deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44965
Published: 2021-12-13
Description: Directory traversal vulnerability in /admin/includes/* directory for PHPGURUKUL Employee Record Management System 1.2 The attacker can retrieve and download sensitive information from the vulnerable server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PHPGURUKUL/ANUJ%20KUMAR/Employee-Record-Management-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PHPGURUKUL/ANUJ%20KUMAR/Employee-Record-Management-System
CVE: CVE-2021-44966
Published: 2021-12-13
Description: SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account of this system and can destroy, change or manipulate all sensitive information on the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PHPGURUKUL/ANUJ%20KUMAR/Employee-Record-Management-System-SQL-Injection-Bypass-Authentication; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PHPGURUKUL/ANUJ%20KUMAR/Employee-Record-Management-System-SQL-Injection-Bypass-Authentication
CVE: CVE-2021-22279
Published: 2021-12-13
Description: A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if the attacker has access to the Connected Services Gateway Ethernet port.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://search.abb.com/library/Download.aspx?DocumentID=SI20265&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=SI20265&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-39910
Published: 2021-12-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39910.json; https://gitlab.com/gitlab-org/gitlab/-/issues/325901; https://hackerone.com/reports/1133656
CVE: CVE-2021-39915
Published: 2021-12-13
Description: Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39915.json; https://gitlab.com/gitlab-org/gitlab/-/issues/340803; https://hackerone.com/reports/1336059
CVE: CVE-2021-39916
Published: 2021-12-13
Description: Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39916.json; https://gitlab.com/gitlab-org/gitlab/-/issues/343379; https://hackerone.com/reports/1372216
CVE: CVE-2021-39917
Published: 2021-12-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a DOS attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-697
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39917.json; https://gitlab.com/gitlab-org/gitlab/-/issues/338486; https://hackerone.com/reports/1277918
CVE: CVE-2021-39918
Published: 2021-12-13
Description: Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39918.json; https://gitlab.com/gitlab-org/gitlab/-/issues/329916; https://hackerone.com/reports/1180043
CVE: CVE-2021-39919
Published: 2021-12-13
Description: In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-640
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39919.json; https://gitlab.com/gitlab-org/gitlab/-/issues/342445; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39919.json
CVE: CVE-2021-39930
Published: 2021-12-13
Description: Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a user's custom project and group templates
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39930.json; https://gitlab.com/gitlab-org/gitlab/-/issues/26103; https://hackerone.com/reports/475240
CVE: CVE-2021-39931
Published: 2021-12-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under specific condition an unauthorised project member was allowed to delete a protected branches due to a business logic error.
CVSS Score: 3.1 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39931.json; https://gitlab.com/gitlab-org/gitlab/-/issues/340445; https://hackerone.com/reports/1318379
CVE: CVE-2021-39932
Published: 2021-12-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39932.json; https://gitlab.com/gitlab-org/gitlab/-/issues/217360; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39932.json
CVE: CVE-2021-39933
Published: 2021-12-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input (notes, comments, etc) was susceptible to catastrophic backtracking that could cause a DOS attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39933.json; https://gitlab.com/gitlab-org/gitlab/-/issues/340449; https://hackerone.com/reports/1320077
CVE: CVE-2021-39934
Published: 2021-12-13
Description: Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39934.json; https://gitlab.com/gitlab-org/gitlab/-/issues/342823; https://hackerone.com/reports/1360744
CVE: CVE-2021-39935
Published: 2021-12-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39935.json; https://gitlab.com/gitlab-org/gitlab/-/issues/346187; https://hackerone.com/reports/1236965
CVE: CVE-2021-39936
Published: 2021-12-13
Description: Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker in possession of a deploy token to access a project's disabled wiki.
CVSS Score: 3.5 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39936.json; https://gitlab.com/gitlab-org/gitlab/-/issues/241767; https://hackerone.com/reports/964057
CVE: CVE-2021-39937
Published: 2021-12-13
Description: A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-269
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39937.json; https://gitlab.com/gitlab-org/gitlab/-/issues/336802; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39937.json
CVE: CVE-2021-39938
Published: 2021-12-13
Description: A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands
CVSS Score: 3.1 (LOW)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39938.json; https://gitlab.com/gitlab-org/gitlab/-/issues/344873; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39938.json
CVE: CVE-2021-39939
Published: 2021-12-13
Description: An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker triggering a job with a specially crafted docker image to exhaust resources on runner manager
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39939.json; https://gitlab.com/gitlab-org/gitlab-runner/-/issues/28630; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39939.json
CVE: CVE-2021-39940
Published: 2021-12-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39940.json; https://gitlab.com/gitlab-org/gitlab/-/issues/263116; https://hackerone.com/reports/997961
CVE: CVE-2021-39941
Published: 2021-12-13
Description: An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39941.json; https://gitlab.com/gitlab-org/gitlab/-/issues/33864; https://hackerone.com/reports/706361
CVE: CVE-2021-39944
Published: 2021-12-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39944.json; https://gitlab.com/gitlab-org/gitlab/-/issues/336531; https://hackerone.com/reports/1256017
CVE: CVE-2021-39945
Published: 2021-12-13
Description: Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked
CVSS Score: 2.7 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39945.json; https://gitlab.com/gitlab-org/gitlab/-/issues/331675; https://hackerone.com/reports/1198317
CVE: CVE-2021-40007
Published: 2021-12-13
Description: There is an information leak vulnerability in eCNS280_TD V100R005C10SPC650. The vulnerability is caused by improper log output management. An attacker with the ability to access the log file of device may lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211208-01-informationleak-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211208-01-informationleak-en
CVE: CVE-2021-40008
Published: 2021-12-13
Description: There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudEngine 6800 V200R019C00SPC800 and CloudEngine 7800 V200R019C00SPC800. The software does not sufficiently track and release allocated memory while parse a series of crafted binary messages, which could consume remaining memory. Successful exploit could cause memory exhaust.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211208-01-memleak-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211208-01-memleak-en
CVE: CVE-2021-43983
Published: 2021-12-13
Description: WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-343-02; https://www.zerodayinitiative.com/advisories/ZDI-22-034/; https://www.zerodayinitiative.com/advisories/ZDI-22-035/
CVE: CVE-2020-16154
Published: 2021-12-13
Description: The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DENFY4CRTIZL5WYYUYUM4VKCJNXO4QIW/; https://metacpan.org/pod/App::cpanminus
CVE: CVE-2020-16155
Published: 2021-12-13
Description: The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/; https://metacpan.org/pod/CPAN::Checksums; https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
CVE: CVE-2020-16156
Published: 2021-12-13
Description: CPAN 2.28 allows Signature Verification Bypass.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html; https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
CVE: CVE-2021-38947
Published: 2021-12-13
Description: IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 211242.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/211242; https://www.ibm.com/support/pages/node/6525554; https://exchange.xforce.ibmcloud.com/vulnerabilities/211242
CVE: CVE-2021-39052
Published: 2021-12-13
Description: IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. IBM X-Force ID: 214523.
CVSS Score: 9.8 (CRITICAL)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214523; https://www.ibm.com/support/pages/node/6525554; https://exchange.xforce.ibmcloud.com/vulnerabilities/214523
CVE: CVE-2021-39053
Published: 2021-12-13
Description: IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to obtain sensitive information, caused by the improper handling of requests for Spectrum Copy Data Management Admin Console. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 214524.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214524; https://www.ibm.com/support/pages/node/6525554; https://exchange.xforce.ibmcloud.com/vulnerabilities/214524
CVE: CVE-2021-39054
Published: 2021-12-13
Description: IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 214525.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214525; https://www.ibm.com/support/pages/node/6525554; https://exchange.xforce.ibmcloud.com/vulnerabilities/214525
CVE: CVE-2021-39058
Published: 2021-12-13
Description: IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 214617.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214617; https://www.ibm.com/support/pages/node/6525554; https://exchange.xforce.ibmcloud.com/vulnerabilities/214617
CVE: CVE-2021-39064
Published: 2021-12-13
Description: IBM Spectrum Copy Data Management 2.2.13 and earlier has weak authentication and password rules and incorrectly handles default credentials for the Spectrum Copy Data Management Admin console. IBM X-Force ID: 214957.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214957; https://www.ibm.com/support/pages/node/6525554; https://exchange.xforce.ibmcloud.com/vulnerabilities/214957
CVE: CVE-2021-39065
Published: 2021-12-13
Description: IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the Spectrum Copy Data Management Admin Console login and uploadcertificate function . A remote attacker could inject arbitrary shell commands which would be executed on the affected system. IBM X-Force ID: 214958.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214958; https://www.ibm.com/support/pages/node/6525554; https://exchange.xforce.ibmcloud.com/vulnerabilities/214958
CVE: CVE-2021-43818
Published: 2021-12-13
Description: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
CVSS Score: 8.2 (HIGH)
CWE: CWE-74, CWE-79, CWE-79
References: https://github.com/lxml/lxml/commit/12fa[PII_REDACTED]a7bb87d990c375cf91ca5b664a; https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776; https://github.com/lxml/lxml/commit/f[PII_REDACTED]df7e8f39c3ad1b1aa8852be3b27c0
CVE: CVE-2020-4496
Published: 2021-12-13
Description: The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182046; https://www.ibm.com/support/pages/node/6525346; https://exchange.xforce.ibmcloud.com/vulnerabilities/182046
CVE: CVE-2021-32024
Published: 2021-12-13
Description: A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentially execute code in the context of the affected process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1287
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000089042; http://support.blackberry.com/kb/articleDetail?articleNumber=000089042
CVE: CVE-2021-38901
Published: 2021-12-13
Description: IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information. IBM X-Force ID: 209610.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209610; https://www.ibm.com/support/pages/node/6524924; https://exchange.xforce.ibmcloud.com/vulnerabilities/209610
CVE: CVE-2021-39048
Published: 2021-12-13
Description: IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local attacker could exploit this vulnerability and cause a denial of service. IBM X-Force ID: 214438.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214438; https://security.gentoo.org/glsa/202209-02; https://www.ibm.com/support/pages/node/6524706
CVE: CVE-2021-39049
Published: 2021-12-13
Description: IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and gain lower level privileges. IBM X-Force ID: 214439.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214439; https://www.ibm.com/support/pages/node/6525256; https://exchange.xforce.ibmcloud.com/vulnerabilities/214439
CVE: CVE-2021-39050
Published: 2021-12-13
Description: IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and gain lower level privileges. IBM X-Force ID: 214440.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214440; https://www.ibm.com/support/pages/node/6525258; https://exchange.xforce.ibmcloud.com/vulnerabilities/214440
CVE: CVE-2021-39057
Published: 2021-12-13
Description: IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214616; https://www.ibm.com/support/pages/node/6525346; https://exchange.xforce.ibmcloud.com/vulnerabilities/214616