deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39649
Published: 2021-12-15
Description: In regmap_exit of regmap.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174049006References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39650
Published: 2021-12-15
Description: In (TBD) of (TBD), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-169763055References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39651
Published: 2021-12-15
Description: In TBD of TBD, there is a possible way to access PIN protected settings bypassing PIN confirmation due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-193438173References: N/A
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39652
Published: 2021-12-15
Description: In sec_ts_parsing_cmds of (TBD), there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194499021References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39653
Published: 2021-12-15
Description: In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. This could lead to local escalation of privilege after preparing the device, hiding the warning, and passing the phone to a new user, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-193443223References: N/A
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2022-06-01; https://source.android.com/security/bulletin/pixel/2022-06-01
CVE: CVE-2021-39655
Published: 2021-12-15
Description: Product: AndroidVersions: Android kernelAndroid ID: A-192641593References: N/A
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39656
Published: 2021-12-15
Description: In __configfs_open_file of file.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174049066References: Upstream kernel
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-667
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-39657
Published: 2021-12-15
Description: In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194696049References: Upstream kernel
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-12-01; https://source.android.com/security/bulletin/pixel/2021-12-01
CVE: CVE-2021-43935
Published: 2021-12-15
Description: The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-288, CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsma-21-343-01; https://www.cisa.gov/uscert/ics/advisories/icsma-21-343-01
CVE: CVE-2021-27855
Published: 2021-12-15
Description: FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves administrative privileges. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA001.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.fatpipeinc.com/support/cve-list.php; https://www.zeroscience.mk/codes/fatpipe_privesc.txt; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5685.php
CVE: CVE-2021-27856
Published: 2021-12-15
Description: FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.
CVSS Score: 9.8 (CRITICAL)
References: https://www.fatpipeinc.com/support/cve-list.php; https://www.zeroscience.mk/codes/fatpipe_backdoor.txt; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5684.php
CVE: CVE-2021-27857
Published: 2021-12-15
Description: A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, unauthenticated attacker to download a configuration archive. The attacker needs to know or correctly guess the hostname of the target system since the hostname is used as part of the configuration archive file name. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA003.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.fatpipeinc.com/support/cve-list.php; https://www.zeroscience.mk/codes/fatpipe_configdl.txt; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5683.php
CVE: CVE-2021-27858
Published: 2021-12-15
Description: A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote attacker to access at least the URL "/fpui/jsp/index.jsp" leading to unknown impact, presumably some violation of confidentiality. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA004.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.fatpipeinc.com/support/cve-list.php; https://www.zeroscience.mk/codes/fatpipe_auth.txt; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.php
CVE: CVE-2021-27859
Published: 2021-12-15
Description: A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows an authenticated, remote attacker with read-only privileges to create an account with administrative privileges. Older versions of FatPipe software may also be vulnerable. This does not appear to be a CSRF vulnerability. The FatPipe advisory identifier for this vulnerability is FPSA005.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.fatpipeinc.com/support/cve-list.php; https://www.zeroscience.mk/codes/fatpipe_csrf.txt; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5681.php
CVE: CVE-2021-29847
Published: 2021-12-15
Description: BMC firmware (IBM Power System S821LC Server (8001-12C) OP825.50) configuration changed to allow an authenticated user to open an insecure communication channel which could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 205267.
CVSS Score: 5.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/205267; https://www.ibm.com/support/pages/node/6520420; https://exchange.xforce.ibmcloud.com/vulnerabilities/205267
CVE: CVE-2021-35490
Published: 2021-12-15
Description: Thruk before 2.44 allows XSS for a quick command.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.gruppotim.it/redteam; https://www.thruk.org/changelog.html; https://www.gruppotim.it/redteam
CVE: CVE-2021-41276
Published: 2021-12-15
Description: Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. This issue has been patched in Tuleap Community Edition 13.2.99.31, Tuleap Enterprise Edition 13.1-5, and Tuleap Enterprise Edition 13.2-3.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-74, CWE-90, CWE-74
References: https://github.com/Enalean/tuleap/commit/bd47f29847fcd6a68d359bc8aefb8749bb8a1b7c; https://github.com/Enalean/tuleap/security/advisories/GHSA-887w-pv2r-x8pm; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=bd47f29847fcd6a68d359bc8aefb8749bb8a1b7c
CVE: CVE-2021-43782
Published: 2021-12-15
Description: Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-pv2r-x8pm/CVE-2021-41276, the initial fix was incomplete. Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. The following versions contain the fix: Tuleap Community Edition 13.2.99.83, Tuleap Enterprise Edition 13.1-6, and Tuleap Enterprise Edition 13.2-4.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-74, CWE-90, CWE-74
References: https://github.com/Enalean/tuleap/commit/64e77561eba9f8233199c2962b3497ed7294a7d2; https://github.com/Enalean/tuleap/security/advisories/GHSA-887w-pv2r-x8pm; https://github.com/Enalean/tuleap/security/advisories/GHSA-cwv9-hhm4-jr84
CVE: CVE-2021-43806
Published: 2021-12-15
Description: Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Enalean/tuleap/commit/b82be896b00a787ed46a77bd4700e8fccfe2e5ba; https://github.com/Enalean/tuleap/security/advisories/GHSA-x8fr-8gvw-cc4v; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b82be896b00a787ed46a77bd4700e8fccfe2e5ba
CVE: CVE-2021-43831
Published: 2021-12-15
Description: Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access any files on the host computer if they know the file names or file paths. This is limited only by the host operating system. Paths are opened in read only mode. The problem has been patched in gradio 2.5.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/gradio-app/gradio/commit/41bd3645bdb616e1248b2167ca83636a2653f781; https://github.com/gradio-app/gradio/security/advisories/GHSA-rhq2-3vr9-6mcr; https://github.com/gradio-app/gradio/commit/41bd3645bdb616e1248b2167ca83636a2653f781
CVE: CVE-2021-43835
Published: 2021-12-15
Description: Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction. The versions have been patched in 2.2.18, 2.3.8 and 2.4.0. For users unable to upgrade the only known workaround is to apply a patch to the ProfileController manually.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://github.com/sulu/sulu/commit/30bf8b5a4f83b6f2171a696011757d095edaa28a; https://github.com/sulu/sulu/security/advisories/GHSA-84px-q68r-2fc9; https://github.com/sulu/sulu/commit/30bf8b5a4f83b6f2171a696011757d095edaa28a
CVE: CVE-2021-43836
Published: 2021-12-15
Description: Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://github.com/sulu/sulu/commit/9c948f9ce350c68b53af8c3910e2cefc7f722b54; https://github.com/sulu/sulu/security/advisories/GHSA-vx6j-pjrh-vgjh; https://github.com/sulu/sulu/commit/9c948f9ce350c68b53af8c3910e2cefc7f722b54
CVE: CVE-2021-45078
Published: 2021-12-15
Description: stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQBH244M5PV6S6UMHUTCVCWFZDX7Y4M6/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUHLDDT3HH7YEY6TX7IJRGPJUTNNVEL3/; https://security.gentoo.org/glsa/202208-30
CVE: CVE-2021-4119
Published: 2021-12-15
Description: bookstack is vulnerable to Improper Access Control
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/bookstackapp/bookstack/commit/e765e618547c92f4e0b46caca6fb91f0174efd99; https://huntr.dev/bounties/135f2d7d-ab0b-4351-99b9-889efac46fca; https://github.com/bookstackapp/bookstack/commit/e765e618547c92f4e0b46caca6fb91f0174efd99
CVE: CVE-2021-44116
Published: 2021-12-15
Description: Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cnblogs.com/unrealnumb/p/15573449.html; https://www.cnblogs.com/unrealnumb/p/15573449.html
CVE: CVE-2020-18984
Published: 2021-12-15
Description: A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/buxu/bug/issues/2; https://github.com/buxu/bug/issues/2
CVE: CVE-2020-18985
Published: 2021-12-15
Description: An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/buxu/bug/issues/3; https://github.com/buxu/bug/issues/3
CVE: CVE-2021-44350
Published: 2021-12-15
Description: SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/top-think/framework/issues/2613; https://github.com/top-think/framework/issues/2613
CVE: CVE-2021-45017
Published: 2021-12-15
Description: Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/xwlrbh/Catfish/issues/8; https://github.com/xwlrbh/Catfish/issues/8
CVE: CVE-2021-45018
Published: 2021-12-15
Description: Cross Site Scripting (XSS) vulnerability exists in Catfish <=6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.htmland then the .html file on the website that uses this editor (the file suffix is allowed).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xwlrbh/Catfish/issues/9; https://github.com/xwlrbh/Catfish/issues/9
CVE: CVE-2021-43833
Published: 2021-12-16
Description: eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows any authenticated user to gain access to arbitrary accounts by setting a specially crafted email address. This vulnerability impacts all instances that have not set an explicit email domain name allowlist. Note that whereas neither administrators nor targeted users are notified of a change, an attacker will need to control an account. The default settings require administrators to validate newly created accounts. The problem has been patched. Users should upgrade to at least version 4.2.0. For users unable to upgrade enabling an email domain allow list (from Sysconfig panel, Security tab) will completely resolve the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://github.com/elabftw/elabftw/releases/tag/4.2.0; https://github.com/elabftw/elabftw/security/advisories/GHSA-v659-q2fh-v99w; https://github.com/elabftw/elabftw/releases/tag/4.2.0
CVE: CVE-2021-43834
Published: 2021-12-16
Description: eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attacker to authenticate as an existing user, if that user was created using a single sign-on authentication option such as LDAP or SAML. It impacts instances where LDAP or SAML is used for authentication instead of the (default) local password mechanism. Users should upgrade to at least version 4.2.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/elabftw/elabftw/releases/tag/4.2.0; https://github.com/elabftw/elabftw/security/advisories/GHSA-98rp-gx76-33ph; https://github.com/elabftw/elabftw/releases/tag/4.2.0
CVE: CVE-2021-44023
Published: 2021-12-16
Description: A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://helpcenter.trendmicro.com/en-us/article/tmka-10867; https://www.zerodayinitiative.com/advisories/ZDI-21-1536/; https://helpcenter.trendmicro.com/en-us/article/tmka-10867
CVE: CVE-2021-45085
Published: 2021-12-16
Description: XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612; https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045; https://lists.debian.org/debian-lts-announce/2022/08/msg00006.html
CVE: CVE-2021-45086
Published: 2021-12-16
Description: XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612; https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045; https://www.debian.org/security/2022/dsa-5042
CVE: CVE-2021-45087
Published: 2021-12-16
Description: XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612; https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045; https://lists.debian.org/debian-lts-announce/2022/08/msg00006.html
CVE: CVE-2021-45088
Published: 2021-12-16
Description: XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612; https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045; https://lists.debian.org/debian-lts-announce/2022/08/msg00006.html
CVE: CVE-2021-45092
Published: 2021-12-16
Description: Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/166068/Thinfinity-VirtualUI-2.5.41.0-IFRAME-Injection.html; https://github.com/cybelesoft/virtualui/issues/2; http://packetstormsecurity.com/files/166068/Thinfinity-VirtualUI-2.5.41.0-IFRAME-Injection.html
CVE: CVE-2021-45095
Published: 2021-12-16
Description: pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f[PII_REDACTED]4817a4f9fa55ec57fb38acbb0; https://github.com/torvalds/linux/commit/bcd0f[PII_REDACTED]4817a4f9fa55ec57fb38acbb0; https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html
CVE: CVE-2021-45096
Published: 2021-12-16
Description: KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-611
References: https://github.com/dawid-czarnecki/public-vulnerabilities; https://www.knime.com/changelog-v45; https://www.knime.com/whats-new-in-knime-45