deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27060
Published: 2021-03-11
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27060; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27060
CVE: CVE-2021-27061
Published: 2021-03-11
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27061; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27061
CVE: CVE-2021-27062
Published: 2021-03-11
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27062; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27062
CVE: CVE-2021-27063
Published: 2021-03-11
Description: Windows DNS Server Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27063; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27063
CVE: CVE-2021-27066
Published: 2021-03-11
Description: Windows Admin Center Security Feature Bypass Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27066; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27066
CVE: CVE-2021-27070
Published: 2021-03-11
Description: Windows 10 Update Assistant Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27070; https://www.zerodayinitiative.com/advisories/ZDI-21-329/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27070
CVE: CVE-2021-27074
Published: 2021-03-11
Description: Azure Sphere Unsigned Code Execution Vulnerability
CVSS Score: 6.2 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27074; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1247; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1249
CVE: CVE-2021-27075
Published: 2021-03-11
Description: Azure Virtual Machine Information Disclosure Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27075; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27075
CVE: CVE-2021-27076
Published: 2021-03-11
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27076; https://www.zerodayinitiative.com/advisories/ZDI-21-276/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27076
CVE: CVE-2021-27077
Published: 2021-03-11
Description: Windows Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27077; https://www.zerodayinitiative.com/advisories/ZDI-21-287/; https://www.zerodayinitiative.com/advisories/ZDI-21-403/
CVE: CVE-2021-27080
Published: 2021-03-11
Description: Azure Sphere Unsigned Code Execution Vulnerability
CVSS Score: 9.3 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27080; https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1250; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27080
CVE: CVE-2021-27081
Published: 2021-03-11
Description: Visual Studio Code ESLint Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27081; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27081
CVE: CVE-2021-27082
Published: 2021-03-11
Description: Quantum Development Kit for Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27082; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27082
CVE: CVE-2021-27083
Published: 2021-03-11
Description: Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27083; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27083
CVE: CVE-2021-27084
Published: 2021-03-11
Description: Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27084; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27084
CVE: CVE-2021-27085
Published: 2021-03-11
Description: Internet Explorer Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27085; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27085; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27085
CVE: CVE-2021-21381
Published: 2021-03-11
Description: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and @@U usage in desktop files`". The follow-up commits "`dir: Reserve the whole @@ prefix`" and "`dir: Refuse to export .desktop files with suspicious uses of @@ tokens`" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported `.desktop` files in `exports/share/applications/*.desktop` (typically `~/.local/share/flatpak/exports/share/applications/*.desktop` and `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow `@@` or `@@u`.
CVSS Score: 7.1 (HIGH)
CWE: CWE-74
References: https://github.com/flatpak/flatpak/commit/8279c5818425b6812523e3805bbe242fb6a5d961; https://github.com/flatpak/flatpak/commit/a7401e638bf0c03102039e216ab1081922f140ae; https://github.com/flatpak/flatpak/commit/eb7946bb6248923d8c90fe9b84425fef97ae580d
CVE: CVE-2021-26776
Published: 2021-03-11
Description: CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/cskaza/cszcms/issues/29; https://github.com/cskaza/cszcms/issues/29
CVE: CVE-2021-27677
Published: 2021-03-11
Description: Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sruupl/batflat/issues/105; https://github.com/sruupl/batflat/issues/105
CVE: CVE-2021-27678
Published: 2021-03-11
Description: Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sruupl/batflat/issues/105; https://github.com/sruupl/batflat/issues/105
CVE: CVE-2021-27679
Published: 2021-03-11
Description: Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sruupl/batflat/issues/105; https://github.com/sruupl/batflat/issues/105
CVE: CVE-2021-28088
Published: 2021-03-11
Description: Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the "Display Name" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://anotepad.com/note/read/s3kkk6h7; https://hackerone.com/reports/1119296; https://anotepad.com/note/read/s3kkk6h7
CVE: CVE-2021-28141
Published: 2021-03-11
Description: An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This may allow the attacker to gain unauthorized access to the server and execute code. To exploit, one must use the parameter _TSM_HiddenField_ and inject a command at the end of the URI. NOTE: the vendor states that this is not a vulnerability. The request's output does not indicate that a "true" command was executed on the server, and the request's output does not leak any private source code or data from the server
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://gist.github.com/shreyasfegade/e2480e26b2ed1d0c7175ecf7cb15f9c1; https://pastebin.com/JULpfvFJ; https://gist.github.com/shreyasfegade/e2480e26b2ed1d0c7175ecf7cb15f9c1
CVE: CVE-2021-28144
Published: 2021-03-11
Description: prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/161757/D-Link-DIR-3060-1.11b04-Command-Injection.html; http://seclists.org/fulldisclosure/2021/Mar/23; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10208
CVE: CVE-2020-14987
Published: 2021-03-11
Description: An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows remote attackers to execute arbitrary code because there is a mishandling of the capability for administrators to write and run Groovy scripts within the updater editor. An attacker must use an AST transforming annotation such as @Grab.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74, CWE-862
References: https://tvrbk.github.io/cve/2021/03/09/brXM.html; https://tvrbk.github.io/cve/2021/03/09/brXM.html
CVE: CVE-2020-14988
Published: 2021-03-11
Description: An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the upload image functionality via an SVG document containing JavaScript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://tvrbk.github.io/cve/2021/03/09/brXM.html; https://tvrbk.github.io/cve/2021/03/09/brXM.html
CVE: CVE-2020-14989
Published: 2021-03-11
Description: An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows CSRF if the attacker uses GET where POST was intended.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://tvrbk.github.io/cve/2021/03/09/brXM.html; https://tvrbk.github.io/cve/2021/03/09/brXM.html
CVE: CVE-2020-29045
Published: 2021-03-11
Description: The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm_cart cookie in load_cart_from_cookie in includes/class-cart-manager.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://appcheck-ng.com/cve-2020-29045/; https://wordpress.org/plugins/food-and-drink-menu/#developers; https://appcheck-ng.com/cve-2020-29045/
CVE: CVE-2020-36277
Published: 2021-03-11
Description: Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-670
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21997; https://github.com/DanBloomberg/leptonica/compare/1.79.0...1.80.0; https://github.com/DanBloomberg/leptonica/pull/499
CVE: CVE-2021-20261
Published: 2021-03-11
Description: A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=1932150; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a0c80efe5956ccce9fe7ae5c78542578c07bc20a; https://bugzilla.redhat.com/show_bug.cgi?id=1932150
CVE: CVE-2021-22709
Published: 2021-03-11
Description: A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior, which could result in loss of data or remote code execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01; https://www.se.com/ww/en/download/document/SEVD-2021-068-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01
CVE: CVE-2021-22710
Published: 2021-03-11
Description: A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior, which could cause remote code execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01; https://www.se.com/ww/en/download/document/SEVD-2021-068-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01
CVE: CVE-2021-22711
Published: 2021-03-11
Description: A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior, which could result in arbitrary read or write conditions when malicious CGF (Configuration Group File) file is imported to IGSS Definition due to missing validation of input data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01; https://www.se.com/ww/en/download/document/SEVD-2021-068-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01
CVE: CVE-2021-22712
Published: 2021-03-11
Description: A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior, which could result in arbitrary read or write conditions when malicious CGF (Configuration Group File) file is imported to IGSS Definition due to an unchecked pointer address.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01; https://www.se.com/ww/en/download/document/SEVD-2021-068-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01
CVE: CVE-2021-22713
Published: 2021-03-11
Description: A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION8650, ION8800, ION7650, ION7700/73xx, and ION83xx/84xx/85xx/8600 (see security notifcation for affected versions), which could cause the meter to reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.se.com/ww/en/download/document/SEVD-2021-068-03; https://www.se.com/ww/en/download/document/SEVD-2021-068-03
CVE: CVE-2021-22714
Published: 2021-03-11
Description: A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION7400, PM8000 and ION9000 (All versions prior to V3.0.0), which could cause the meter to reboot or allow for remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.se.com/ww/en/download/document/SEVD-2021-068-02; https://www.se.com/ww/en/download/document/SEVD-2021-068-02
CVE: CVE-2016-20009
Published: 2021-03-11
Description: A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://blog.exodusintel.com/2016/08/09/vxworks-execute-my-packets/; https://cert-portal.siemens.com/productcert/pdf/ssa-553445.pdf; https://blog.exodusintel.com/2016/08/09/vxworks-execute-my-packets/
CVE: CVE-2020-24983
Published: 2021-03-11
Description: An issue was discovered in Quadbase EspressReports ES 7 Update 9. An unauthenticated attacker can create a malicious HTML file that houses a POST request made to the DashboardBuilder within the target web application. This request will utilise the target admin session and perform the authenticated request (to change the Dashboard name) as if the victim had done so themselves, aka CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://c41nc.co.uk/cve-2020-24983/; https://c41nc.co.uk/cve-2020-24983/
CVE: CVE-2020-24984
Published: 2021-03-11
Description: An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://c41nc.co.uk/cve-2020-24984/; https://c41nc.co.uk/cve-2020-24984/
CVE: CVE-2021-28143
Published: 2021-03-11
Description: /jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools).
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/vitorespf/Advisories/blob/master/DLINK-DIR-841-command-injection.txt; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10207; https://github.com/vitorespf/Advisories/blob/master/DLINK-DIR-841-command-injection.txt
CVE: CVE-2021-28153
Published: 2021-03-11
Description: An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-59
References: https://gitlab.gnome.org/GNOME/glib/-/issues/2325; https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RXTD5HCP2K4AAUSWWZTBKQNHRCTAEOF/
CVE: CVE-2021-28154
Published: 2021-03-11
Description: Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which manipulates the readFile and writeFile APIs. NOTE: the vendor states "The way we secured the app is that it does not allow any remote scripts to be opened, no unsafe scripts to be evaluated, no remote sites to be browsed.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://github.com/camunda/camunda-modeler/issues/2143; https://github.com/camunda/camunda-modeler/issues/2143
CVE: CVE-2020-36278
Published: 2021-03-12
Description: Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23433; https://github.com/DanBloomberg/leptonica/commit/8d6e1755518cfb98536d6c3daf0601f226d16842; https://github.com/DanBloomberg/leptonica/compare/1.79.0...1.80.0
CVE: CVE-2020-36279
Published: 2021-03-12
Description: Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap_reg.c and adaptmap.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22512; https://github.com/DanBloomberg/leptonica/commit/3c18c43b6a3f753f0dfff99610d46ad46b8bfac4; https://github.com/DanBloomberg/leptonica/compare/1.79.0...1.80.0
CVE: CVE-2020-36280
Published: 2021-03-12
Description: Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream, related to tiffio.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23654; https://github.com/DanBloomberg/leptonica/commit/5ba34b1fe741d69d43a6c8cf767756997eadd87c; https://github.com/DanBloomberg/leptonica/compare/1.79.0...1.80.0
CVE: CVE-2020-36281
Published: 2021-03-12
Description: Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22140; https://github.com/DanBloomberg/leptonica/commit/5ee24b398bb67666f6d173763eaaedd9c36fb1e5; https://github.com/DanBloomberg/leptonica/compare/1.79.0...1.80.0
CVE: CVE-2020-36282
Published: 2021-03-12
Description: JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/rabbitmq/rabbitmq-jms-client/issues/135; https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2; https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0
CVE: CVE-2021-20674
Published: 2021-03-12
Description: Untrusted search path vulnerability in Installer of MagicConnect Client program distributed before 2021 March 1 allows an attacker to gain privileges and via a Trojan horse DLL in an unspecified directory and to execute arbitrary code with the privilege of the user invoking the installer when a terminal is connected remotely using Remote desktop.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jvn.jp/en/jp/JVN18056666/index.html; https://www.magicconnect.net/information/[PII_REDACTED]00-2; https://jvn.jp/en/jp/JVN18056666/index.html
CVE: CVE-2021-26569
Published: 2021-03-12
Description: Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-366, CWE-362
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.zerodayinitiative.com/advisories/ZDI-21-338/; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-27646
Published: 2021-03-12
Description: Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.zerodayinitiative.com/advisories/ZDI-21-339/; https://www.zerodayinitiative.com/advisories/ZDI-21-340/