deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-0292
Published: 2021-07-15
Description: An Uncontrolled Resource Consumption vulnerability in the ARP daemon (arpd) and Network Discovery Protocol (ndp) process of Juniper Networks Junos OS Evolved allows a malicious attacker on the local network to consume memory resources, ultimately resulting in a Denial of Service (DoS) condition. Link-layer functions such as IPv4 and/or IPv6 address resolution may be impacted, leading to traffic loss. The processes do not recover on their own and must be manually restarted. Changes in memory usage can be monitored using the following shell commands (header shown for clarity): user@router:/var/log# ps aux | grep arpd USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 31418 59.0 0.7 *5702564* 247952 ? xxx /usr/sbin/arpd --app-name arpd -I object_select --shared-objects-mode 3 user@router:/var/log# ps aux | grep arpd USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 31418 49.1 1.0 *5813156* 351184 ? xxx /usr/sbin/arpd --app-name arpd -I object_select --shared-objects-mode 3 Memory usage can be monitored for the ndp process in a similar fashion: user@router:/var/log# ps aux | grep ndp USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 14935 0.0 0.1 *5614052* 27256 ? Ssl Jun15 0:17 /usr/sbin/ndp -I no_tab_chk,object_select --app-name ndp --shared-obje user@router:/var/log# ps aux | grep ndp USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 14935 0.0 0.1 *5725164* 27256 ? Ssl Jun15 0:17 /usr/sbin/ndp -I no_tab_chk,object_select --app-name ndp --shared-obje This issue affects Juniper Networks Junos OS Evolved: 19.4 versions prior to 19.4R2-S3-EVO; 20.1 versions prior to 20.1R2-S4-EVO; all versions of 20.2-EVO. This issue does not affect Juniper Networks Junos OS Evolved versions prior to 19.4R2-EVO.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://kb.juniper.net/JSA11194; https://kb.juniper.net/JSA11194
CVE: CVE-2021-0293
Published: 2021-07-15
Description: A vulnerability in Juniper Networks Junos OS caused by Missing Release of Memory after Effective Lifetime leads to a memory leak each time the CLI command 'show system connections extensive' is executed. The amount of memory leaked on each execution depends on the number of TCP connections from and to the system. Repeated execution will cause more memory to leak and eventually daemons that need to allocate additionally memory and ultimately the kernel to crash, which will result in traffic loss. Continued execution of this command will cause a sustained Denial of Service (DoS) condition. An administrator can use the following CLI command to monitor for increase in memory consumption of the netstat process, if it exists: user@junos> show system processes extensive | match "username|netstat" PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 21181 root 100 0 5458M 4913M CPU3 2 0:59 97.27% netstat The following log message might be observed if this issue happens: kernel: %KERN-3: pid 21181 (netstat), uid 0, was killed: out of swap space This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R2-S8, 18.2R3-S7. 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S6, 18.4R3-S7; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S4; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S1; 19.4 versions prior to 19.4R1-S4, 19.4R2-S3, 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2-S1, 20.2R3; 20.3 versions prior to 20.3R1-S1, 20.3R2; This issue does not affect Juniper Networks Junos OS versions prior to 18.2R1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://kb.juniper.net/JSA11195; https://kb.juniper.net/JSA11195
CVE: CVE-2021-0294
Published: 2021-07-15
Description: A vulnerability in Juniper Networks Junos OS, which only affects the release 18.4R2-S5, where a function is inconsistently implemented on Juniper Networks Junos QFX5000 Series and EX4600 Series, and if "storm-control enhanced" is configured, can lead to the enhanced storm control filter group not be installed. It will cause storm control not to work hence allowing an attacker to cause high CPU usage or packet loss issues by sending a large amount of broadcast or unknown unicast packets arriving the device. This issue affects Juniper Networks QFX5100, QFX5110, QFX5120, QFX5200, QFX5210, EX4600, and EX4650, and QFX5100 with QFX 5e Series image installed. QFX5130 and QFX5220 are not affected from this issue. This issue affects Juniper Networks Junos OS 18.4R2-S5 on QFX5000 Series and EX4600 Series. No other product or platform is affected by this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-474
References: https://kb.juniper.net/JSA11196; https://kb.juniper.net/JSA11196
CVE: CVE-2021-0295
Published: 2021-07-15
Description: A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) of Juniper Networks Junos OS on the QFX10K Series switches allows an attacker to trigger a packet forwarding loop, leading to a partial Denial of Service (DoS). The issue is caused by DVMRP packets looping on a multi-homed Ethernet Segment Identifier (ESI) when VXLAN is configured. DVMRP packets received on a multi-homed ESI are sent to the peer, and then incorrectly forwarded out the same ESI, violating the split horizon rule. This issue only affects QFX10K Series switches, including the QFX10002, QFX10008, and QFX10016. Other products and platforms are unaffected by this vulnerability. This issue affects Juniper Networks Junos OS on QFX10K Series: 17.3 versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 version 18.2R1 and later versions; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S9, 18.4R3-S8; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R3; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-697, CWE-697
References: https://kb.juniper.net/JSA11208; https://kb.juniper.net/JSA11208
CVE: CVE-2021-36753
Published: 2021-07-15
Description: sharkdp BAT before 0.18.2 executes less.exe from the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/sharkdp/bat/commit/bf2b2df9c9e218e35e5a38ce3d03cffb7c363956; https://github.com/sharkdp/bat/pull/1724; https://github.com/sharkdp/bat/releases/tag/v0.18.2
CVE: CVE-2021-32764
Published: 2021-07-15
Description: Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is patched in `stable` version 2.7.6, `beta` version 2.8.0.beta3, and `tests-passed` version 2.8.0.beta3. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/discourse/discourse/security/advisories/GHSA-9x4c-29xg-56hw; https://github.com/discourse/discourse/security/advisories/GHSA-9x4c-29xg-56hw
CVE: CVE-2020-23705
Published: 2021-07-15
Description: A global buffer overflow vulnerability in jfif_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/rockcarry/ffjpeg/issues/25; https://github.com/rockcarry/ffjpeg/issues/25
CVE: CVE-2020-23706
Published: 2021-07-15
Description: A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_subsequent_scan() ok_jpg.c:1102 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/brackeen/ok-file-formats/issues/7; https://github.com/brackeen/ok-file-formats/issues/7
CVE: CVE-2020-23707
Published: 2021-07-15
Description: A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_progressive() at ok_jpg.c:1054 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/122.html; https://github.com/brackeen/ok-file-formats/issues/8; https://cwe.mitre.org/data/definitions/122.html
CVE: CVE-2021-36755
Published: 2021-07-16
Description: Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nightscout/cgm-remote-monitor/commit/68f3f90e30cc1da57f7e5069f9c4e[PII_REDACTED]f; https://github.com/nightscout/cgm-remote-monitor/commit/68f3f90e30cc1da57f7e5069f9c4e[PII_REDACTED]f
CVE: CVE-2021-36758
Published: 2021-07-16
Description: 1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-863
References: https://support.1password.com/kb/202106/; https://support.1password.com/kb/202106/
CVE: CVE-2021-21799
Published: 2021-07-16
Description: Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1270; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1270
CVE: CVE-2021-21800
Published: 2021-07-16
Description: Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1271; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1271
CVE: CVE-2021-21801
Published: 2021-07-16
Description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272
CVE: CVE-2021-21802
Published: 2021-07-16
Description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272
CVE: CVE-2021-21803
Published: 2021-07-16
Description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272
CVE: CVE-2021-21804
Published: 2021-07-16
Description: A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98, CWE-829
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1273; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1273
CVE: CVE-2021-21816
Published: 2021-07-16
Description: An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1281; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1281
CVE: CVE-2021-21817
Published: 2021-07-16
Description: An information disclosure vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disclosure of sensitive information. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1282; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1282
CVE: CVE-2021-21818
Published: 2021-07-16
Description: A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to a denial of service. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-259, CWE-798
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1283; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1283
CVE: CVE-2021-21819
Published: 2021-07-16
Description: A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1284; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1284
CVE: CVE-2021-21820
Published: 2021-07-16
Description: A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1285; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1285
CVE: CVE-2021-3647
Published: 2021-07-16
Description: URI.js is vulnerable to URL Redirection to Untrusted Site
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481; https://huntr.dev/bounties/[PII_REDACTED]40-medialize/URI.js; https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481
CVE: CVE-2021-1422
Published: 2021-07-16
Description: A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the device that results in a denial of service (DoS) condition. The vulnerability is due to a logic error in how the software cryptography module handles specific types of decryption errors. An attacker could exploit this vulnerability by sending malicious packets over an established IPsec connection. A successful exploit could cause the device to crash, forcing it to reload. Important: Successful exploitation of this vulnerability would not cause a compromise of any encrypted data. Note: This vulnerability affects only Cisco ASA Software Release 9.16.1 and Cisco FTD Software Release 7.0.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-617, CWE-617
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-ipsec-dos-TFKQbgWC; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-ipsec-dos-TFKQbgWC
CVE: CVE-2021-28114
Published: 2021-07-16
Description: Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://froala.com/wysiwyg-editor/; https://labs.bishopfox.com/advisories; https://labs.bishopfox.com/advisories/froala-editor-v3.2.6
CVE: CVE-2021-3649
Published: 2021-07-16
Description: chatwoot is vulnerable to Inefficient Regular Expression Complexity
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/chatwoot/chatwoot/commit/aa7db90cd2d23dbcf22a94f1e4c100dd909e2172; https://huntr.dev/bounties/[PII_REDACTED]07-chatwoot/chatwoot; https://github.com/chatwoot/chatwoot/commit/aa7db90cd2d23dbcf22a94f1e4c100dd909e2172
CVE: CVE-2021-28054
Published: 2021-07-16
Description: An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration > Hosts" allows remote authenticated users to inject arbitrary web script or HTML via the Alias parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.centreon.com/current/en/; https://github.com/centreon/centreon/releases/tag/20.04.13; https://redshell.co
CVE: CVE-2021-28053
Published: 2021-07-16
Description: An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration > Users > Contacts / Users" allows remote authenticated users to execute arbitrary SQL commands via the Additional Information parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://docs.centreon.com/current/en/; https://github.com/centreon/centreon/releases/tag/20.04.13; https://redshell.co
CVE: CVE-2021-35961
Published: 2021-07-16
Description: Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.chtsecurity.com/news/2e4e69d5-2e32-4f73-ac7e-a66432e020e4; https://www.twcert.org.tw/tw/cp-132-4905-c99ac-1.html; https://www.chtsecurity.com/news/2e4e69d5-2e32-4f73-ac7e-a66432e020e4
CVE: CVE-2021-35962
Published: 2021-07-16
Description: Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can apply Path Traversal means to download credential files from the system without permission.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.chtsecurity.com/news/d7ec2db9-12dd-439f-b014-b956ce231054; https://www.twcert.org.tw/tw/cp-132-4906-89381-1.html; https://www.chtsecurity.com/news/d7ec2db9-12dd-439f-b014-b956ce231054
CVE: CVE-2020-4675
Published: 2021-07-16
Description: IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186324.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186324; https://www.ibm.com/support/pages/node/6472927; https://exchange.xforce.ibmcloud.com/vulnerabilities/186324
CVE: CVE-2020-4821
Published: 2021-07-16
Description: IBM InfoSphere Data Replication 11.4 and IBM InfoSphere Change Data Capture for z/OS 10.2.1, under certain configurations, could allow a user to bypass authentication mechanisms using an empty password string. IBM X-Force ID: 189834
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189834; https://www.ibm.com/support/pages/node/6472909; https://www.ibm.com/support/pages/node/6472911
CVE: CVE-2020-4980
Published: 2021-07-16
Description: IBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts when encrypt host connections is not enabled as well as data at rest. IBM X-Force ID: 192539.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192539; https://www.ibm.com/support/pages/node/6472891; https://exchange.xforce.ibmcloud.com/vulnerabilities/192539
CVE: CVE-2021-32749
Published: 2021-07-16
Description: fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois. Command `mail` from mailutils package used in mail actions like `mail-whois` can execute command if unescaped sequences (`\n~`) are available in "foreign" input (for instance in whois output). To exploit the vulnerability, an attacker would need to insert malicious characters into the response sent by the whois server, either via a MITM attack or by taking over a whois server. The issue is patched in versions 0.10.7 and 0.11.3. As a workaround, one may avoid the usage of action `mail-whois` or patch the vulnerability manually.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-78, CWE-94
References: https://github.com/fail2ban/fail2ban/commit/2ed414ed09b3bb4c478abc9366a1ff22024a33c9; https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f2529b5eee844; https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm
CVE: CVE-2021-32769
Published: 2021-07-16
Description: Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d16d4a3b91b34b7456bb11; https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjx7-399x-p2rj; https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d16d4a3b91b34b7456bb11
CVE: CVE-2021-34438
Published: 2021-07-16
Description: Windows Font Driver Host Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34438; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34438
CVE: CVE-2021-34439
Published: 2021-07-16
Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34439; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34439
CVE: CVE-2021-34440
Published: 2021-07-16
Description: GDI+ Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34440; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34440