deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-23888
Published: 2021-11-10
Description: A User Mode Write AV in Editor!TMethodImplementationIntercept+0x53f6c3 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted psd file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/psd_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/psd_file_format.md
CVE: CVE-2020-23889
Published: 2021-11-10
Description: A User Mode Write AV starting at Editor!TMethodImplementationIntercept+0x4189c6 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted ico file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/ico_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/ico_file_format.md
CVE: CVE-2020-23890
Published: 2021-11-10
Description: A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted JPG file. Related to Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at JPGCodec+0x753648.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/jpg_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/jpg_file_format.md
CVE: CVE-2020-23891
Published: 2021-11-10
Description: A User Mode Write AV in Editor+0x5cd7 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md
CVE: CVE-2020-23893
Published: 2021-11-10
Description: A User Mode Write AV in Editor!TMethodImplementationIntercept+0x3c3682 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md
CVE: CVE-2020-23894
Published: 2021-11-10
Description: A User Mode Write AV in ntdll!RtlpCoalesceFreeBlocks+0x268 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md
CVE: CVE-2020-23895
Published: 2021-11-10
Description: A User Mode Write AV in Editor+0x76af of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md
CVE: CVE-2020-23896
Published: 2021-11-10
Description: A User Mode Write AV in Editor+0x576b of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tiff_file_format.md
CVE: CVE-2020-23897
Published: 2021-11-10
Description: A User Mode Write AV in Editor!TMethodImplementationIntercept+0x54dcec of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md
CVE: CVE-2020-23898
Published: 2021-11-10
Description: A User Mode Write AV in Editor+0x5ea2 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md
CVE: CVE-2020-23899
Published: 2021-11-10
Description: A User Mode Write AV in Editor+0x5f91 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md
CVE: CVE-2020-23900
Published: 2021-11-10
Description: A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. Related to Data from Faulting Address controls Code Flow starting at Editor!TMethodImplementationIntercept+0x57a3b.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md
CVE: CVE-2020-23901
Published: 2021-11-10
Description: A User Mode Write AV in Editor+0x5d15 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md
CVE: CVE-2020-23902
Published: 2021-11-10
Description: A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. Related to Data from Faulting Address may be used as a return value starting at Editor!TMethodImplementationIntercept+0x528a3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md; https://www.wildbit-soft.fi/software.html; https://github.com/Aurorainfinity/vulnerabilities/blob/master/WildBit_Viewer/tga_file_format.md
CVE: CVE-2020-23903
Published: 2021-11-10
Description: A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/xiph/speex/issues/13; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXCRAYNW5ESCE2PIGTUXZNZHNYFLJ6PX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3SEV2ZRR47GSD3M7O5PH4XEJMKJJNG2/
CVE: CVE-2020-23904
Published: 2021-11-10
Description: A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file. NOTE: the vendor states "I cannot reproduce it" and it "is a demo program.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/xiph/speex/issues/14; https://github.com/xiph/speex/issues/14
CVE: CVE-2020-23906
Published: 2021-11-10
Description: FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of data authenticity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-345
References: https://trac.ffmpeg.org/ticket/8782; https://trac.ffmpeg.org/ticket/8782
CVE: CVE-2021-33618
Published: 2021-11-10
Description: Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2021/Nov/38; https://github.com/Dolibarr/dolibarr/releases; https://trovent.github.io/security-advisories/TRSA-2105-02/TRSA-2105-02.txt
CVE: CVE-2021-33816
Published: 2021-11-10
Description: The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2021/Nov/39; https://trovent.github.io/security-advisories/TRSA-2106-01/TRSA-2106-01.txt; https://trovent.io/security-advisory-2106-01
CVE: CVE-2021-40871
Published: 2021-11-10
Description: An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66. Remote attackers to cause a denial of service (DoS) by sending crafted messages to a OPC/UA client. The client process may crash unexpectedly because of a wrong type cast, and must be restarted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://industrial.softing.com/; https://industrial.softing.com/fileadmin/sof-files/pdf/ia/support/Security_Bulletin-CVE-2021-40871.pdf; https://industrial.softing.com/
CVE: CVE-2021-40872
Published: 2021-11-10
Description: An issue was discovered in Softing Industrial Automation uaToolkit Embedded before 1.40. Remote attackers to cause a denial of service (DoS) or login as an anonymous user (bypassing security checks) by sending crafted messages to a OPC/UA server. The server process may crash unexpectedly because of an invalid type cast, and must be restarted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://industrial.softing.com/; https://industrial.softing.com/fileadmin/sof-files/pdf/ia/support/Security_Bulletin_CVE-2021-40872.pdf; https://industrial.softing.com/
CVE: CVE-2021-40873
Published: 2021-11-10
Description: An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66, and uaToolkit Embedded before 1.40. Remote attackers to cause a denial of service (DoS) by sending crafted messages to a client or server. The server process may crash unexpectedly because of a double free, and must be restarted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://industrial.softing.com/; https://industrial.softing.com/fileadmin/sof-files/pdf/ia/support/Security_Bulletin_CVE-2021-40873.pdf; https://industrial.softing.com/
CVE: CVE-2021-43573
Published: 2021-11-11
Description: A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10. It exists in the client code when processing a malformed IE length of HT capability information in the Beacon and Association response frame.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.amebaiot.com/en/security_bulletin/cve-2021-43573/; https://www.amebaiot.com/en/security_bulletin/cve-2021-43573/
CVE: CVE-2021-41080
Published: 2021-11-11
Description: Zoho ManageEngine Network Configuration Manager before ﻿﻿125465 is vulnerable to SQL Injection in a hardware details search.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.manageengine.com/network-configuration-manager/security-updates/cve-2021-41080.html; https://www.manageengine.com/network-configuration-manager/security-updates/cve-2021-41080.html
CVE: CVE-2021-41081
Published: 2021-11-11
Description: Zoho ManageEngine Network Configuration Manager before ﻿﻿125465 is vulnerable to SQL Injection in a configuration search.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.manageengine.com/network-configuration-manager/security-updates/cve-2021-41081.html; https://www.manageengine.com/network-configuration-manager/security-updates/cve-2021-41081.html
CVE: CVE-2021-41833
Published: 2021-11-11
Description: Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://pitstop.manageengine.com/portal/en/community/topic/unauthenticated-remote-code-execution-vulnerability-solved; https://www.manageengine.com/sccm-third-party-patch-management/kb/unauthenticated-remote-code-execution.html; https://pitstop.manageengine.com/portal/en/community/topic/unauthenticated-remote-code-execution-vulnerability-solved
CVE: CVE-2021-42002
Published: 2021-11-11
Description: Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://www.manageengine.com/products/ad-manager/release-notes.html#7115; https://www.manageengine.com/products/ad-manager/release-notes.html#7115
CVE: CVE-2021-42847
Published: 2021-11-11
Description: Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/172258/ManageEngine-ADAudit-Plus-Remote-Code-Execution.html; https://pitstop.manageengine.com/portal/en/community/topic/fix-released-for-a-vulnerability-in-manageengine-adaudit-plus; http://packetstormsecurity.com/files/172258/ManageEngine-ADAudit-Plus-Remote-Code-Execution.html
CVE: CVE-2021-43397
Published: 2021-11-11
Description: LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://packetstormsecurity.com/files/164997/LiquidFiles-3.5.13-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2021/Nov/40; http://seclists.org/fulldisclosure/2021/Nov/52
CVE: CVE-2021-25980
Published: 2021-11-11
Description: In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-74
References: https://github.com/debiki/talkyard/commit/4067e191a909ed06f250d09a40e43aa5edbb0289; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25980; https://github.com/debiki/talkyard/commit/4067e191a909ed06f250d09a40e43aa5edbb0289
CVE: CVE-2021-26558
Published: 2021-11-11
Description: Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.openwall.com/lists/oss-security/2021/11/11/1; https://lists.apache.org/thread/4gzkm1zb6c97v9gl8lcz8ll5xr8o484c; http://www.openwall.com/lists/oss-security/2021/11/11/1
CVE: CVE-2021-43350
Published: 2021-11-11
Description: An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-90, CWE-74
References: http://www.openwall.com/lists/oss-security/2021/11/11/3; http://www.openwall.com/lists/oss-security/2021/11/11/4; http://www.openwall.com/lists/oss-security/2021/11/17/1
CVE: CVE-2002-20001
Published: 2021-11-11
Description: The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://dheatattack.com; https://dheatattack.gitlab.io/
CVE: CVE-2021-3907
Published: 2021-11-11
Description: OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-22, CWE-22
References: https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959; https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh; https://www.debian.org/security/2021/dsa-5033
CVE: CVE-2021-3908
Published: 2021-11-11
Description: OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400, CWE-835
References: https://github.com/cloudflare/cfrpki/security/advisories/GHSA-g5gj-9ggf-9vmq; https://www.debian.org/security/2022/dsa-5041; https://github.com/cloudflare/cfrpki/security/advisories/GHSA-g5gj-9ggf-9vmq
CVE: CVE-2021-3909
Published: 2021-11-11
Description: OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/cloudflare/cfrpki/security/advisories/GHSA-8cvr-4rrf-f244; https://www.debian.org/security/2021/dsa-5033; https://www.debian.org/security/2022/dsa-5041
CVE: CVE-2021-3910
Published: 2021-11-11
Description: OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/cloudflare/cfrpki/security/advisories/GHSA-5mxh-2qfv-4g7j; https://www.debian.org/security/2022/dsa-5041; https://github.com/cloudflare/cfrpki/security/advisories/GHSA-5mxh-2qfv-4g7j
CVE: CVE-2021-3911
Published: 2021-11-11
Description: If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-20, CWE-252
References: https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22; https://www.debian.org/security/2022/dsa-5041; https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22
CVE: CVE-2021-3912
Published: 2021-11-11
Description: OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/cloudflare/cfrpki/security/advisories/GHSA-g9wh-3vrx-r7hg; https://www.debian.org/security/2022/dsa-5041; https://github.com/cloudflare/cfrpki/security/advisories/GHSA-g9wh-3vrx-r7hg
CVE: CVE-2021-34417
Published: 2021-11-11
Description: The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6[PII_REDACTED]3, Zoom On-Premise Meeting Connector MMR before version 4.6[PII_REDACTED]3, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6[PII_REDACTED]3, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5[PII_REDACTED]3 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.
CVSS Score: 7.9 (HIGH)
CWE: CWE-20
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2021-34418
Published: 2021-11-11
Description: The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6[PII_REDACTED]3, Zoom On-Premise Meeting Connector MMR before version 4.6[PII_REDACTED]3, Zoom On-Premise Recording Connector before version 3.8.42.20200905, Zoom On-Premise Virtual Room Connector before version 4.4.6[PII_REDACTED]2, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5[PII_REDACTED]6 fails to validate that a NULL byte was sent while authenticating. This could lead to a crash of the login service.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-476
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2021-34419
Published: 2021-11-11
Description: In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control request to a user in the process of in-meeting screen sharing. This could allow meeting participants to be targeted for social engineering attacks.
CVSS Score: 3.7 (LOW)
CWE: CWE-74
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2021-34420
Published: 2021-11-11
Description: The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer’s computer.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-347
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://medium.com/manomano-tech/a-red-team-operation-leveraging-a-zero-day-vulnerability-in-zoom-80f57fb0822e; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2021-34421
Published: 2021-11-11
Description: The Keybase Client for Android before version 5.8.0 and the Keybase Client for iOS before version 5.8.0 fails to properly remove exploded messages initiated by a user if the receiving user places the chat session in the background while the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from the customer's device.
CVSS Score: 3.7 (LOW)
CWE: CWE-459
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2021-34422
Published: 2021-11-11
Description: The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name which could allow a user to execute an application which was not intended on their host machine. If a malicious user leveraged this issue with the public folder sharing feature of the Keybase client, this could lead to remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin