deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-19107
Published: 2021-05-06
Description: SQL Injection vulnerability in Online Book Store v1.0 via the isbn parameter to edit_book.php, which could let a remote malicious user execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/9; https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/9
CVE: CVE-2020-19108
Published: 2021-05-06
Description: SQL Injection vulnerability in Online Book Store v1.0 via the pubid parameter to bookPerPub.php, which could let a remote malicious user execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/10; https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/10
CVE: CVE-2020-19109
Published: 2021-05-06
Description: SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_edit.php, which could let a remote malicious user execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/12; https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/12
CVE: CVE-2020-19110
Published: 2021-05-06
Description: SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to book.php parameter, which could let a remote malicious user execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/11; https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/11
CVE: CVE-2020-19111
Published: 2021-05-06
Description: Incorrect Access Control vulnerability in Online Book Store v1.0 via admin_verify.php, which could let a remote mailicious user bypass authentication and obtain sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://cwe.mitre.org/data/definitions/287.html; https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/14; https://cwe.mitre.org/data/definitions/287.html
CVE: CVE-2020-19112
Published: 2021-05-06
Description: SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_delete.php, which could let a remote malicious user execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/13; https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/13
CVE: CVE-2020-19113
Published: 2021-05-06
Description: Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php, which may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/15; https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/15
CVE: CVE-2020-19114
Published: 2021-05-06
Description: SQL Injection vulnerability in Online Book Store v1.0 via the publisher parameter to edit_book.php, which could let a remote malicious user execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/8; https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/8
CVE: CVE-2020-23127
Published: 2021-05-06
Description: Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-41-2020-04-22-Medium-risk-high-impact-CSRF-and-privilege-escalation-via-CSRF; https://toandak.blogspot.com/2020/05/csrf-vulnerbility-in-chamilo-lms.html; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-41-2020-04-22-Medium-risk-high-impact-CSRF-and-privilege-escalation-via-CSRF
CVE: CVE-2020-23128
Published: 2021-05-06
Description: Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-269
References: https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-41-2020-04-22-Medium-risk-high-impact-CSRF-and-privilege-escalation-via-CSRF; https://toandak.blogspot.com/2020/05/improper-privilege-management-in.html; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-41-2020-04-22-Medium-risk-high-impact-CSRF-and-privilege-escalation-via-CSRF
CVE: CVE-2020-28007
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28007-LFDIR.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28007-LFDIR.txt
CVE: CVE-2020-28008
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28008-SPDIR.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28008-SPDIR.txt
CVE: CVE-2020-28009
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days).
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28009-STDIN.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28009-STDIN.txt
CVE: CVE-2020-28010
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2021/07/22/7; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28010-SLCWD.txt; http://www.openwall.com/lists/oss-security/2021/07/22/7
CVE: CVE-2020-28011
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28011-SPRSS.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28011-SPRSS.txt
CVE: CVE-2020-28012
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag.
CVSS Score: 7.8 (HIGH)
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28012-CLOSE.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28012-CLOSE.txt
CVE: CVE-2020-28013
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28013-PFPSN.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28013-PFPSN.txt
CVE: CVE-2020-28014
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-269
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28014-PIDFP.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28014-PIDFP.txt
CVE: CVE-2020-28015
Published: 2021-05-06
Description: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character.
CVSS Score: 7.8 (HIGH)
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28015-NLEND.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28015-NLEND.txt
CVE: CVE-2020-28016
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28016-PFPZA.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28016-PFPZA.txt
CVE: CVE-2020-28017
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28017-RCPTL.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28017-RCPTL.txt
CVE: CVE-2020-28018
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2021/05/11/14; http://www.openwall.com/lists/oss-security/2021/05/11/15; http://www.openwall.com/lists/oss-security/2021/05/11/17
CVE: CVE-2020-28019
Published: 2021-05-06
Description: Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28019-BDATA.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28019-BDATA.txt
CVE: CVE-2020-28020
Published: 2021-05-06
Description: Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2021/07/25/1; http://www.openwall.com/lists/oss-security/2021/08/03/1; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28020-HSIZE.txt
CVE: CVE-2020-28021
Published: 2021-05-06
Description: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which indirectly leads to remote code execution as root) via AUTH= in a MAIL FROM command.
CVSS Score: 8.8 (HIGH)
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28021-MAUTH.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28021-MAUTH.txt
CVE: CVE-2020-28022
Published: 2021-05-06
Description: Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28022-EXOPT.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28022-EXOPT.txt
CVE: CVE-2020-28023
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from process memory to an unauthenticated SMTP client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28023-SCHAD.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28023-SCHAD.txt
CVE: CVE-2020-28024
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can actually push back non-character error codes such as EOF.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28024-UNGET.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28024-UNGET.txt
CVE: CVE-2020-28025
Published: 2021-05-06
Description: Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to a leak of sensitive information from process memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28025-BHASH.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28025-BHASH.txt
CVE: CVE-2020-28026
Published: 2021-05-06
Description: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root.
CVSS Score: 9.8 (CRITICAL)
References: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28026-FGETS.txt; https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28026-FGETS.txt
CVE: CVE-2021-1275
Published: 2021-05-06
Description: Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-vmanage-4TbynnhZ; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-vmanage-4TbynnhZ
CVE: CVE-2021-1284
Published: 2021-05-06
Description: A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authentication and authorization and modify the configuration of an affected system. To exploit this vulnerability, the attacker must be able to access an associated Cisco SD-WAN vEdge device. This vulnerability is due to insufficient authorization checks. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based messaging service interface of an affected system. A successful exploit could allow the attacker to gain unauthenticated read and write access to the affected vManage system. With this access, the attacker could access information about the affected vManage system, modify the configuration of the system, or make configuration changes to devices that are managed by the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdw-auth-bypass-65aYqcS2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdw-auth-bypass-65aYqcS2
CVE: CVE-2021-1363
Published: 2021-05-06
Description: Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM &amp; Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-inj-ereCOKjR; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-inj-ereCOKjR
CVE: CVE-2021-1365
Published: 2021-05-06
Description: Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM &amp; Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-inj-ereCOKjR; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-inj-ereCOKjR
CVE: CVE-2021-1397
Published: 2021-05-06
Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability is known as an open redirect attack, which is used in phishing attacks to get users to visit malicious sites without their knowledge.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imc-openred-zAYrU6d2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imc-openred-zAYrU6d2
CVE: CVE-2021-1400
Published: 2021-05-06
Description: Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://jvn.jp/en/jp/JVN71263107/index.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-multi-ZAfKGXhF; http://jvn.jp/en/jp/JVN71263107/index.html
CVE: CVE-2021-1401
Published: 2021-05-06
Description: Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-78
References: http://jvn.jp/en/jp/JVN71263107/index.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-multi-ZAfKGXhF; http://jvn.jp/en/jp/JVN71263107/index.html
CVE: CVE-2021-1421
Published: 2021-05-06
Description: A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to perform a command injection attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to a configuration command. An attacker could exploit this vulnerability by including malicious input during the execution of this command. A successful exploit could allow a non-privileged attacker authenticated in the restricted CLI to execute arbitrary commands on the underlying operating system (OS) with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-cmdinj-DkFjqg2j; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-cmdinj-DkFjqg2j
CVE: CVE-2021-1426
Published: 2021-05-06
Description: Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 7.0 (HIGH)
CWE: CWE-378, CWE-427
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-code-exec-jR3tWTA6; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-code-exec-jR3tWTA6
CVE: CVE-2021-1427
Published: 2021-05-06
Description: Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 7.0 (HIGH)
CWE: CWE-378, CWE-427
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-code-exec-jR3tWTA6; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-code-exec-jR3tWTA6
CVE: CVE-2021-1428
Published: 2021-05-06
Description: Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 7.0 (HIGH)
CWE: CWE-378, CWE-427
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-code-exec-jR3tWTA6; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-code-exec-jR3tWTA6