021-09-06
Description: The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://eprint.iacr.org/2021/923; https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1; https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2
CVE: CVE-2021-40531
Published: 2021-09-06
Description: Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://jonpalmisc.com/2021/11/22/cve-2021-40531; https://www.sketch.com/updates/#version-75; https://jonpalmisc.com/2021/11/22/cve-2021-40531
CVE: CVE-2021-40532
Published: 2021-09-06
Description: Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/morethanwords/tweb/commit/f224e459c36eb96b2cf9dba559a48b1f08d23330; https://github.com/morethanwords/tweb/commit/f224e459c36eb96b2cf9dba559a48b1f08d23330
CVE: CVE-2021-40540
Published: 2021-09-07
Description: ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/164152/Ulfius-Web-Framework-Remote-Memory-Corruption.html; https://github.com/babelouest/ulfius/commit/c83f564c184a27145e07c274b305cabe943bbfaa; https://github.com/babelouest/ulfius/compare/v2.7.3...v2.7.4
CVE: CVE-2021-33483
Published: 2021-09-07
Description: An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://burninatorsec.blogspot.com/2021/07/onyaktech-comments-pro-broken.html; https://twitter.com/onyaktech; https://burninatorsec.blogspot.com/2021/07/onyaktech-comments-pro-broken.html
CVE: CVE-2021-33484
Published: 2021-09-07
Description: An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted encryption key (sent as a parameter in the comment form request) by setting this encrypted value as the username, which will appear on the comment page in its decrypted form. Using these two values (combined with the encryption functionality discovered in the decompiled installer), the attacker can encrypt another user's ID and username. These values can be used as part of the comment posting request in order to spoof the user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://burninatorsec.blogspot.com/2021/07/onyaktech-comments-pro-broken.html; https://twitter.com/onyaktech; https://burninatorsec.blogspot.com/2021/07/onyaktech-comments-pro-broken.html
CVE: CVE-2021-28135
Published: 2021-09-07
Description: The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://github.com/espressif/esp-idf; https://github.com/espressif/esp32-bt-lib
CVE: CVE-2021-28136
Published: 2021-09-07
Description: The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://github.com/espressif/esp-idf; https://github.com/espressif/esp32-bt-lib
CVE: CVE-2021-28155
Published: 2021-09-07
Description: The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown a device by flooding the target device with LMP Feature Response data.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://www.jbl.com.sg/over-ear-headphones/JBL+TUNE500BT.html; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE: CVE-2021-31613
Published: 2021-09-07
Description: The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP auto rate procedure, allowing attackers in radio range to immediately crash (and restart) a device via a crafted LMP packet.
CVSS Score: 6.5 (MEDIUM)
References: http://www.zh-jieli.com/product/68-cn.html; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://launchstudio.bluetooth.com/ListingDetails/19746
CVE: CVE-2021-33831
Published: 2021-09-07
Description: api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can interfere with tracing of infection chains by creating 500 random users within 2500 seconds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/lanmarc77/CVE-2021-33831; https://www.th-wildau.de/studieren-weiterbilden/neuigkeiten-und-veranstaltungen/corona/; https://github.com/lanmarc77/CVE-2021-33831
CVE: CVE-2021-34144
Published: 2021-09-07
Description: The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://github.com/Jieli-Tech/fw-AC63_BT_SDK; https://launchstudio.bluetooth.com/ListingDetails/91371
CVE: CVE-2021-34150
Published: 2021-09-07
Description: The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity.
CVSS Score: 6.5 (MEDIUM)
References: http://www.bluetrum.com/product/ab5301a.html; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; http://www.bluetrum.com/product/ab5301a.html
CVE: CVE-2021-38840
Published: 2021-09-07
Description: SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the water_refilling/classes/Login.php username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38840; https://www.exploit-db.com/exploits/50204; https://www.exploit-db.com/exploits/50205
CVE: CVE-2021-38841
Published: 2021-09-07
Description: Remote Code Execution can occur in Simple Water Refilling Station Management System 1.0 via the System Logo option on the system_info page in classes/SystemSettings.php with an update_settings action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/50205; https://www.sourcecodester.com/php/14906/simple-water-refilling-station-management-system-php-free-source-code.html; https://www.sourcecodester.com/users/tips23
CVE: CVE-2021-39278
Published: 2021-09-07
Description: Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164014; http://packetstormsecurity.com/files/164014
CVE: CVE-2021-39279
Published: 2021-09-07
Description: Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.moxa.com; https://packetstormsecurity.com/files/164014; https://www.moxa.com
CVE: CVE-2021-28139
Published: 2021-09-07
Description: The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.
CVSS Score: 8.8 (HIGH)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://github.com/espressif/esp-idf; https://github.com/espressif/esp32-bt-lib
CVE: CVE-2021-31609
Published: 2021-09-07
Description: The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range to trigger a crash in WT32i via a crafted LMP packet.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://www.silabs.com/wireless/bluetooth/bluegiga-classic-legacy-modules/device.wt32i-a; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE: CVE-2021-31610
Published: 2021-09-07
Description: The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (either restart or deadlock the device) by flooding a device with LMP_AU_rand data.
CVSS Score: 6.5 (MEDIUM)
References: http://www.bluetrum.com/product/ab5376t.html; http://www.bluetrum.com/product/bt8896a.html; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE: CVE-2021-31611
Published: 2021-09-07
Description: The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by a malformed LMP packet, allowing attackers in radio range to deadlock a device via a crafted LMP packet. The user needs to manually reboot the device to restore communication.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-667
References: http://www.zh-jieli.com/product/68-cn.html; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://launchstudio.bluetooth.com/ListingDetails/19746
CVE: CVE-2021-31612
Published: 2021-09-07
Description: The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greater than 17 bytes during the LMP auto rate procedure, allowing attackers in radio range to trigger a deadlock via a crafted LMP packet.
CVSS Score: 6.5 (MEDIUM)
References: http://www.zh-jieli.com/product/68-cn.html; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://launchstudio.bluetooth.com/ListingDetails/19746
CVE: CVE-2021-31785
Published: 2021-09-07
Description: The Bluetooth Classic implementation on Actions ATS2815 and ATS2819 chipsets does not properly handle the reception of multiple LMP_host_connection_req packets, allowing attackers in radio range to trigger a denial of service (deadlock) of the device via crafted LMP packets. Manual user intervention is required to restart the device and restore Bluetooth communication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-667
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://launchstudio.bluetooth.com/ListingDetails/76427; https://www.actions-semi.com/index.php?id=3581&siteId=4
CVE: CVE-2021-31786
Published: 2021-09-07
Description: The Bluetooth Classic Audio implementation on Actions ATS2815 and ATS2819 devices does not properly handle a connection attempt from a host with the same BDAddress as the current connected BT host, allowing attackers to trigger a disconnection and deadlock of the device by connecting with a forged BDAddress that matches the original connected host.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-667
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://launchstudio.bluetooth.com/ListingDetails/76427; https://www.actions-semi.com/index.php?id=3581&siteId=4
CVE: CVE-2021-34143
Published: 2021-09-07
Description: The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C_DEMO_V1.0 does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (deadlock) of the device by flooding it with LMP_AU_Rand packets after paging procedure. User intervention is required to restart the device.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://github.com/Jieli-Tech/fw-AC63_BT_SDK; https://launchstudio.bluetooth.com/ListingDetails/91371
CVE: CVE-2021-34145
Published: 2021-09-07
Description: The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with an invalid Baseband packet type (and LT_ADDRESS and LT_ADDR) after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.
CVSS Score: 5.3 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://www.cypress.com/documentation/datasheets/cyw20735b1-single-chip-bluetooth-transceiver-wireless-input-devices; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE: CVE-2021-34146
Published: 2021-09-07
Description: The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart (crash) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://www.cypress.com/documentation/datasheets/cyw20735b1-single-chip-bluetooth-transceiver-wireless-input-devices; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE: CVE-2021-34147
Published: 2021-09-07
Description: The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually trigger a crash via multiple attempts of sending a crafted LMP timing accuracy response followed by a sudden reconnection with a random BDAddress.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://www.cypress.com/documentation/datasheets/cyw20735b1-single-chip-bluetooth-transceiver-wireless-input-devices; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE: CVE-2021-34148
Published: 2021-09-07
Description: The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with a greater ACL Length after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://www.cypress.com/documentation/datasheets/cyw20735b1-single-chip-bluetooth-transceiver-wireless-input-devices; https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
CVE: CVE-2021-34149
Published: 2021-09-07
Description: The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand packets, allowing attackers in radio range to trigger a denial of service (deadlock) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.packetstormsecurity.net/papers/general/braktooth.pdf; https://www.ti.com/product/CC2564C; https://www.ti.com/tool/CC256XC-BT-SP#primary-sw
CVE: CVE-2021-36162
Published: 2021-09-07
Description: Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
CVSS Score: 8.8 (HIGH)
References: https://lists.apache.org/thread.html/rfa351115a459e214b99ffcc52c35f33359f3370c547d9c6ba1a60037%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/rfa351115a459e214b99ffcc52c35f33359f3370c547d9c6ba1a60037%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2021-36163
Published: 2021-09-07
Description: In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread.html/r8d0adc057bb15a37199502cc366f4b1164c9c536ce28e4defdb428c0%40%3Cdev.dubbo.apache.org%3E; https://lists.apache.org/thread.html/r8d0adc057bb15a37199502cc366f4b1164c9c536ce28e4defdb428c0%40%3Cdev.dubbo.apache.org%3E
CVE: CVE-2021-36696
Published: 2021-09-07
Description: Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user profile due to lack of input validation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.r29k.com/articles/bb/stored-xss-in-deskpro#anchor2; https://www.r29k.com/articles/bb/stored-xss-in-deskpro#anchor2
CVE: CVE-2020-7877
Published: 2021-09-07
Description: A buffer overflow issue was discovered in ZOOK solution(remote administration tool) through processing 'ConnectMe' command while parsing a crafted OUTERIP value because of missing boundary check. This vulnerability allows the attacker to execute remote arbitrary command.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36216; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36216
CVE: CVE-2021-36717
Published: 2021-09-07
Description: Synerion TimeNet version 9.21 contains a directory traversal vulnerability where, on the "Name" parameter, the attacker can return to the root directory and open the host file. This might give the attacker the ability to view restricted files, which could provide the attacker with more information required to further compromise the system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2021-37218
Published: 2021-09-07
Description: HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://discuss.hashicorp.com/t/hcsec-2021-21-nomad-raft-rpc-privilege-escalation/29023; https://www.hashicorp.com/blog/category/nomad; https://discuss.hashicorp.com/t/hcsec-2021-21-nomad-raft-rpc-privilege-escalation/29023
CVE: CVE-2021-37219
Published: 2021-09-07
Description: HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024; https://security.gentoo.org/glsa/202207-01; https://www.hashicorp.com/blog/category/consul
CVE: CVE-2021-38615
Published: 2021-09-07
Description: In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest, standard, or admin) to view and modify information.
CVSS Score: 6.3 (MEDIUM)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38615; https://eigentech.com/; https://excellium-services.com/cert-xlm-advisory/