deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-31917
Published: 2021-09-21
Description: A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://access.redhat.com/security/cve/cve-2021-31917; https://access.redhat.com/security/cve/cve-2021-31917
CVE: CVE-2021-0869
Published: 2021-09-21
Description: In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-179620905 References: N/A
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-09-01; https://source.android.com/security/bulletin/pixel/2021-09-01
CVE: CVE-2021-28960
Published: 2021-09-21
Description: Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.manageengine.com; https://www.manageengine.com/products/desktop-central/unauthenticated-command-injection-vulnerability.html; https://www.manageengine.com
CVE: CVE-2021-37419
Published: 2021-09-21
Description: Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://blog.stmcyber.com/vulns/cve-2021-37419/; https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release; https://www.manageengine.com
CVE: CVE-2021-37420
Published: 2021-09-21
Description: Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://blog.stmcyber.com/vulns/cve-2021-37420/; https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release; https://www.manageengine.com
CVE: CVE-2021-37424
Published: 2021-09-21
Description: ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.
CVSS Score: 9.8 (CRITICAL)
References: https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release; https://www.manageengine.com; https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release
CVE: CVE-2021-37741
Published: 2021-09-21
Description: ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-41531
Published: 2021-09-21
Description: NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to RTR clients such as routers to reject the RPKI data set, effectively disabling Route Origin Validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1288, CWE-20
References: https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-41531.txt; https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-41531.txt
CVE: CVE-2021-41525
Published: 2021-09-21
Description: An issue related to modification of otherwise restricted files through a locally authenticated attacker exists in FlexNet inventory agent and inventory beacon versions 2020 R2.5 and prior.
CVSS Score: 5.5 (MEDIUM)
References: https://community.flexera.com/t5/FlexNet-Manager-Knowledge-Base/FlexNet-Inventory-Agent-and-Inventory-Beacon-Vulnerability/ta-p/204723; https://community.flexera.com/t5/FlexNet-Manager-Knowledge-Base/FlexNet-Inventory-Agent-and-Inventory-Beacon-Vulnerability/ta-p/204723
CVE: CVE-2021-29795
Published: 2021-09-21
Description: IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence of hypervisor calls from a partition that could crash the system. IBM X-Force ID: 203557.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203557; https://www.ibm.com/support/pages/node/6490877; https://exchange.xforce.ibmcloud.com/vulnerabilities/203557
CVE: CVE-2021-29831
Published: 2021-09-21
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 204775.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204775; https://www.ibm.com/support/pages/node/6490905; https://exchange.xforce.ibmcloud.com/vulnerabilities/204775
CVE: CVE-2021-23443
Published: 2021-09-21
Description: This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-843
References: https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21; https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556; https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21
CVE: CVE-2021-23444
Published: 2021-09-21
Description: This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-843
References: https://github.com/clientIO/joint/commit/e5bf89efef6d5ea572d66870ffd86560de7830a8; https://github.com/clientIO/joint/pull/1514; https://github.com/clientIO/joint/releases/tag/v3.4.2
CVE: CVE-2021-39230
Published: 2021-09-21
Description: Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to the Trinity kernel. There are no workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/FrankEnderman/Butter/commit/a4fd717e848306f04f2823ea5f617e4da9f5bbdb; https://github.com/FrankEnderman/Butter/security/advisories/GHSA-4538-4g86-xf6j; https://github.com/FrankEnderman/Butter/commit/a4fd717e848306f04f2823ea5f617e4da9f5bbdb
CVE: CVE-2021-40868
Published: 2021-09-21
Description: In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164255/Cloudron-6.2-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/164183/Cloudron-6.2-Cross-Site-Scripting.html; https://www.cloudron.io/
CVE: CVE-2021-40847
Published: 2021-09-21
Description: The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled by default. This daemon connects to Circle and NETGEAR to obtain version information and updates to the circled daemon and its filtering database. However, database updates from NETGEAR are unsigned and downloaded via cleartext HTTP. As such, an attacker with the ability to perform a MitM attack on the device can respond to circled update requests with a crafted, compressed database file, the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code. This affects R6400v2 1.0.4.106, R6700 1.0.2.16, R6700v3 1.0.4.106, R6900 1.0.2.16, R6900P 1.3.2.134, R7000 1.0.11.123, R7000P 1.3.2.134, R7850 1.0.5.68, R7900 1.0.4.38, R8000 1.0.4.68, and RS400 1.5.0.68.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html; https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204; https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html
CVE: CVE-2021-41084
Published: 2021-09-21
Description: http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.
CVSS Score: 8.7 (HIGH)
CWE: CWE-918, CWE-74
References: https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8; https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3; https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values
CVE: CVE-2020-19551
Published: 2021-09-21
Description: Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://github.com/wuzhicms/wuzhicms/issues/177; https://github.com/wuzhicms/wuzhicms/issues/177
CVE: CVE-2020-19553
Published: 2021-09-21
Description: Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.class.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/179; https://github.com/wuzhicms/wuzhicms/issues/179
CVE: CVE-2020-19554
Published: 2021-09-21
Description: Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125177; https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125177
CVE: CVE-2020-35540
Published: 2021-09-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-35541
Published: 2021-09-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2021-41086
Published: 2021-09-21
Description: jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://github.com/jsuites/jsuites/commit/d47a6f4e143188dde2742f4cffd313e1068ad3b3; https://github.com/jsuites/jsuites/commit/fe1d3cc5e339f2f4da8ed1f9f42271fdf9cbd8d2; https://github.com/jsuites/jsuites/security/advisories/GHSA-qh7x-j4v8-qw5w
CVE: CVE-2021-41087
Published: 2021-09-21
Description: in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-345, CWE-22
References: https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290; https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3; https://github.com/in-toto/in-toto-golang/commit/f2c57d1e0f15e3ffbeac531829c696b72ecc4290
CVE: CVE-2020-23266
Published: 2021-09-22
Description: An issue was discovered in gpac 0.8.0. The OD_ReadUTF8String function in odf_code.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted media file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1481; https://github.com/gpac/gpac/issues/1481
CVE: CVE-2020-23267
Published: 2021-09-22
Description: An issue was discovered in gpac 0.8.0. The gf_hinter_track_process function in isom_hinter_track_process.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted media file
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1479; https://github.com/gpac/gpac/issues/1479
CVE: CVE-2020-23269
Published: 2021-09-22
Description: An issue was discovered in gpac 0.8.0. The stbl_GetSampleSize function in isomedia/stbl_read.c has a heap-based buffer overflow which can lead to a denial of service (DOS) via a crafted media file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1482; https://github.com/gpac/gpac/issues/1482
CVE: CVE-2020-23273
Published: 2021-09-22
Description: Heap-buffer overflow in the randomize_iparp function in edit_packet.c. of Tcpreplay v4.3.2 allows attackers to cause a denial of service (DOS) via a crafted pcap.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/appneta/tcpreplay/issues/579; https://github.com/appneta/tcpreplay/issues/579
CVE: CVE-2021-41382
Published: 2021-09-22
Description: Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/164531/Plastic-SCM-10.0.16.5622-Improper-Access-Control.html; http://packetstormsecurity.com/files/164531/Plastic-SCM-10.0.16.5622-Insecure-Direct-Object-Reference.html; https://www.plasticscm.com/download/releasenotes/10.0.16.5622
CVE: CVE-2021-31819
Published: 2021-09-22
Description: In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-%28CVE-2021-31819%29[PII_REDACTED].html; https://advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-%28CVE-2021-31819%29[PII_REDACTED].html
CVE: CVE-2021-38112
Published: 2021-09-22
Description: In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution because of the Chromium Embedded Framework (CEF) --gpu-launcher argument. This is fixed in 3.1.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-88
References: https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes; https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/; https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes
CVE: CVE-2021-38153
Published: 2021-09-22
Description: Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://kafka.apache.org/cve-list; https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E; https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E
CVE: CVE-2021-39339
Published: 2021-09-22
Description: The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-supplied URL request value that gets called by a curl requests. This affects versions up to, and including, 1.8.0.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/telefication/tags/1.8.0/bypass.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39339; https://plugins.trac.wordpress.org/browser/telefication/tags/1.8.0/bypass.php
CVE: CVE-2021-3583
Published: 2021-09-22
Description: A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-94
References: https://bugzilla.redhat.com/show_bug.cgi?id=1968412; https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html; https://bugzilla.redhat.com/show_bug.cgi?id=1968412
CVE: CVE-2021-36260
Published: 2021-09-22
Description: A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html; http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html; https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/
CVE: CVE-2021-39404
Published: 2021-09-22
Description: MaianAffiliate v1.0 allows an authenticated administrative user to save an XSS to the database.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS; https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS
CVE: CVE-2021-31836
Published: 2021-09-22
Description: Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information. The utility was able to be run from any location on the file system and by a low privileged user.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10369; https://kc.mcafee.com/corporate/index?page=content&id=SB10369
CVE: CVE-2021-31841
Published: 2021-09-22
Description: A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL with a specific name and in a specific location. This would result in the user gaining elevated permissions and the ability to execute arbitrary code as the system user, through not checking the DLL signature.
CVSS Score: 8.2 (HIGH)
CWE: CWE-347, CWE-426, CWE-347, CWE-426
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10369; https://kc.mcafee.com/corporate/index?page=content&id=SB10369
CVE: CVE-2021-31847
Published: 2021-09-22
Description: Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and the ability to execute arbitrary code as the system user, through not correctly protecting a temporary directory used in the repair process and not checking the DLL signature.
CVSS Score: 8.2 (HIGH)
CWE: CWE-269, CWE-347, CWE-427
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10369; https://www.zerodayinitiative.com/advisories/ZDI-21-1104/; https://kc.mcafee.com/corporate/index?page=content&id=SB10369
CVE: CVE-2021-37925
Published: 2021-09-22
Description: Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com
CVE: CVE-2021-37927
Published: 2021-09-22
Description: Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://www.manageengine.com; https://www.manageengine.com/products/ad-manager/release-notes.html#7111; https://www.manageengine.com/products/self-service-password/release-notes.html#6110
CVE: CVE-2021-40875
Published: 2021-09-22
Description: Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The corresponding file paths can be tested, and in some cases, result in the disclosure of hardcoded credentials, API keys, or other sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: http://packetstormsecurity.com/files/164270/Gurock-Testrail-7.2.0.3014-Improper-Access-Control.html; https://github.com/SakuraSamuraii/derailed; https://johnjhacking.com/blog/cve-2021-40875/
CVE: CVE-2021-41011
Published: 2021-09-22
Description: LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditions. This is usually impossible, but in combination with a server-side bug, attackers could get this information.
CVSS Score: 7.5 (HIGH)
References: https://hackerone.com/reports/1279524; https://hackerone.com/reports/1279524
CVE: CVE-2019-6288
Published: 2021-09-22
Description: Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://twitter.com/r00treaver/status/[PII_REDACTED]64635401; https://www.edge-core.com; https://twitter.com/r00treaver/status/[PII_REDACTED]64635401
CVE: CVE-2021-37860
Published: 2021-09-22
Description: Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/