deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27036
Published: 2021-07-09
Description: A maliciously crafted PCX, PICT, RCL, TIF, BMP, PSD or TIFF file can be used to write beyond the allocated buffer while parsing PCX, PDF, PICT, RCL, BMP, PSD or TIFF files. This vulnerability can be exploited to execute arbitrary code
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2021-27037
Published: 2021-07-09
Description: A maliciously crafted PNG, PDF or DWF file in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by remote malicious actors to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2021-27038
Published: 2021-07-09
Description: A Type Confusion vulnerability in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can occur when processing a maliciously crafted PDF file. A malicious actor can leverage this to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2021-27039
Published: 2021-07-09
Description: A maliciously crafted TIFF and PCX file can be forced to read and write beyond allocated boundaries when parsing the TIFF and PCX file for based overflow. This vulnerability can be exploited to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2021-33012
Published: 2021-07-09
Description: Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause the PLC to fault when the controller is switched to RUN mode, which results in a denial-of-service condition. If successfully exploited, this vulnerability will cause the controller to fault whenever the controller is switched to RUN mode.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-189-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-189-01
CVE: CVE-2020-22535
Published: 2021-07-09
Description: Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://github.com/Pbootcms/Pbootcms/issues/5; https://github.com/Pbootcms/Pbootcms/issues/5
CVE: CVE-2020-21333
Published: 2021-07-09
Description: Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sanluan/PublicCMS/issues/27; https://github.com/sanluan/PublicCMS/issues/27
CVE: CVE-2021-29712
Published: 2021-07-09
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 200966.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200966; https://www.ibm.com/support/pages/node/6468581; https://exchange.xforce.ibmcloud.com/vulnerabilities/200966
CVE: CVE-2021-29730
Published: 2021-07-09
Description: IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 201164.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201164; https://www.ibm.com/support/pages/node/6468569; https://exchange.xforce.ibmcloud.com/vulnerabilities/201164
CVE: CVE-2021-3541
Published: 2021-07-09
Description: A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776
References: https://bugzilla.redhat.com/show_bug.cgi?id=1950515; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpujan2022.html
CVE: CVE-2021-33792
Published: 2021-07-09
Description: Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2021-33795
Published: 2021-07-09
Description: Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document owner, and signature author are mishandled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-29014
Published: 2021-07-09
Description: A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an authenticated attacker to bring the system into an unresponsive state via specifically orchestrated sequences of commands.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362
References: https://fortiguard.com/advisory/FG-IR-20-185; https://fortiguard.com/advisory/FG-IR-20-185
CVE: CVE-2021-22129
Published: 2021-07-09
Description: Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://fortiguard.com/advisory/FG-IR-21-023; https://fortiguard.com/advisory/FG-IR-21-023
CVE: CVE-2021-24007
Published: 2021-07-09
Description: Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fortiguard.com/advisory/FG-IR-21-012; https://fortiguard.com/advisory/FG-IR-21-012
CVE: CVE-2021-24020
Published: 2021-07-09
Description: A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://fortiguard.com/advisory/FG-IR-21-027; https://fortiguard.com/advisory/FG-IR-21-027
CVE: CVE-2021-26100
Published: 2021-07-09
Description: A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-347
References: https://fortiguard.com/advisory/FG-IR-21-003; https://fortiguard.com/advisory/FG-IR-21-003
CVE: CVE-2021-26106
Published: 2021-07-09
Description: An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/advisory/FG-IR-20-210; https://fortiguard.com/advisory/FG-IR-20-210
CVE: CVE-2021-32753
Published: 2021-07-09
Description: EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is created, the client_id and client_secret required to obtain an OAuth2 authentication token are set to the username of the proxy user. A remote network attacker can then perform a dictionary-based password attack on the OAuth2 token endpoint of the API gateway to obtain an OAuth2 authentication token and use that token to make authenticated calls to EdgeX microservices from an untrusted network. OAuth2 is the default authentication method in EdgeX Edinburgh release. The default authentication method was changed to JWT in Fuji and later releases. Users should upgrade to the EdgeX Ireland release to obtain the fix. The OAuth2 authentication method is disabled in Ireland release. If unable to upgrade and OAuth2 authentication is required, users should create OAuth2 users directly using the Kong admin API and forgo the use of the `security-proxy-setup` tool to create OAuth2 users.
CVSS Score: 8.3 (HIGH)
CWE: CWE-284, CWE-287, CWE-521, CWE-521
References: https://docs.konghq.com/hub/kong-inc/oauth2/#create-a-consumer; https://github.com/edgexfoundry/edgex-go/security/advisories/GHSA-xph4-vmcc-52gh; https://docs.konghq.com/hub/kong-inc/oauth2/#create-a-consumer
CVE: CVE-2021-33214
Published: 2021-07-09
Description: In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-276
References: https://cdn.hms-networks.com/docs/librariesprovider6/cybersecurity/hms-security-advisory-2021-07-09-001---ewon-ecatcher.pdf?sfvrsn=b37418d7_4; https://labs.bishopfox.com/advisories; https://labs.bishopfox.com/advisories/ecatcher-desktop-version-6.6.4
CVE: CVE-2021-36367
Published: 2021-07-09
Description: PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).
CVSS Score: 8.1 (HIGH)
CWE: CWE-345, CWE-345
References: https://git.tartarus.org/?p=simon/putty.git%3Ba=commit%3Bh=1dc5659aa62848f0aeb5de7bd3839fecc7debefa; https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html; https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
CVE: CVE-2021-36371
Published: 2021-07-09
Description: Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate authentication. The attacker must send an SNI specifying an unprotected backend and an HTTP Host header specifying a protected backend. (2.x versions are unaffected. 1.x versions are unaffected with certain configuration settings involving prune_unreachable_routes and a wildcard Host resource.)
CVSS Score: 3.7 (LOW)
CWE: CWE-295
References: https://github.com/emissary-ingress/emissary/issues/3340; https://github.com/emissary-ingress/emissary/releases/tag/v2.0.0-ea; https://github.com/emissary-ingress/emissary/issues/3340
CVE: CVE-2020-25391
Published: 2021-07-09
Description: A cross site scripting vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Pages' field under the 'Pages Content' module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/cszcms/tickets/1/; https://sourceforge.net/p/cszcms/tickets/1/
CVE: CVE-2020-25392
Published: 2021-07-09
Description: A cross site scripting (XSS) vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Article' field under the 'Article' plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/cszcms/tickets/2/; https://sourceforge.net/p/cszcms/tickets/2/
CVE: CVE-2020-25394
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in moziloCMS 2.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Content" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mozilo/mozilo2.0/issues/28; https://github.com/mozilo/mozilo2.0/issues/28
CVE: CVE-2020-25875
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payload entered into the 'Smiley Code' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://codoforum.com/; https://github.com/r0ck3t1973/xss_payload/issues/4; https://codoforum.com/
CVE: CVE-2020-25876
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payload entered into the 'Page Title' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://codoforum.com/; https://github.com/r0ck3t1973/xss_payload/issues/3; https://codoforum.com/
CVE: CVE-2020-25877
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in the 'Add Page' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blackcat-cms.org/; https://github.com/BlackCatDevelopment/BlackCatCMS/issues/401; https://blackcat-cms.org/
CVE: CVE-2020-25878
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in the 'Admin-Tools' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the 'Output Filters' and 'Droplets' modules.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://blackcat-cms.org/; https://github.com/BlackCatDevelopment/BlackCatCMS/issues/402; https://blackcat-cms.org/
CVE: CVE-2020-25879
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Username' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://codoforum.com/; https://github.com/r0ck3t1973/xss_payload/issues/5; https://codoforum.com/
CVE: CVE-2020-35984
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/r0ck3t1973/rukovoditel/issues/4; https://github.com/r0ck3t1973/rukovoditel/issues/4
CVE: CVE-2020-35985
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/r0ck3t1973/rukovoditel/issues/3; https://github.com/r0ck3t1973/rukovoditel/issues/3
CVE: CVE-2020-35986
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/r0ck3t1973/rukovoditel/issues/2; https://github.com/r0ck3t1973/rukovoditel/issues/2
CVE: CVE-2020-35987
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/r0ck3t1973/rukovoditel/issues/1; https://github.com/r0ck3t1973/rukovoditel/issues/1
CVE: CVE-2021-20024
Published: 2021-07-09
Description: Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or potentially read sensitive information from the memory locations.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0011; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0011
CVE: CVE-2021-35358
Published: 2021-07-09
Description: A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' and 'Filename' parameters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/dotCMS/core/issues/20540; https://github.com/dotCMS/core/issues/20540
CVE: CVE-2021-35360
Published: 2021-07-09
Description: A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/dotCMS/core/issues/20541; https://github.com/dotCMS/core/issues/20541
CVE: CVE-2021-35361
Published: 2021-07-09
Description: A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/dotCMS/core/issues/20541; https://github.com/dotCMS/core/issues/20541
CVE: CVE-2021-29106
Published: 2021-07-10
Description: A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/
CVE: CVE-2021-29107
Published: 2021-07-10
Description: A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/
CVE: CVE-2021-29102
Published: 2021-07-11
Description: A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/
CVE: CVE-2021-29103
Published: 2021-07-11
Description: A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/
CVE: CVE-2021-29104
Published: 2021-07-11
Description: A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/
CVE: CVE-2021-29105
Published: 2021-07-11
Description: A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/
CVE: CVE-2021-26099
Published: 2021-07-12
Description: Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphertext.
CVSS Score: 4.4 (MEDIUM)
References: https://fortiguard.com/advisory/FG-IR-20-244; https://fortiguard.com/advisory/FG-IR-20-244
CVE: CVE-2021-22515
Published: 2021-07-12
Description: Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-863
References: https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6341/data/advanced-authentication-releasenotes-6341.html; https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6341/data/advanced-authentication-releasenotes-6341.html
CVE: CVE-2021-22916
Published: 2021-07-12
Description: In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues DNS requests that used the system DNS settings instead of the extension's proxy settings, resulting in possible information disclosure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://hackerone.com/reports/1203842; https://hackerone.com/reports/1203842
CVE: CVE-2021-22917
Published: 2021-07-12
Description: Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if adblocking was enabled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://hackerone.com/reports/1077022; https://hackerone.com/reports/1077022