deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-24740
Published: 2021-05-18
Description: An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/pluck-cms/pluck/issues/81; https://github.com/pluck-cms/pluck/issues/81
CVE: CVE-2021-32305
Published: 2021-05-18
Description: WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html; https://github.com/websvnphp/websvn/pull/142; http://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html
CVE: CVE-2021-3200
Published: 2021-05-18
Description: Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int *resultflagsp function at src/testcase.c: line 2334, which could cause a denial of service
CVSS Score: 3.3 (LOW)
CWE: CWE-120
References: https://github.com/openSUSE/libsolv/issues/416; https://github.com/yangjiageng/PoC/blob/master/libsolv-PoCs/PoC-testcase_read-2334; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2020-18178
Published: 2021-05-18
Description: Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/Neeke/HongCMS/issues/11; https://github.com/Neeke/HongCMS/issues/11
CVE: CVE-2020-20214
Published: 2021-05-18
Description: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from an assertion failure vulnerability in the btest process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://packetstormsecurity.com/files/162513/Mikrotik-RouterOS-6.46.5-Memory-Corruption-Assertion-Failure.html; http://seclists.org/fulldisclosure/2021/May/15; http://seclists.org/fulldisclosure/2021/May/15
CVE: CVE-2020-20222
Published: 2021-05-18
Description: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://packetstormsecurity.com/files/162513/Mikrotik-RouterOS-6.46.5-Memory-Corruption-Assertion-Failure.html; http://seclists.org/fulldisclosure/2021/May/15; http://seclists.org/fulldisclosure/2021/May/15
CVE: CVE-2020-20236
Published: 2021-05-18
Description: Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/162513/Mikrotik-RouterOS-6.46.5-Memory-Corruption-Assertion-Failure.html; http://seclists.org/fulldisclosure/2021/May/15; http://seclists.org/fulldisclosure/2021/May/15
CVE: CVE-2020-20237
Published: 2021-05-18
Description: Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/162513/Mikrotik-RouterOS-6.46.5-Memory-Corruption-Assertion-Failure.html; http://seclists.org/fulldisclosure/2021/May/15; http://seclists.org/fulldisclosure/2021/May/15
CVE: CVE-2020-19924
Published: 2021-05-18
Description: In Boostnote 0.12.1, exporting to PDF contains opportunities for XSS attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/BoostIO/Boostnote/issues/3178; https://github.com/BoostIO/Boostnote/issues/3178
CVE: CVE-2020-20220
Published: 2021-05-18
Description: Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/162533/MikroTik-RouterOS-Memory-Corruption.html; http://seclists.org/fulldisclosure/2021/May/23; https://mikrotik.com/
CVE: CVE-2020-20227
Published: 2021-05-18
Description: Mikrotik RouterOs stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/162533/MikroTik-RouterOS-Memory-Corruption.html; http://seclists.org/fulldisclosure/2021/May/23; https://mikrotik.com/
CVE: CVE-2020-20245
Published: 2021-05-18
Description: Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the log process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/162533/MikroTik-RouterOS-Memory-Corruption.html; http://seclists.org/fulldisclosure/2021/May/23; https://mikrotik.com/
CVE: CVE-2020-20246
Published: 2021-05-18
Description: Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the mactel process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/162533/MikroTik-RouterOS-Memory-Corruption.html; http://seclists.org/fulldisclosure/2021/May/23; https://mikrotik.com/
CVE: CVE-2021-31315
Published: 2021-05-18
Description: Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://www.shielder.it/advisories/telegram-rlottie-blit-stack-buffer-overflow/; https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/; https://www.shielder.it/advisories/telegram-rlottie-blit-stack-buffer-overflow/
CVE: CVE-2021-31316
Published: 2021-05-18
Description: The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.shielder.it/advisories/centos-web-panel-idsession-root-rce/; https://www.shielder.it/advisories/centos-web-panel-idsession-root-rce/
CVE: CVE-2021-31317
Published: 2021-05-18
Description: Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-843
References: https://www.shielder.it/advisories/telegram-rlottie-vdasher-vdasher-type-confusion/; https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/; https://www.shielder.it/advisories/telegram-rlottie-vdasher-vdasher-type-confusion/
CVE: CVE-2021-31318
Published: 2021-05-18
Description: Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-843
References: https://www.shielder.it/advisories/telegram-rlottie-lotcomplayeritem-lotcomplayeritem-type-confusion/; https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/; https://www.shielder.it/advisories/telegram-rlottie-lotcomplayeritem-lotcomplayeritem-type-confusion/
CVE: CVE-2021-31319
Published: 2021-05-18
Description: Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://www.shielder.it/advisories/telegram-rlottie-lotgradient-populate-integer-overflow/; https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/; https://www.shielder.it/advisories/telegram-rlottie-lotgradient-populate-integer-overflow/
CVE: CVE-2021-31320
Published: 2021-05-18
Description: Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://www.shielder.it/advisories/telegram-rlottie-vgradientcache-generategradientcolortable-heap-buffer-overflow/; https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/; https://www.shielder.it/advisories/telegram-rlottie-vgradientcache-generategradientcolortable-heap-buffer-overflow/
CVE: CVE-2021-31321
Published: 2021-05-18
Description: Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://www.shielder.it/advisories/telegram-rlottie-gray_split_cubic-stack-buffer-overflow/; https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/; https://www.shielder.it/advisories/telegram-rlottie-gray_split_cubic-stack-buffer-overflow/
CVE: CVE-2021-31322
Published: 2021-05-18
Description: Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://www.shielder.it/advisories/telegram-rlottie-lotgradient-populate-heap-buffer-overflow/; https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/; https://www.shielder.it/advisories/telegram-rlottie-lotgradient-populate-heap-buffer-overflow/
CVE: CVE-2021-31323
Published: 2021-05-18
Description: Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://www.shielder.it/advisories/telegram-rlottie-lottieparserimpl-parsedashproperty-heap-buffer-overflow/; https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/; https://www.shielder.it/advisories/telegram-rlottie-lottieparserimpl-parsedashproperty-heap-buffer-overflow/
CVE: CVE-2021-31324
Published: 2021-05-18
Description: The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.shielder.it/advisories/centos-web-panel-idsession-root-rce/; https://www.shielder.it/advisories/centos-web-panel-idsession-root-rce/
CVE: CVE-2021-20589
Published: 2021-05-19
Description: Buffer access with incorrect length value vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.38.000, GT25 model communication driver versions 01.19.000 through 01.38.000, GT23 model communication driver versions 01.19.000 through 01.38.000 and GT21 model communication driver versions 01.21.000 through 01.39.000, GOT SIMPLE series GS21 model communication driver versions 01.21.000 through 01.39.000, GT SoftGOT2000 versions 1.170C through 1.250L and Tension Controller LE7-40GU-L Screen package data for MODBUS/TCP V1.00 allows a remote unauthenticated attacker to stop the communication function of the products via specially crafted packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://jvn.jp/vu/JVNVU99895108/index.html; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-002_en.pdf; https://jvn.jp/vu/JVNVU99895108/index.html
CVE: CVE-2021-21732
Published: 2021-05-19
Description: A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications can read some files in the proc file system without authorization. Attackers could exploit this vulnerability to obtain sensitive information. This affects Axon 11 5G ZTE/CN_P725A12/P725A12:10/QKQ1.200816.002/20[PII_REDACTED]17:user/release-keys.
CVSS Score: 7.5 (HIGH)
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015064; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015064
CVE: CVE-2020-20264
Published: 2021-05-19
Description: Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/cq674350529/pocs_slides/blob/master/pocs/MikroTik/vul_netwatch/README.md; https://seclists.org/fulldisclosure/2021/May/11; https://github.com/cq674350529/pocs_slides/blob/master/pocs/MikroTik/vul_netwatch/README.md
CVE: CVE-2020-20266
Published: 2021-05-19
Description: Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-787
References: https://github.com/cq674350529/pocs_slides/blob/master/pocs/MikroTik/vul_dot1x/README.md; https://seclists.org/fulldisclosure/2021/May/11; https://github.com/cq674350529/pocs_slides/blob/master/pocs/MikroTik/vul_dot1x/README.md
CVE: CVE-2021-21733
Published: 2021-05-19
Description: The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the information returned by the program, and then obtain some sensitive information. This affects ZXCDN V7.01 all versions up to IAMV7.01.01.02.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015304; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015304
CVE: CVE-2017-17674
Published: 2021-05-19
Description: BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: http://bmc.com; http://remedy.com; https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html
CVE: CVE-2017-17675
Published: 2021-05-19
Description: BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: http://bmc.com; http://remedy.com; https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html
CVE: CVE-2017-17677
Published: 2021-05-19
Description: BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://bmc.com; http://remedy.com; https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html
CVE: CVE-2017-17678
Published: 2021-05-19
Description: BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a legacy utility.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://bmc.com; http://remedy.com; https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html
CVE: CVE-2021-3421
Published: 2021-05-19
Description: A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-347
References: https://bugzilla.redhat.com/show_bug.cgi?id=1927747; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMGXO3W6DHPO62GJ4VVF5DEUX5DRUR5K/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHRPNBCRPDJHHQE3MBPSZK4H7X2IM7AC/
CVE: CVE-2021-3445
Published: 2021-05-19
Description: A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://bugzilla.redhat.com/show_bug.cgi?id=1932079; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPMFGGQ5T6WVFTFX3OKMVTTM5O4EXWZR/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4NL7TNWAHJ6JVRABQUPWHKKCTHUZMNF/
CVE: CVE-2021-3517
Published: 2021-05-19
Description: There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787, CWE-787, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1954232; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2021-31930
Published: 2021-05-19
Description: Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the account, the XSS payload will be executed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/concerto/concerto/pull/1558; https://github.com/concerto/concerto/security/advisories; https://github.com/concerto/concerto/pull/1558
CVE: CVE-2021-33204
Published: 2021-05-19
Description: In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit search_path is not set.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/pgpartman/pg_partman/commit/0b6565ad378c358f8a6cd1d48ddc482eb7f854d3; https://github.com/pgpartman/pg_partman/compare/v4.5.0...v4.5.1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-36364
Published: 2021-05-19
Description: An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and delete actions) in the ImportController.Create method via a TempFileName field.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/smartstore/SmartStoreNET/commit/5ab1e37dc8d6415d04354e1a116f3d82e9555f5c; https://github.com/smartstore/SmartStoreNET/issues/2112; https://github.com/smartstore/SmartStoreNET/commit/5ab1e37dc8d6415d04354e1a116f3d82e9555f5c
CVE: CVE-2020-36365
Published: 2021-05-19
Description: Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/smartstore/SmartStoreNET/issues/2113; https://github.com/smartstore/SmartStoreNET/issues/2113
CVE: CVE-2021-25644
Published: 2021-05-19
Description: An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://www.couchbase.com/downloads; https://www.couchbase.com/resources/security#SecurityAlerts; https://www.couchbase.com/downloads
CVE: CVE-2021-27925
Published: 2021-05-19
Description: An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-362
References: https://www.couchbase.com/downloads; https://www.couchbase.com/resources/security#SecurityAlerts; https://www.couchbase.com/downloads
CVE: CVE-2021-31158
Published: 2021-05-19
Description: In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://www.couchbase.com/resources/security#SecurityAlerts; https://docs.couchbase.com/server/current/release-notes/relnotes.html
CVE: CVE-2020-4646
Published: 2021-05-19
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5, 6.0.0.0 through 6.0.3.3, and 6.1.0.0 through 6.1.0.2 could allow an authenticated user to view pages they shoiuld not have access to due to improper authorization control.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185808; https://www.ibm.com/support/pages/node/6454169; https://exchange.xforce.ibmcloud.com/vulnerabilities/185808