deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28381
Published: 2021-01-12
Description: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write into uninitialized memory. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04; https://www.zerodayinitiative.com/advisories/ZDI-21-048/
CVE: CVE-2020-28382
Published: 2021-01-12
Description: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in a out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04; https://www.zerodayinitiative.com/advisories/ZDI-21-052/
CVE: CVE-2020-28383
Published: 2021-01-12
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing PAR files. This can result in an out of bounds write past the memory location that is a read only image address. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11885)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf
CVE: CVE-2020-28384
Published: 2021-01-12
Description: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could lead to a stack based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04; https://www.zerodayinitiative.com/advisories/ZDI-21-055/
CVE: CVE-2020-28386
Published: 2021-01-12
Description: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04; https://www.zerodayinitiative.com/advisories/ZDI-21-060/
CVE: CVE-2020-28390
Published: 2021-01-12
Description: A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-051/; https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf
CVE: CVE-2020-28391
Published: 2021-01-12
Description: A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with C-PLUG the devices use the hardcoded private RSA-key shipped with the firmware-image. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-012-02; https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf
CVE: CVE-2020-28395
Published: 2021-01-12
Description: A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-012-02; https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf
CVE: CVE-2021-23123
Published: 2021-01-12
Description: An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or inaccessible modules.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-com-modules-exposes-module-names.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-com-modules-exposes-module-names.html
CVE: CVE-2021-23124
Published: 2021-01-12
Description: An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-xss-in-mod-breadcrumbs-aria-label-attribute.html; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-xss-in-mod-breadcrumbs-aria-label-attribute.html
CVE: CVE-2021-23125
Published: 2021-01-12
Description: An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-in-com-tags-image-parameters.html; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-in-com-tags-image-parameters.html
CVE: CVE-2020-16526
Published: 2021-01-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2021-23927
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2021-23928
Published: 2021-01-12
Description: OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2021-23929
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2021-23930
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2021-23931
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows XSS via an inline binary file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2021-23932
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2021-23933
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2021-23934
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2021-23935
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2021-23936
Published: 2021-01-12
Description: OX App Suite through 7.10.4 allows XSS via the subject of a task.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html; https://packetstormsecurity.com/files/160853/OX-App-Suite-OX-Documents-7.10.x-XSS-SSRF.html
CVE: CVE-2020-28374
Published: 2021-01-13
Description: In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/161229/Kernel-Live-Patch-Security-Notice-LSN-0074-1.html; http://www.openwall.com/lists/oss-security/2021/01/13/2; http://www.openwall.com/lists/oss-security/2021/01/13/5
CVE: CVE-2020-36191
Published: 2021-01-13
Description: JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/jupyterhub/jupyterhub/issues/3304; https://github.com/jupyterhub/jupyterhub/releases; https://github.com/jupyterhub/jupyterhub/issues/3304
CVE: CVE-2020-35686
Published: 2021-01-13
Description: The SECOMN service in Sound Research DCHU model software component modules (APO) through 2.0.9.17, delivered on HP Windows 10 computers, may allow escalation of privilege via a fake DLL. (As a resolution, Windows Update is being submitted for all affected products to update to 2.0.9.18 or later.)
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://www.soundresearch.com/wp-content/uploads/static/CVE-2020-35686.html; https://www.soundresearch.com/wp-content/uploads/static/CVE-2020-35686.html
CVE: CVE-2020-5633
Published: 2021-01-13
Description: Multiple NEC products (Express5800/T110j, Express5800/T110j-S, Express5800/T110j (2nd-Gen), Express5800/T110j-S (2nd-Gen), iStorage NS100Ti, and Express5800/GT110j) where Baseboard Management Controller (BMC) firmware Rev1.09 and earlier is applied allows remote attackers to bypass authentication and then obtain/modify BMC setting information, obtain monitoring information, or reboot/shut down the vulnerable product via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://jpn.nec.com/security-info/secinfo/nv21-002.html; https://jvn.jp/en/jp/JVN38752718/index.html; https://www.support.nec.co.jp/View.aspx?id=[PII_REDACTED]
CVE: CVE-2020-5685
Published: 2021-01-13
Description: UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service (DoS) condition by sending a specially crafted request to a specific URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN38784555/index.html; https://www.necplatforms.co.jp/en/press/security_adv.html; https://jvn.jp/en/jp/JVN38784555/index.html
CVE: CVE-2020-5686
Published: 2021-01-13
Description: Incorrect implementation of authentication algorithm issue in UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to access the remote system maintenance feature and obtain the information by sending a specially crafted request to a specific URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://jvn.jp/en/jp/JVN38784555/index.html; https://www.necplatforms.co.jp/en/press/security_adv.html; https://jvn.jp/en/jp/JVN38784555/index.html
CVE: CVE-2021-20616
Published: 2021-01-13
Description: Untrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jvn.jp/en/jp/JVN69635538/index.html; https://www.skyseaclientview.net/news/210112_01/; https://jvn.jp/en/jp/JVN69635538/index.html
CVE: CVE-2021-21602
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452
CVE: CVE-2021-21603
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1889; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1889
CVE: CVE-2021-21604
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.
CVSS Score: 8.0 (HIGH)
CWE: CWE-502
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1923; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1923
CVE: CVE-2021-21605
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2021; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2021
CVE: CVE-2021-21606
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2023; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2023
CVE: CVE-2021-21607
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2025; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2025
CVE: CVE-2021-21608
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2035; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2035
CVE: CVE-2021-21609
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2047; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2047
CVE: CVE-2021-21610
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2153; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2153
CVE: CVE-2021-21611
Published: 2021-01-13
Description: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2171; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2171
CVE: CVE-2021-21612
Published: 2021-01-13
Description: Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2057; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2057
CVE: CVE-2021-21613
Published: 2021-01-13
Description: Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2098; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2098
CVE: CVE-2021-21614
Published: 2021-01-13
Description: Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2156; https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2156
CVE: CVE-2021-23899
Published: 2021-01-13
Description: OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e; https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2; https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0
CVE: CVE-2021-23900
Published: 2021-01-13
Description: OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.
CVSS Score: 7.5 (HIGH)
References: https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e; https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2; https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0
CVE: CVE-2021-3131
Published: 2021-01-13
Description: The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://github.com/jet-pentest/CVE-2021-3131; https://github.com/jet-pentest/CVE-2021-3131
CVE: CVE-2021-3139
Published: 2021-01-13
Description: In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2021/01/13/5; https://bugzilla.suse.com/attachment.cgi?id=844938; https://bugzilla.suse.com/show_bug.cgi?id=1178372
CVE: CVE-2020-15218
Published: 2021-01-13
Description: Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-613
References: https://github.com/Combodo/iTop/security/advisories/GHSA-3m3g-86hp-5p2j; https://github.com/Combodo/iTop/security/advisories/GHSA-3m3g-86hp-5p2j
CVE: CVE-2020-15219
Published: 2021-01-13
Description: Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/Combodo/iTop/security/advisories/GHSA-q5cf-46rg-frf8; https://github.com/Combodo/iTop/security/advisories/GHSA-q5cf-46rg-frf8