deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33332
Published: 2021-08-03
Description: Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://issues.liferay.com/browse/LPE-17053; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366; https://issues.liferay.com/browse/LPE-17053
CVE: CVE-2021-33333
Published: 2021-08-03
Description: The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-276
References: https://issues.liferay.com/browse/LPE-17032; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742; https://issues.liferay.com/browse/LPE-17032
CVE: CVE-2021-33334
Published: 2021-08-03
Description: The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view all forms and form entries in a site via the forms section in site administration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://issues.liferay.com/browse/LPE-17039; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332; https://issues.liferay.com/browse/LPE-17039
CVE: CVE-2020-19301
Published: 2021-08-03
Description: A vulnerability in the vae_admin_rule database table of vaeThink v1.0.1 allows attackers to execute arbitrary code via a crafted payload in the condition parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://cwe.mitre.org/data/definitions/94.html; https://github.com/tingyuu/vaeThink/issues/1; https://cwe.mitre.org/data/definitions/94.html
CVE: CVE-2020-19302
Published: 2021-08-03
Description: An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing uploaded file suffixes to ".php".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/tingyuu/vaeThink/issues/2; https://github.com/tingyuu/vaeThink/issues/2
CVE: CVE-2020-19303
Published: 2021-08-03
Description: An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://github.com/houdunwang/hdcms/issues/6; https://github.com/houdunwang/hdcms/issues/6
CVE: CVE-2020-19304
Published: 2021-08-03
Description: An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/MRdoulestar/CodeAnalyse/issues/1; https://github.com/MRdoulestar/CodeAnalyse/issues/1
CVE: CVE-2020-19305
Published: 2021-08-03
Description: An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://cwe.mitre.org/data/definitions/36.html; https://github.com/MRdoulestar/CodeAnalyse/issues/2; https://cwe.mitre.org/data/definitions/36.html
CVE: CVE-2021-33335
Published: 2021-08-03
Description: Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863
References: https://issues.liferay.com/browse/LPE-17103; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906; https://issues.liferay.com/browse/LPE-17103
CVE: CVE-2021-33403
Published: 2021-08-03
Description: An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses between two large accounts during a transaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://cn.etherscan.com/address/0x63e634330a20150dbb61b15648bc73855d6ccf07#code; https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/LNCToken.md; https://cn.etherscan.com/address/0x63e634330a20150dbb61b15648bc73855d6ccf07#code
CVE: CVE-2021-34270
Published: 2021-08-03
Description: An integer overflow in the mintToken function of a smart contract implementation for Doftcoin Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/Doftcoin.md; https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/Doftcoin.md
CVE: CVE-2021-34272
Published: 2021-08-03
Description: A security flaw in the 'owned' function of a smart contract implementation for RobotCoin (RBTC), a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets.
CVSS Score: 7.5 (HIGH)
References: https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/RobotCoin.md; https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/RobotCoin.md
CVE: CVE-2021-34273
Published: 2021-08-03
Description: A security flaw in the 'owned' function of a smart contract implementation for BTC2X (B2X), a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets.
CVSS Score: 7.5 (HIGH)
References: https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/BTC2X.md; https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/BTC2X.md
CVE: CVE-2021-38084
Published: 2021-08-03
Description: An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: https://sourceforge.net/p/courier/mailman/courier-imap/thread/cone[PII_REDACTED][PII_REDACTED].1000%40monster.email-scan.com/#msg31555583; https://sourceforge.net/p/courier/mailman/message/37329216/; https://sourceforge.net/p/courier/mailman/courier-imap/thread/cone[PII_REDACTED][PII_REDACTED].1000%40monster.email-scan.com/#msg31555583
CVE: CVE-2021-32813
Published: 2021-08-03
Description: Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation, however, the Traefik team has addressed this issue to prevent any potential abuse. If one has a chain of Traefik middlewares, and one of them sets a request header, then sending a request with a certain Connection header will cause it to be removed before the request is sent. In this case, the backend does not see the request header. A patch is available in version 2.4.13. There are no known workarounds aside from upgrading.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-913, CWE-913
References: https://github.com/traefik/traefik/pull/8319/commits/cbaf86a93014a969b8accf39301932c17d0d73f9; https://github.com/traefik/traefik/releases/tag/v2.4.13; https://github.com/traefik/traefik/security/advisories/GHSA-m697-4v8f-55qg
CVE: CVE-2021-37231
Published: 2021-08-04
Description: A stack-buffer-overflow occurs in Atomicparsley 20[PII_REDACTED]13.840499f through APar_readX() in src/util.cpp while parsing a crafted mp4 file because of the missing boundary check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/wez/atomicparsley/issues/30; https://github.com/wez/atomicparsley/pull/31#issue-687280335; https://security.gentoo.org/glsa/202305-01
CVE: CVE-2021-37232
Published: 2021-08-04
Description: A stack overflow vulnerability occurs in Atomicparsley 20[PII_REDACTED]13.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_buffer while reading more bytes in APar_read64.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/wez/atomicparsley/commit/d72ccf06c98259d7261e0f3ac4fd[PII_REDACTED]c1; https://github.com/wez/atomicparsley/issues/32; https://security.gentoo.org/glsa/202305-01
CVE: CVE-2021-35397
Published: 2021-08-04
Description: A path traversal vulnerability in the static router for Drogon from 1.0.0-beta14 to 1.6.0 could allow an unauthenticated, remote attacker to arbitrarily read files. The vulnerability is due to lack of proper input validation for requested path. An attacker could exploit this vulnerability by sending crafted HTTP request with specific path to read. Successful exploitation could allow the attacker to read files that should be restricted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/an-tao/drogon; https://github.com/an-tao/drogon/blob/834e3eabdd0441ad2bc80c02e8bbfc3b8312c213/lib/src/StaticFileRouter.cc#L62-L67; https://github.com/an-tao/drogon/wiki/ENG-02-Installation
CVE: CVE-2021-36483
Published: 2021-08-04
Description: DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e; https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization; https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization
CVE: CVE-2021-33336
Published: 2021-08-04
Description: Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://issues.liferay.com/browse/LPE-17078; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name; https://issues.liferay.com/browse/LPE-17078
CVE: CVE-2021-33339
Published: 2021-08-04
Description: Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://issues.liferay.com/browse/LPE-17102; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934; https://issues.liferay.com/browse/LPE-17102
CVE: CVE-2021-3680
Published: 2021-08-04
Description: showdoc is vulnerable to Missing Cryptographic Step
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-325, CWE-347
References: https://github.com/star7th/showdoc/commit/4b962c1740311e0d46775023b6acba39ad60e370; https://huntr.dev/bounties/76b49607-fba9-4100-9be7-cb459fe6cfe2; https://github.com/star7th/showdoc/commit/4b962c1740311e0d46775023b6acba39ad60e370
CVE: CVE-2020-4707
Published: 2021-08-04
Description: IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187370.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187370; https://www.ibm.com/support/pages/node/6477840; https://exchange.xforce.ibmcloud.com/vulnerabilities/187370
CVE: CVE-2021-26098
Published: 2021-08-04
Description: An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-330
References: https://fortiguard.com/advisory/FG-IR-20-218; https://fortiguard.com/advisory/FG-IR-20-218
CVE: CVE-2021-29765
Published: 2021-08-04
Description: IBM PowerVM Hypervisor FW940 and FW950 could allow an attacker to obtain sensitive information if they gain service access to the FSP. IBM X-Force ID: 202476.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202476; https://www.ibm.com/support/pages/node/6478039; https://exchange.xforce.ibmcloud.com/vulnerabilities/202476
CVE: CVE-2021-32590
Published: 2021-08-04
Description: Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: https://fortiguard.com/advisory/FG-IR-21-084; https://fortiguard.com/advisory/FG-IR-21-084
CVE: CVE-2021-32594
Published: 2021-08-04
Description: An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow a low-privileged user to potentially tamper with the underlying system's files via the upload of specifically crafted files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://fortiguard.com/advisory/FG-IR-21-092; https://fortiguard.com/advisory/FG-IR-21-092
CVE: CVE-2021-33337
Published: 2021-08-04
Description: Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://issues.liferay.com/browse/LPE-17101; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-media; https://issues.liferay.com/browse/LPE-17101
CVE: CVE-2021-33338
Published: 2021-08-04
Description: The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://issues.liferay.com/browse/LPE-17030; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276; https://issues.liferay.com/browse/LPE-17030
CVE: CVE-2021-35463
Published: 2021-08-04
Description: Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120850663; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120850663
CVE: CVE-2021-36764
Published: 2021-08-04
Description: In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16804&token=d8c89c887979b22fdfc9fd5c3aa3804bbb1ddbff&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16804&token=d8c89c887979b22fdfc9fd5c3aa3804bbb1ddbff&download=
CVE: CVE-2021-36765
Published: 2021-08-04
Description: In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16806&token=3b0c51de5a6e35bccbb413ddaaa56551ca5490f6&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16806&token=3b0c51de5a6e35bccbb413ddaaa56551ca5490f6&download=
CVE: CVE-2021-3678
Published: 2021-08-04
Description: showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-338, CWE-338
References: https://github.com/star7th/showdoc/commit/4b962c1740311e0d46775023b6acba39ad60e370; https://huntr.dev/bounties/f9a9defd-29ea-4442-b692-ff1512813de4; https://github.com/star7th/showdoc/commit/4b962c1740311e0d46775023b6acba39ad60e370
CVE: CVE-2020-24821
Published: 2021-08-04
Description: A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/aclements/libelfin/issues/52; https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-dwarfcursorskip_form-at-dwarfcursorcc191; https://github.com/aclements/libelfin/issues/52
CVE: CVE-2020-24822
Published: 2021-08-04
Description: A vulnerability in the dwarf::cursor::uleb function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/aclements/libelfin/issues/50; https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-dwarfcursoruleb128-at-dwarfinternalhh154; https://github.com/aclements/libelfin/issues/50
CVE: CVE-2020-24823
Published: 2021-08-04
Description: A vulnerability in the dwarf::to_string function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/aclements/libelfin/issues/51; https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-dwarfto_string-at-dwarfvaluecc300; https://github.com/aclements/libelfin/issues/51
CVE: CVE-2020-24824
Published: 2021-08-04
Description: A global buffer overflow issue in the dwarf::line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/aclements/libelfin/issues/48; https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#global-buffer-overflow-in-function-dwarfline_tableline_table-at-dwarflinecc107; https://github.com/aclements/libelfin/issues/48
CVE: CVE-2020-24825
Published: 2021-08-04
Description: A vulnerability in the line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/aclements/libelfin/issues/46; https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-line_tableline_table-at-dwarflinecc104; https://github.com/aclements/libelfin/issues/46
CVE: CVE-2020-24826
Published: 2021-08-04
Description: A vulnerability in the elf::section::as_strtab function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/aclements/libelfin/issues/49; https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-elfsectionas_strtab-at-elfelfcc284; https://github.com/aclements/libelfin/issues/49
CVE: CVE-2020-24827
Published: 2021-08-04
Description: A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/aclements/libelfin/issues/47; https://github.com/xiaoxiongwang/function_bugs/tree/master/libelfin#segv-in-function-dwarfcursorskip_form-at-dwarfcursorcc181; https://github.com/aclements/libelfin/issues/47
CVE: CVE-2021-24010
Published: 2021-08-04
Description: Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated user to obtain unauthorized access to files and data via specifially crafted web requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://fortiguard.com/advisory/FG-IR-20-202; https://fortiguard.com/advisory/FG-IR-20-202
CVE: CVE-2021-24018
Published: 2021-08-04
Description: A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specifically crafted firmware image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://fortiguard.com/advisory/FG-IR-21-046; https://fortiguard.com/advisory/FG-IR-21-046
CVE: CVE-2021-36168
Published: 2021-08-04
Description: A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Fortinet FortiPortal 6.x before 6.0.5, FortiPortal 5.3.x before 5.3.6 and any FortiPortal before 6.2.5 allows authenticated attacker to disclosure information via crafted GET request with malicious parameter values.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://fortiguard.com/advisory/FG-IR-21-085; https://fortiguard.com/advisory/FG-IR-21-085
CVE: CVE-2020-29011
Published: 2021-08-04
Description: Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated attacker to execute unauthorized code on the underlying SQL interpreter via specifically crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fortiguard.com/advisory/FG-IR-20-171; https://fortiguard.com/advisory/FG-IR-20-171
CVE: CVE-2021-26097
Published: 2021-08-04
Description: An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6 may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/advisory/FG-IR-20-198; https://fortiguard.com/advisory/FG-IR-20-198
CVE: CVE-2021-32596
Published: 2021-08-04
Description: A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already in possession of the password store to decrypt the passwords by means of precomputed tables.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-916
References: https://fortiguard.com/advisory/FG-IR-21-094; https://fortiguard.com/advisory/FG-IR-21-094