deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20988
Published: 2021-05-13
Description: In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. This may lead to a denial of service of the affected device.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-119
References: https://cert.vde.com/de-de/advisories/vde-2021-018; https://kb.hilscher.com/display/ISMS/2019-04-10+Wrong+handling+of+the+UDP+checksum; https://cert.vde.com/de-de/advisories/vde-2021-018
CVE: CVE-2021-20993
Published: 2021-05-13
Description: In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://cert.vde.com/en-us/advisories/vde-2021-013; https://cert.vde.com/en-us/advisories/vde-2021-013
CVE: CVE-2021-20994
Published: 2021-05-13
Description: In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://cert.vde.com/en-us/advisories/vde-2021-013; https://cert.vde.com/en-us/advisories/vde-2021-013
CVE: CVE-2021-20995
Published: 2021-05-13
Description: In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://cert.vde.com/en-us/advisories/vde-2021-013; https://cert.vde.com/en-us/advisories/vde-2021-013
CVE: CVE-2021-20996
Published: 2021-05-13
Description: In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://cert.vde.com/en-us/advisories/vde-2021-013; https://cert.vde.com/en-us/advisories/vde-2021-013
CVE: CVE-2021-20997
Published: 2021-05-13
Description: In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://cert.vde.com/en-us/advisories/vde-2021-013; https://cert.vde.com/en-us/advisories/vde-2021-013
CVE: CVE-2021-20998
Published: 2021-05-13
Description: In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://cert.vde.com/en-us/advisories/vde-2021-013; https://cert.vde.com/en-us/advisories/vde-2021-013
CVE: CVE-2021-20999
Published: 2021-05-13
Description: In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operation may be stopped.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-668
References: https://cert.vde.com/en-us/advisories/vde-2021-016; https://cert.vde.com/en-us/advisories/vde-2021-016
CVE: CVE-2021-25693
Published: 2021-05-13
Description: An attacker may cause a Denial of Service (DoS) in multiple versions of Teradici PCoIP Agent via a null pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://advisory.teradici.com/security-advisories/79/; https://advisory.teradici.com/security-advisories/79/
CVE: CVE-2020-20092
Published: 2021-05-13
Description: File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and placing PHP code after the JPEG data, which could let a remote malicious user execute arbitrary PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/woider/ArticleCMS/issues/8; https://github.com/woider/ArticleCMS/issues/8
CVE: CVE-2020-21342
Published: 2021-05-13
Description: Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://github.com/Ksharp12138/zzcms/issues/1; https://github.com/Ksharp12138/zzcms/issues/1
CVE: CVE-2020-25713
Published: 2021-05-13
Description: A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-125
References: http://www.openwall.com/lists/oss-security/2020/11/16/1; https://bugs.librdf.org/mantis/view.php?id=650; https://bugzilla.redhat.com/show_bug.cgi?id=1900685
CVE: CVE-2020-27823
Published: 2021-05-13
Description: A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-120, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1905762; https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/
CVE: CVE-2020-27830
Published: 2021-05-13
Description: A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2020/12/08/1; http://www.openwall.com/lists/oss-security/2020/12/08/4; https://bugzilla.redhat.com/show_bug.cgi?id=1919900
CVE: CVE-2020-28063
Published: 2021-05-13
Description: A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/woider/ArticleCMS/issues/8; https://github.com/woider/ArticleCMS/issues/8
CVE: CVE-2021-20025
Published: 2021-05-13
Description: SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this transitional/temporary user account from the trusted domain to access the Virtual Appliance remotely only when the device is freshly installed and not connected to Mysonicwall.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0012
CVE: CVE-2021-3528
Published: 2021-05-13
Description: A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522, CWE-532
References: https://bugzilla.redhat.com/show_bug.cgi?id=1955601; https://bugzilla.redhat.com/show_bug.cgi?id=1955601
CVE: CVE-2021-20181
Published: 2021-05-13
Description: A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-367, CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=1927007; https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2021-20221
Published: 2021-05-13
Description: An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://www.openwall.com/lists/oss-security/2021/02/05/1; https://bugzilla.redhat.com/show_bug.cgi?id=1924601; https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html
CVE: CVE-2021-20535
Published: 2021-05-13
Description: IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198834.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198834; https://www.ibm.com/support/pages/node/6452323; https://exchange.xforce.ibmcloud.com/vulnerabilities/198834
CVE: CVE-2021-21424
Published: 2021-05-13
Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-203
References: https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011; https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68; https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html
CVE: CVE-2021-32917
Published: 2021-05-13
Description: An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2021/05/13/1; http://www.openwall.com/lists/oss-security/2021/05/14/2; https://blog.prosody.im/prosody-0.11.9-released/
CVE: CVE-2021-32918
Published: 2021-05-13
Description: An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2021/05/13/1; http://www.openwall.com/lists/oss-security/2021/05/14/2; https://blog.prosody.im/prosody-0.11.9-released/
CVE: CVE-2021-32919
Published: 2021-05-13
Description: An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another server (when this option is enabled).
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2021/05/13/1; http://www.openwall.com/lists/oss-security/2021/05/14/2; https://blog.prosody.im/prosody-0.11.9-released/
CVE: CVE-2021-32920
Published: 2021-05-13
Description: Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2021/05/13/1; http://www.openwall.com/lists/oss-security/2021/05/14/2; https://blog.prosody.im/prosody-0.11.9-released/
CVE: CVE-2021-32921
Published: 2021-05-13
Description: An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2021/05/13/1; http://www.openwall.com/lists/oss-security/2021/05/14/2; https://blog.prosody.im/prosody-0.11.9-released/
CVE: CVE-2021-29623
Published: 2021-05-13
Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4.
CVSS Score: 3.6 (LOW)
CWE: CWE-908, CWE-908
References: https://github.com/Exiv2/exiv2/pull/1627; https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/
CVE: CVE-2021-22135
Published: 2021-05-13
Description: Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125
CVE: CVE-2021-22136
Published: 2021-05-13
Description: In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session from timing out.
CVSS Score: 3.5 (LOW)
CWE: CWE-613, CWE-613
References: https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125; https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125
CVE: CVE-2021-22137
Published: 2021-05-13
Description: In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-281
References: https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125
CVE: CVE-2021-22138
Published: 2021-05-13
Description: In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in the middle style attack against the Logstash monitoring data.
CVSS Score: 3.7 (LOW)
CWE: CWE-295, CWE-295
References: https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125
CVE: CVE-2021-22139
Published: 2021-05-13
Description: Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://discuss.elastic.co/t/7-12-1-security-update/271433; https://discuss.elastic.co/t/7-12-1-security-update/271433
CVE: CVE-2021-22140
Published: 2021-05-13
Description: Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://discuss.elastic.co/t/7-12-1-security-update/271433; https://discuss.elastic.co/t/7-12-1-security-update/271433
CVE: CVE-2021-32925
Published: 2021-05-13
Description: admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/andrejspuler/writeups/blob/main/chamilo-lms/README.md#authenticated-rcelfi-in-user-import-via-xml-external-entity---cve-2021-32925; https://github.com/chamilo/chamilo-lms/commit/e71437c8de809044ba3ae1b181d70857c050a3e9; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-58-2021-05-12-High-impact-very-low-risk-LFIRCE-vulnerability-in-users-import
CVE: CVE-2021-23906
Published: 2021-05-13
Description: An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is not checked in the HiQnet Protocol, leading to remote code execution.
CVSS Score: 1.8 (LOW)
CWE: CWE-20
References: https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/; https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866
CVE: CVE-2021-23907
Published: 2021-05-13
Description: An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGet, GetAttributes, and MultiSvSet is not checked in the HiQnet Protocol, leading to remote code execution.
CVSS Score: 2.9 (LOW)
References: https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/; https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866
CVE: CVE-2021-23908
Published: 2021-05-13
Description: An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A type confusion issue affects MultiSvSetAttributes in the HiQnet Protocol, leading to remote code execution.
CVSS Score: 2.9 (LOW)
CWE: CWE-843
References: https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/; https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866
CVE: CVE-2021-23909
Published: 2021-05-13
Description: An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The SH2 MCU allows remote code execution.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787
References: https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/; https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866
CVE: CVE-2021-23910
Published: 2021-05-13
Description: An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. There is an out-of-bounds array access in RemoteDiagnosisApp.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://keenlab.tencent.com/en/2021/05/12/Tencent-Security-Keen-Lab-Experimental-Security-Assessment-on-Mercedes-Benz-Cars/; https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko.xhtml?oid=49946866
CVE: CVE-2021-27413
Published: 2021-05-13
Description: Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-131-01; https://www.zerodayinitiative.com/advisories/ZDI-21-588/; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-01
CVE: CVE-2021-29506
Published: 2021-05-13
Description: GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/graphhopper/graphhopper/commit/eb189be1fa7443ebf4ae881e737a18f818c95f41; https://github.com/graphhopper/graphhopper/pull/2304; https://github.com/graphhopper/graphhopper/security/advisories/GHSA-hf44-3mx6-vhhw
CVE: CVE-2021-29510
Published: 2021-05-13
Description: Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
CVSS Score: 3.3 (LOW)
CWE: CWE-835
References: https://github.com/samuelcolvin/pydantic/commit/7e83fdd2563ffac081db7ecdf1affa65ef38c468; https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2HT266L6Q7H6ICP7DFGXOGBJHNNKMKB/
CVE: CVE-2020-23995
Published: 2021-05-13
Description: An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: https://cwe.mitre.org/data/definitions/209.html; https://docu.ilias.de/goto_docu_pg_118817_35.html; https://docu.ilias.de/goto_docu_pg_122177_35.html