deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1782
Published: 2021-04-02
Description: A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..
CVSS Score: 7.0 (HIGH)
CWE: CWE-667, CWE-667
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-1783
Published: 2021-04-02
Description: An access issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-1785
Published: 2021-04-02
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-1786
Published: 2021-04-02
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local user may be able to create or modify system files.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-1787
Published: 2021-04-02
Description: Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-1788
Published: 2021-04-02
Description: A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/; https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147
CVE: CVE-2021-1789
Published: 2021-04-02
Description: A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/; https://security.gentoo.org/glsa/202104-03
CVE: CVE-2021-1791
Published: 2021-04-02
Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to disclose kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-1792
Published: 2021-04-02
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-22865
Published: 2021-04-02
Description: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication flow to read private repository metadata via the REST API without having been granted the appropriate permissions. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. The private repository metadata returned would be limited to repositories owned by the user the token identifies. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.0.4 and was fixed in versions 3.0.4, 2.22.10, 2.21.18. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.18; https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.10; https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.4
CVE: CVE-2020-11923
Published: 2021-04-02
Description: An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-wiz-smart-lightbulbs/; http://seclists.org/fulldisclosure/2024/Jul/14
CVE: CVE-2020-11924
Published: 2021-04-02
Description: An issue was discovered in WiZ Colors A60 1.14.0. Wi-Fi credentials are stored in cleartext in flash memory, which presents an information-disclosure risk for a discarded or resold device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-wiz-smart-lightbulbs/; http://seclists.org/fulldisclosure/2024/Jul/14
CVE: CVE-2021-1753
Published: 2021-04-02
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212146
CVE: CVE-2021-1761
Published: 2021-04-02
Description: This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-1790
Published: 2021-04-02
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Processing a maliciously crafted font may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212147
CVE: CVE-2021-1793
Published: 2021-04-02
Description: This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-1794
Published: 2021-04-02
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212146
CVE: CVE-2021-1795
Published: 2021-04-02
Description: An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212146
CVE: CVE-2021-1796
Published: 2021-04-02
Description: An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212146
CVE: CVE-2021-1797
Published: 2021-04-02
Description: The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local user may be able to read arbitrary files.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2021/Apr/51; https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147
CVE: CVE-2021-1799
Published: 2021-04-02
Description: A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on arbitrary servers.
CVSS Score: 6.5 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/; https://security.gentoo.org/glsa/202104-03
CVE: CVE-2021-1800
Published: 2021-04-02
Description: A path handling issue was addressed with improved validation. This issue is fixed in Xcode 12.4. A malicious application may be able to access arbitrary files on the host device while running an app that uses on-demand resources with Xcode.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT212153; https://support.apple.com/en-us/HT212153
CVE: CVE-2021-1801
Published: 2021-04-02
Description: This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.
CVSS Score: 6.5 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/; https://security.gentoo.org/glsa/202104-03
CVE: CVE-2021-1802
Published: 2021-04-02
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212147
CVE: CVE-2021-1803
Published: 2021-04-02
Description: The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A local application may be able to enumerate the user's iCloud documents.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/HT211931; https://support.apple.com/en-us/HT211931
CVE: CVE-2021-1805
Published: 2021-04-02
Description: An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, macOS Mojave 10.14.6 Security Update 2021-002. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2021/Apr/54; https://support.apple.com/en-us/HT212177; https://support.apple.com/kb/HT212327
CVE: CVE-2021-1806
Published: 2021-04-02
Description: A race condition was addressed with additional validation. This issue is fixed in macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, macOS Mojave 10.14.6 Security Update 2021-002. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://seclists.org/fulldisclosure/2021/Apr/54; https://support.apple.com/en-us/HT212177; https://support.apple.com/kb/HT212327
CVE: CVE-2021-1818
Published: 2021-04-02
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147; https://support.apple.com/en-us/HT212148
CVE: CVE-2021-1844
Published: 2021-04-02
Description: A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2021/Apr/55; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/; https://support.apple.com/en-us/HT212220
CVE: CVE-2021-1870
Published: 2021-04-02
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
CVSS Score: 9.8 (CRITICAL)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/; https://security.gentoo.org/glsa/202104-03
CVE: CVE-2021-1871
Published: 2021-04-02
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
CVSS Score: 9.8 (CRITICAL)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/; https://support.apple.com/en-us/HT212146; https://support.apple.com/en-us/HT212147
CVE: CVE-2021-1879
Published: 2021-04-02
Description: This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.apple.com/en-us/HT212256; https://support.apple.com/en-us/HT212257; https://support.apple.com/en-us/HT212258
CVE: CVE-2021-27973
Published: 2021-04-02
Description: SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/162404/Piwigo-11.3.0-SQL-Injection.html; https://github.com/Piwigo/Piwigo/issues/1352; http://packetstormsecurity.com/files/162404/Piwigo-11.3.0-SQL-Injection.html
CVE: CVE-2021-29660
Published: 2021-04-02
Description: A Cross-Site Request Forgery (CSRF) vulnerability in en/cfg_setpwd.html in Softing AG OPC Toolbox through 4.10.1.13035 allows attackers to reset the administrative password by inducing the Administrator user to browse a URL controlled by an attacker.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.gruppotim.it/redteam; https://www.gruppotim.it/redteam
CVE: CVE-2021-29661
Published: 2021-04-02
Description: Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page containing it.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.gruppotim.it/redteam; https://www.gruppotim.it/redteam
CVE: CVE-2021-3374
Published: 2021-04-02
Description: Directory traversal in RStudio Shiny Server before 1.5.16 allows attackers to read the application source code, involving an encoded slash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://blog.rstudio.com/2021/01/13/shiny-server-1-5-16-update/; https://github.com/colemanjp/shinyserver-directory-traversal-source-code-leak; https://blog.rstudio.com/2021/01/13/shiny-server-1-5-16-update/
CVE: CVE-2020-21585
Published: 2021-04-02
Description: Vulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/emlog/emlog/issues/54; https://github.com/pwnninja/emlog/issues/1; https://github.com/emlog/emlog/issues/54
CVE: CVE-2020-21588
Published: 2021-04-02
Description: Buffer overflow in Core FTP LE v2.2 allows local attackers to cause a denial or service (crash) via a long string in the Setup->Users->Username editbox.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/lonely-explorer/CoreFTP/issues/1; https://github.com/pwnninja/CoreFTP/issues/1; https://github.com/lonely-explorer/CoreFTP/issues/1
CVE: CVE-2020-21590
Published: 2021-04-02
Description: Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/pwnninja/wuzhicms/issues/1; https://github.com/wuzhicms/wuzhicms/issues/190; https://github.com/pwnninja/wuzhicms/issues/1
CVE: CVE-2021-28940
Published: 2021-04-02
Description: Because of a incorrect escaped exec command in MagpieRSS in 0.72 in the /extlib/Snoopy.class.inc file, it is possible to add a extra command to the curl binary. This creates an issue on the /scripts/magpie_debug.php and /scripts/magpie_simple.php page that if you send a specific https url in the RSS URL field, you are able to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116
References: https://github.com/kellan/magpierss/blob/04d2a88b97fdba5813d01dc0d56c772d97360bb5/extlib/Snoopy.class.inc#L660; https://pastebin.com/kpzHKKJu; https://www.exploit-db.com/exploits/49643
CVE: CVE-2021-28941
Published: 2021-04-02
Description: Because of no validation on a curl command in MagpieRSS 0.72 in the /extlib/Snoopy.class.inc file, when you send a request to the /scripts/magpie_debug.php or /scripts/magpie_simple.php page, it's possible to request any internal page if you use a https request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/kellan/magpierss/blob/04d2a88b97fdba5813d01dc0d56c772d97360bb5/extlib/Snoopy.class.inc#L660; https://pastebin.com/kpzHKKJu; https://github.com/kellan/magpierss/blob/04d2a88b97fdba5813d01dc0d56c772d97360bb5/extlib/Snoopy.class.inc#L660
CVE: CVE-2021-30072
Published: 2021-04-02
Description: An issue was discovered in prog.cgi on D-Link DIR-878 1.30B08 devices. Because strcat is misused, there is a stack-based buffer overflow that does not require authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10217; https://www.dlink.com/en/security-bulletin/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10217
CVE: CVE-2021-30125
Published: 2021-04-02
Description: Jamf Pro before 10.28.0 allows XSS related to inventory history, aka PI-009376.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.jamf.com/10.28.0/jamf-pro/release-notes/Bug_Fixes_and_Enhancements.html; https://docs.jamf.com/10.28.0/jamf-pro/release-notes/Bug_Fixes_and_Enhancements.html
CVE: CVE-2021-30126
Published: 2021-04-02
Description: Lightmeter ControlCenter 1.1.0 through 1.5.x before 1.5.1 allows anyone who knows the URL of a publicly available Lightmeter instance to access application settings, possibly including an SMTP password and a Slack access token, via a settings HTTP query.
CVSS Score: 6.5 (MEDIUM)
References: https://lightmeter.io/lightmeter-1-5-1-important-security-fixes/; https://lightmeter.io/lightmeter-1-5-1-important-security-fixes/
CVE: CVE-2020-27600
Published: 2021-04-02
Description: HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pwnninja/dlink/blob/main/DIR-846_SetMasterWLanSettingsCI.md; https://www.dlink.com; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2021-30074
Published: 2021-04-02
Description: docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/docsifyjs/docsify/issues/1549; https://github.com/docsifyjs/docsify/issues/1549
CVE: CVE-2021-21529
Published: 2021-04-02
Description: Dell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability. A local authenticated malicious user with low privileges may potentially exploit this vulnerability to cause the system to run out of memory by running multiple instances of the vulnerable application.
CVSS Score: 3.8 (LOW)
CWE: CWE-400, CWE-400
References: https://www.dell.com/support/kbdoc/en-us/000184608/dsa-2021-059-dell-emc-system-update-dsu-security-update-for-denial-of-service-vulnerability; https://www.dell.com/support/kbdoc/en-us/000184608/dsa-2021-059-dell-emc-system-update-dsu-security-update-for-denial-of-service-vulnerability