deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44743
Published: 2022-01-14
Description: Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb22-03.html; https://helpx.adobe.com/security/products/bridge/apsb22-03.html
CVE: CVE-2021-44828
Published: 2022-01-14
Description: Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a non-privileged user to achieve write access to read-only memory, and possibly obtain root privileges, corrupt memory, and modify the memory of other processes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver; https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver
CVE: CVE-2021-45051
Published: 2022-01-14
Description: Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/bridge/apsb22-03.html; https://helpx.adobe.com/security/products/bridge/apsb22-03.html
CVE: CVE-2021-45052
Published: 2022-01-14
Description: Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/bridge/apsb22-03.html; https://helpx.adobe.com/security/products/bridge/apsb22-03.html
CVE: CVE-2021-45060
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-45061
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-45062
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-45063
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-45064
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-45067
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-45068
Published: 2022-01-14
Description: Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb22-01.html; https://helpx.adobe.com/security/products/acrobat/apsb22-01.html
CVE: CVE-2021-45406
Published: 2022-01-14
Description: In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://salonerp.sourceforge.io/; https://sourceforge.net/projects/salonerp/files/latest/download; https://www.exploit-db.com/exploits/50659
CVE: CVE-2021-45764
Published: 2022-01-14
Description: GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function shift_chunk_offsets.isra().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/gpac/gpac/issues/1971; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1971
CVE: CVE-2021-45767
Published: 2022-01-14
Description: GPAC 1.1.0 was discovered to contain an invalid memory address dereference via the function lsr_read_id(). This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/gpac/gpac/issues/1982; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1982
CVE: CVE-2021-45769
Published: 2022-01-14
Description: A NULL pointer dereference in AcseConnection_parseMessage at src/mms/iso_acse/acse.c of libiec61850 v1.5.0 can lead to a segmentation fault or application crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mz-automation/libiec61850/issues/368; https://github.com/mz-automation/libiec61850/issues/368
CVE: CVE-2021-45773
Published: 2022-01-14
Description: A NULL pointer dereference in CS104_IPAddress_setFromString at src/iec60870/cs104/cs104_slave.c of lib60870 commit 0d5e76e can lead to a segmentation fault or application crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mz-automation/lib60870/issues/100; https://github.com/mz-automation/lib60870/issues/100
CVE: CVE-2021-45774
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-45775
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-45778
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-45779
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-45780
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-45781
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-45782
Published: 2022-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-46019
Published: 2022-01-14
Description: An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gnu-mirror-unofficial/recutils/commit/34b75ed7ad492c8e38b669ebafe0176f1f9992d2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDVOFC3HTBG7DF2PZTEXRMG4CV2F55UF/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRSXSN2XF6PX74WDYVV26TQMYIFAEQ3T/
CVE: CVE-2021-46020
Published: 2022-01-14
Description: An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/mruby/mruby/issues/5613; https://github.com/mruby/mruby/issues/5613
CVE: CVE-2021-46021
Published: 2022-01-14
Description: An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDVOFC3HTBG7DF2PZTEXRMG4CV2F55UF/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRSXSN2XF6PX74WDYVV26TQMYIFAEQ3T/; https://lists.gnu.org/archive/html/bug-recutils/2021-12/msg00008.html
CVE: CVE-2021-46022
Published: 2022-01-14
Description: An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/gnu-mirror-unofficial/recutils/commit/34b75ed7ad492c8e38b669ebafe0176f1f9992d2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDVOFC3HTBG7DF2PZTEXRMG4CV2F55UF/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRSXSN2XF6PX74WDYVV26TQMYIFAEQ3T/
CVE: CVE-2021-46195
Published: 2022-01-14
Description: GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841; https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841
CVE: CVE-2022-0130
Published: 2022-01-14
Description: Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable.sc host prior to remote exploitation.
CVSS Score: 8.1 (HIGH)
References: https://www.tenable.com/security/tns-2022-01; https://www.tenable.com/security/tns-2022-01
CVE: CVE-2022-21137
Published: 2022-01-14
Description: Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-006-01; https://www.zerodayinitiative.com/advisories/ZDI-22-373/; https://www.zerodayinitiative.com/advisories/ZDI-22-374/
CVE: CVE-2022-22290
Published: 2022-01-14
Description: Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-703, CWE-755
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE: CVE-2022-22529
Published: 2022-01-14
Description: SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls, the UI5 framework provides automated output encoding for its standard controls. This output encoding prevents stored malicious user input from being executed when it is reflected in the UI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3124597; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035; https://launchpad.support.sap.com/#/notes/3124597
CVE: CVE-2022-22530
Published: 2022-01-14
Description: The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being modified or completely compromise the availability of the application.
CVSS Score: 8.1 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3112928; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035; https://launchpad.support.sap.com/#/notes/3112928
CVE: CVE-2022-22531
Published: 2022-01-14
Description: The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to run arbitrary script code, resulting in sensitive information being disclosed or modified.
CVSS Score: 8.1 (HIGH)
References: https://launchpad.support.sap.com/#/notes/3112928; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035; https://launchpad.support.sap.com/#/notes/3112928
CVE: CVE-2021-46168
Published: 2022-01-14
Description: Spin v6.5.1 was discovered to contain an out-of-bounds write in lex() at spinlex.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/nimble-code/Spin/issues/56; https://github.com/nimble-code/Spin/issues/56
CVE: CVE-2021-46169
Published: 2022-01-14
Description: Modex v2.11 was discovered to contain an Use-After-Free vulnerability via the component tcache.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/nimble-code/Modex/issues/10; https://github.com/nimble-code/Modex/issues/10
CVE: CVE-2021-46170
Published: 2022-01-14
Description: An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexer_compare_identifier_to_string in js-lexer.c file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/jerryscript-project/jerryscript/issues/4917; https://github.com/jerryscript-project/jerryscript/issues/4917
CVE: CVE-2021-46171
Published: 2022-01-14
Description: Modex v2.11 was discovered to contain a NULL pointer dereference in set_create_id() at xtract.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/nimble-code/Modex/issues/8; https://github.com/nimble-code/Modex/issues/8
CVE: CVE-2021-24044
Published: 2022-01-15
Description: By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843, CWE-843
References: https://www.facebook.com/security/advisories/cve-2021-24044; https://www.facebook.com/security/advisories/cve-2021-24044
CVE: CVE-2022-23094
Published: 2022-01-15
Description: Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/libreswan/libreswan/issues/585; https://libreswan.org/security/CVE-2022-23094; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPMIHAXWQUJAPCIGNJ5J5Q6ASWQBU7T5/
CVE: CVE-2021-33963
Published: 2022-01-15
Description: China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/mac_addr_clone receives parameters by POST request, and the parameter macType has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://iot.10086.cn/?l=en-us; https://github.com/pokerfacett/MY_CVE_CREDIT/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection9.md; https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
CVE: CVE-2021-44049
Published: 2022-01-15
Description: CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://docs.cyberark.com/Product-Doc/OnlineHelp/EPM-onprem/Latest/en/Content/Release%20Notes/RN-WhatsNew.htm; https://hencohen10.medium.com/cyberark-endpoint-manager-local-privilege-escalation-cve-2021-44049-67cd5e62c3d2; https://www.cyberark.com/ca21-34/
CVE: CVE-2022-23095
Published: 2022-01-15
Description: Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a crafted JPG file leads to memory corruption. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2022-23178
Published: 2022-01-15
Description: An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.redteam-pentesting.de/advisories/rt-sa-2021-009; https://www.redteam-pentesting.de/advisories/rt-sa-2021-009
CVE: CVE-2020-28919
Published: 2022-01-15
Description: A stored cross site scripting (XSS) vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote attacker to inject arbitrary JavaScript via a javascript: URL in a view title.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://checkmk.com/check_mk-werks.php?werk_id=11501; https://emacsninja.com/posts/cve-2020-28919-stored-xss-in-checkmk-160p18.html; https://github.com/tribe29/checkmk/commit/c00f450f884d8a229b7d8ab3f0452ed802a1ae04
CVE: CVE-2021-32545
Published: 2022-01-15
Description: Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2021-33498
Published: 2022-01-15
Description: Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2021-33499
Published: 2022-01-15
Description: Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2021-35969
Published: 2022-01-15
Description: Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2021-42555
Published: 2022-01-15
Description: Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2021-33827
Published: 2022-01-15
Description: The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://doc.owncloud.com/server/admin_manual/release_notes.html; https://owncloud.com/security-advisories/cve-2021-33827/; https://doc.owncloud.com/server/admin_manual/release_notes.html
CVE: CVE-2021-33828
Published: 2022-01-15
Description: The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share) are supposed to be deleted upon detection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://doc.owncloud.com/server/admin_manual/release_notes.html; https://owncloud.com/security-advisories/cve-2021-33828/; https://doc.owncloud.com/server/admin_manual/release_notes.html