deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-19363
Published: 2021-01-20
Description: Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://emreovunc.com/blog/en/vtiger_crm_directorylisting_01.png; https://emreovunc.com/blog/en/vtiger_crm_directorylisting_02.png; https://github.com/EmreOvunc/Vtiger-CRM-Vulnerabilities/
CVE: CVE-2020-19364
Published: 2021-01-20
Description: OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/EmreOvunc/OpenEMR_Vulnerabilities; https://github.com/EmreOvunc/OpenEMR_Vulnerabilities
CVE: CVE-2020-25385
Published: 2021-01-20
Description: Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/EmreOvunc/Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting; https://github.com/EmreOvunc/Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting
CVE: CVE-2020-13133
Published: 2021-01-20
Description: Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) unauthenticated users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://portal.tufin.com/aspx/SecurityAdvisories; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-13134
Published: 2021-01-20
Description: Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://portal.tufin.com/aspx/SecurityAdvisories; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-27850
Published: 2021-01-20
Description: A stored Cross-Site Scripting (XSS) vulnerability in forms import feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via the import of a GF form. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.digital.security/advisories/cert-ds_advisory_cve-2020-27850.txt; https://www.digital.security/advisories/cert-ds_advisory_cve-2020-27850.txt
CVE: CVE-2020-27851
Published: 2021-01-20
Description: Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.digital.security/advisories/cert-ds_advisory_cve-2020-27851.txt; https://www.digital.security/advisories/cert-ds_advisory_cve-2020-27851.txt
CVE: CVE-2020-27852
Published: 2021-01-20
Description: A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.digital.security/advisories/cert-ds_advisory_cve-2020-27852.txt; https://www.digital.security/advisories/cert-ds_advisory_cve-2020-27852.txt
CVE: CVE-2021-3137
Published: 2021-01-20
Description: XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49437; https://www.exploit-db.com/exploits/49437
CVE: CVE-2020-35217
Published: 2021-01-20
Description: Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/vert-x3/vertx-web/pull/1613; https://github.com/vert-x3/vertx-web/pull/1613
CVE: CVE-2021-23326
Published: 2021-01-20
Description: This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://advisory.checkmarx.net/advisory/CX-2020-4300; https://github.com/ardatan/graphql-tools/commit/6a966beee8ca8b2f4adfe93318b96e4a5c501eac; https://github.com/ardatan/graphql-tools/pull/2470
CVE: CVE-2021-3110
Published: 2021-01-20
Description: The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://medium.com/%40gondaliyajaimin797/cve-2021-3110-75a24943ca5e; https://www.exploit-db.com/exploits/49410; https://medium.com/%40gondaliyajaimin797/cve-2021-3110-75a24943ca5e
CVE: CVE-2020-14756
Published: 2021-01-20
Description: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 9.8 (CRITICAL)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2022.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2020-4688
Published: 2021-01-20
Description: IBM Security Guardium 10.6 and 11.2 could allow a local attacker to execute arbitrary commands on the system as an unprivileged user, caused by command injection vulnerability. IBM X-Force ID: 186700.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186700; https://www.ibm.com/support/pages/node/6405952; https://exchange.xforce.ibmcloud.com/vulnerabilities/186700
CVE: CVE-2020-4887
Published: 2021-01-20
Description: IBM AIX 7.1, 7.2 and AIX VIOS 3.1 could allow a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. IBM X-Force ID: 190911.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190911; https://www.ibm.com/support/pages/node/6406022; https://exchange.xforce.ibmcloud.com/vulnerabilities/190911
CVE: CVE-2020-4921
Published: 2021-01-20
Description: IBM Security Guardium 10.6 and 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 191398.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191398; https://www.ibm.com/support/pages/node/6405952; https://exchange.xforce.ibmcloud.com/vulnerabilities/191398
CVE: CVE-2020-4983
Published: 2021-01-20
Description: IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary commands. IBM X-Force ID: 192586.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287, CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192586; https://www.hpcsec.com/2021/01/14/cve-2020-4983/; https://www.ibm.com/support/pages/node/6395478
CVE: CVE-2021-1993
Published: 2021-01-20
Description: Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 4.8 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N).
CVSS Score: 4.8 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-1994
Published: 2021-01-20
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 9.8 (CRITICAL)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-1995
Published: 2021-01-20
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
CVSS Score: 6.5 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-1996
Published: 2021-01-20
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).
CVSS Score: 2.4 (LOW)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-1997
Published: 2021-01-20
Description: Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Report). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS Score: 8.1 (HIGH)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-1998
Published: 2021-01-20
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L).
CVSS Score: 3.8 (LOW)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/; https://security.gentoo.org/glsa/202105-27
CVE: CVE-2021-1999
Published: 2021-01-20
Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: RAS subsystems). The supported version that is affected is 8.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to compromise Oracle ZFS Storage Appliance Kit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle ZFS Storage Appliance Kit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 5.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N).
CVSS Score: 5.0 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-2000
Published: 2021-01-20
Description: Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having SYS Account privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Unified Audit accessible data. CVSS 3.1 Base Score 2.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N).
CVSS Score: 2.4 (LOW)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-2001
Published: 2021-01-20
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.50 and prior, 5.7.30 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/; https://security.gentoo.org/glsa/202105-27
CVE: CVE-2021-2002
Published: 2021-01-20
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/; https://security.gentoo.org/glsa/202105-27
CVE: CVE-2021-2003
Published: 2021-01-20
Description: Vulnerability in the Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Dashboards). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-2004
Published: 2021-01-20
Description: Vulnerability in the Siebel Core - Server BizLogic Script product of Oracle Siebel CRM (component: Integration - Scripting). Supported versions that are affected are 20.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Core - Server BizLogic Script. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Core - Server BizLogic Script accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-2005
Published: 2021-01-20
Description: Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI Platform Security). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).
CVSS Score: 4.7 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2021-2006
Published: 2021-01-20
Description: Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 5.3 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/; https://security.gentoo.org/glsa/202105-27
CVE: CVE-2021-2007
Published: 2021-01-20
Description: Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 3.7 (LOW)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/; https://security.gentoo.org/glsa/202105-27
CVE: CVE-2021-2009
Published: 2021-01-20
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/; https://security.gentoo.org/glsa/202105-27