deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-23848
Published: 2021-06-09
Description: An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE: CVE-2021-23852
Published: 2021-06-09
Description: An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE: CVE-2021-23853
Published: 2021-06-09
Description: In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20, CWE-20
References: https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE: CVE-2021-23854
Published: 2021-06-09
Description: An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE: CVE-2021-29995
Published: 2021-06-09
Description: A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (including script execution). The issue is resolved in CloverDX 5.10, CloverDX 5.9.1, CloverDX 5.8.2, and CloverDX 5.7.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.html; https://support.cloverdx.com/releases/; https://support1.cloverdx.com/hc/en-us/articles/[PII_REDACTED]20
CVE: CVE-2021-30133
Published: 2021-06-09
Description: A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.cloverdx.com/releases/; https://support1.cloverdx.com/hc/en-us/articles/[PII_REDACTED]20; https://support.cloverdx.com/releases/
CVE: CVE-2021-3196
Published: 2021-06-09
Description: An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0. When using federated identity management (authenticating via SAML through a third-party identity provider), an attacker can inject additional data into a signed SAML response being transmitted to the service provider (ID Bravura Security Fabric). The application successfully validates the signed values but uses the unsigned malicious values. An attacker with lower-privilege access to the application can inject the username of a high-privilege user to impersonate that user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347
References: https://www.hitachi-id.com/cve-2021-3196-attackers-can-impersonate-another-user; https://www.hitachi.com/hirt/hitachi-sec/2021/601.html; https://www.hitachi.com/hirt/security/index.html
CVE: CVE-2020-15377
Published: 2021-06-09
Description: Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery (SSRF).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1480; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1480
CVE: CVE-2020-15378
Published: 2021-06-09
Description: The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potential attack surface.
CVSS Score: 5.3 (MEDIUM)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1481; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1481
CVE: CVE-2020-15379
Published: 2021-06-09
Description: Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-supplied data as name for custom field name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1319; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1319
CVE: CVE-2020-15380
Published: 2021-06-09
Description: Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1482; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1482
CVE: CVE-2020-15384
Published: 2021-06-09
Description: Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1485; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1485
CVE: CVE-2020-15385
Published: 2021-06-09
Description: Brocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and list files without permission. As a result, users without permission can see folders, and hidden files, and can create directories without permission.
CVSS Score: 5.4 (MEDIUM)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1486; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1486
CVE: CVE-2020-15386
Published: 2021-06-09
Description: Brocade Fabric OS prior to v9.0.1a and 8.2.3a and after v9.0.0 and 8.2.2d may observe high CPU load during security scanning, which could lead to a slower response to CLI commands and other operations.
CVSS Score: 5.3 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1495; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-15387
Published: 2021-06-09
Description: The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than 2048 bits, which may be vulnerable to man-in-the-middle attacks and/or insecure SSH communications.
CVSS Score: 7.4 (HIGH)
CWE: CWE-326
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1291; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1291
CVE: CVE-2021-32942
Published: 2021-06-09
Description: The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-316, CWE-312
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03; https://www.aveva.com/en/support/cyber-security-updates/; https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03
CVE: CVE-2021-32677
Published: 2021-06-09
Description: FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d; https://github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MATAWX25TYKNEKLDMKWNLYDB34UWTROA/
CVE: CVE-2021-33356
Published: 2021-06-09
Description: Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary commands to /installers/common.sh component that can result in remote command execution with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf; https://github.com/RaspAP/raspap-webgui/blob/5a7b77459839c9420fac0d10ec28cee1af9bb782/installers/common.sh#L216; https://github.com/RaspAP/raspap-webgui/blob/5a7b77459839c9420fac0d10ec28cee1af9bb782/installers/common.sh#L231
CVE: CVE-2021-33357
Published: 2021-06-09
Description: A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf; https://github.com/RaspAP/raspap-webgui/blob/master/ajax/networking/get_netcfg.php; https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf
CVE: CVE-2021-33358
Published: 2021-06-09
Description: Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpa_passphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$()" which enables an authenticated attacker to execute arbitrary OS commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf; https://github.com/RaspAP/raspap-webgui/blob/8f0ae3b36aa1020d21477e66010c6b2146e7c222/app/img/wifi-qr-code.php; https://github.com/RaspAP/raspap-webgui/blob/b02660d5ff8d9faa5d3ef49778b23e832851e0f4/includes/hostapd.php
CVE: CVE-2021-33359
Published: 2021-06-09
Description: A vulnerability exists in gowitness < 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://github.com/sensepost/gowitness/releases/tag/2.3.6; https://twitter.com/leonjza/status/[PII_REDACTED]33971202?s=19; https://github.com/sensepost/gowitness/releases/tag/2.3.6
CVE: CVE-2021-33833
Published: 2021-06-09
Description: ConnMan (aka Connection Manager) 1.30 through 1.39 has a stack-based buffer overflow in uncompress in dnsproxy.c via NAME, RDATA, or RDLENGTH (for A or AAAA).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2021/06/09/1; http://www.openwall.com/lists/oss-security/2022/01/25/1; https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html
CVE: CVE-2020-12288
Published: 2021-06-09
Description: Protection mechanism failure in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
CVE: CVE-2020-12289
Published: 2021-06-09
Description: Out-of-bounds write in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
CVE: CVE-2020-12290
Published: 2021-06-09
Description: Improper access control in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
CVE: CVE-2020-12291
Published: 2021-06-09
Description: Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
CVE: CVE-2020-12292
Published: 2021-06-09
Description: Improper conditions check in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
CVE: CVE-2020-12293
Published: 2021-06-09
Description: Improper control of a resource through its lifetime in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
CVE: CVE-2020-12294
Published: 2021-06-09
Description: Insufficient control flow management in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
CVE: CVE-2020-12295
Published: 2021-06-09
Description: Improper input validation in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
CVE: CVE-2020-12296
Published: 2021-06-09
Description: Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html
CVE: CVE-2020-12357
Published: 2021-06-09
Description: Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-665
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html
CVE: CVE-2020-12358
Published: 2021-06-09
Description: Out of bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html
CVE: CVE-2020-12359
Published: 2021-06-09
Description: Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 6.8 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-12360
Published: 2021-06-09
Description: Out of bounds read in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html
CVE: CVE-2020-24486
Published: 2021-06-09
Description: Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html
CVE: CVE-2020-24506
Published: 2021-06-09
Description: Out of bound read in a subsystem in the Intel(R) CSME versions before 12.0.81, 13.0.47, 13.30.17, 14.1.53 and 14.5.32 may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html
CVE: CVE-2020-24507
Published: 2021-06-09
Description: Improper initialization in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11 and 15.0.22 may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-665
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html
CVE: CVE-2020-24509
Published: 2021-06-09
Description: Insufficient control flow management in subsystem in Intel(R) SPS versions before SPS_E3_05.01.04.300.0, SPS_SoC-A_05.00.03.091.0, SPS_E5_04.04.04.023.0, or SPS_E5_04.04.03.263.0 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-24511
Published: 2021-06-09
Description: Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-24512
Published: 2021-06-09
Description: Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-24513
Published: 2021-06-09
Description: Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 6.5 (MEDIUM)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf; https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html; https://www.debian.org/security/2021/dsa-4934
CVE: CVE-2020-24514
Published: 2021-06-09
Description: Improper authentication in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00460.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00460.html
CVE: CVE-2020-24515
Published: 2021-06-09
Description: Protection mechanism failure in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 6.8 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00460.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00460.html
CVE: CVE-2020-24516
Published: 2021-06-09
Description: Modification of assumed-immutable data in subsystem in Intel(R) CSME versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 6.8 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/