deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-7390
Published: 2021-07-22
Description: Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 (components shipped with Syracuse 12.10.0 and later) of Sage X3. Other on-premises versions of Sage X3 are unaffected or unsupported by the vendor.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed; https://www.sagecity.com/gb/sage-x3-uk/f/sage-x3-uk-announcements-news-and-alerts/147993/sage-x3-latest-patches; https://www.rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities/
CVE: CVE-2021-25210
Published: 2021-07-22
Description: Arbitrary file upload vulnerability in SourceCodester Alumni Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to manage_event.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/BigTiger2020/Alumni-Management-System/blob/main/Alumni%20Management%20System-file%20upload.md; https://github.com/BigTiger2020/Alumni-Management-System/blob/main/Alumni%20Management%20System-file%20upload.md
CVE: CVE-2021-25212
Published: 2021-07-22
Description: SQL injection vulnerability in SourceCodester Alumni Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to manage_event.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/Alumni-Management-System/blob/main/Alumni%20Management%20System-sql.md; https://github.com/BigTiger2020/Alumni-Management-System/blob/main/Alumni%20Management%20System-sql.md
CVE: CVE-2021-26223
Published: 2021-07-22
Description: SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to view_pay.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/CASAP-Automated-Enrollment-System/blob/main/CASAP-Automated-Enrollment-System-3.md; https://github.com/BigTiger2020/CASAP-Automated-Enrollment-System/blob/main/CASAP-Automated-Enrollment-System-3.md
CVE: CVE-2021-26224
Published: 2021-07-22
Description: Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/BigTiger2020/Fantastic-Blog-CMS-/blob/main/Fantastic-Blog-CMS-2.md; https://github.com/BigTiger2020/Fantastic-Blog-CMS-/blob/main/Fantastic-Blog-CMS-2.md
CVE: CVE-2021-27332
Published: 2021-07-22
Description: Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://casap.com; https://github.com/BigTiger2020/CASAP-Automated-Enrollment-System/blob/main/CASAP-Automated-Enrollment-System-6.md; http://casap.com
CVE: CVE-2021-31579
Published: 2021-07-22
Description: Akkadian Provisioning Manager Engine (PME) ships with a hard-coded credential, akkadianuser:haakkadianpassword. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).
CVSS Score: 8.2 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/; https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/
CVE: CVE-2021-31580
Published: 2021-07-22
Description: The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be bypassed by switching the OpenSSH channel from `shell` to `exec` and providing the ssh client a single execution parameter. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).
CVSS Score: 8.7 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/; https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/
CVE: CVE-2021-31581
Published: 2021-07-22
Description: The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).
CVSS Score: 7.9 (HIGH)
CWE: CWE-269, CWE-312
References: https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/; https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/
CVE: CVE-2021-3619
Published: 2021-07-22
Description: Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to Velociraptor is nearly always reserved for trusted and verified users with IT security backgrounds.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Velocidex/velociraptor/pull/1118; https://github.com/Velocidex/velociraptor/releases/tag/v0.6.0; https://github.com/Velocidex/velociraptor/pull/1118
CVE: CVE-2021-3198
Published: 2021-07-22
Description: By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/; https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/
CVE: CVE-2021-3540
Published: 2021-07-22
Description: By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-88, CWE-88
References: https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/; https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/
CVE: CVE-2020-22283
Published: 2021-07-22
Description: A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head allows attackers to access sensitive information via a crafted ICMPv6 packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://lists.debian.org/debian-lts-announce/2023/11/msg00011.html; https://savannah.nongnu.org/bugs/index.php?58553; https://lists.debian.org/debian-lts-announce/2023/11/msg00011.html
CVE: CVE-2020-22284
Published: 2021-07-22
Description: A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2 allows attackers to access sensitive information via a crafted 6LoWPAN packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://savannah.nongnu.org/bugs/index.php?58554; https://savannah.nongnu.org/bugs/index.php?58554
CVE: CVE-2021-25205
Published: 2021-07-22
Description: SQL injection vulnerability in SourceCodester E-Commerce Website V 1.0 allows remote attackers to execute arbitrary SQL statements, via the update parameter to empViewUpdate.php .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/E-Commerce-Website/blob/main/E-Commerce%20Website-sql.md; https://github.com/BigTiger2020/E-Commerce-Website/blob/main/E-Commerce%20Website-sql.md
CVE: CVE-2021-25209
Published: 2021-07-22
Description: SQL injection vulnerability in SourceCodester Theme Park Ticketing System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to view_user.php .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/Theme-Park-Ticketing-System/blob/main/Theme%20Park%20Ticketing%20System.md; https://github.com/BigTiger2020/Theme-Park-Ticketing-System/blob/main/Theme%20Park%20Ticketing%20System.md
CVE: CVE-2021-25211
Published: 2021-07-22
Description: Arbitrary file upload vulnerability in SourceCodester Ordering System v 1.0 allows attackers to execute arbitrary code, via the file upload to ordering\admin\products\edit.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/BigTiger2020/Ordering-System/blob/main/Ordering%20System.md; https://github.com/BigTiger2020/Ordering-System/blob/main/Ordering%20System.md
CVE: CVE-2021-25213
Published: 2021-07-22
Description: SQL injection vulnerability in SourceCodester Travel Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the catid parameter to subcat.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/BigTiger2020/Travel-Management-System/blob/main/Travel%20Management%20System-sql.md; https://github.com/BigTiger2020/Travel-Management-System/blob/main/Travel%20Management%20System-sql.md
CVE: CVE-2021-34259
Published: 2021-07-22
Description: A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://github.com/STMicroelectronics/STM32CubeH7/issues/76; https://github.com/STMicroelectronics/STM32CubeH7/issues/76
CVE: CVE-2021-34260
Published: 2021-07-22
Description: A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://github.com/STMicroelectronics/STM32CubeH7/issues/83; https://github.com/STMicroelectronics/STM32CubeH7/issues/83
CVE: CVE-2021-34261
Published: 2021-07-22
Description: An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to set a remote wake-up feature.
CVSS Score: 4.6 (MEDIUM)
References: https://github.com/STMicroelectronics/STM32CubeH7/issues/78; https://github.com/STMicroelectronics/STM32CubeH7/issues/78
CVE: CVE-2021-34262
Published: 2021-07-22
Description: A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://github.com/STMicroelectronics/STM32CubeH7/issues/81; https://github.com/STMicroelectronics/STM32CubeH7/issues/81
CVE: CVE-2021-34267
Published: 2021-07-22
Description: An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) when the system tries to communicate with the connected endpoint.
CVSS Score: 4.6 (MEDIUM)
References: https://github.com/STMicroelectronics/STM32CubeH7/issues/80; https://github.com/STMicroelectronics/STM32CubeH7/issues/80
CVE: CVE-2021-34268
Published: 2021-07-22
Description: An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) via a malformed USB device packet.
CVSS Score: 4.6 (MEDIUM)
References: https://github.com/STMicroelectronics/STM32CubeH7/issues/75; https://github.com/STMicroelectronics/STM32CubeH7/issues/75
CVE: CVE-2021-32785
Published: 2021-07-22
Description: mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-134, CWE-134
References: https://github.com/zmartzone/mod_auth_openidc/commit/dc672688dc1f2db7df8ad4abebc367116017a449; https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9; https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-55r8-6w97-xxr4
CVE: CVE-2021-32786
Published: 2021-07-22
Description: mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://daniel.haxx.se/blog/2017/01/30/one-url-standard-please/; https://github.com/zmartzone/mod_auth_openidc/commit/3a115484eb927bc6daa5737dd84f88ff4bbc5544; https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9
CVE: CVE-2021-24036
Published: 2021-07-23
Description: Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-190
References: https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3; https://hhvm.com/blog/2021/07/20/security-update.html; https://www.facebook.com/security/advisories/cve-2021-24036
CVE: CVE-2020-14032
Published: 2021-07-23
Description: ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://dannyodler.medium.com/attacking-the-golden-ring-on-amd-mini-pc-b7bfb217b437; https://www.asrock.com/support/index.us.asp?cat=BIOS; https://dannyodler.medium.com/attacking-the-golden-ring-on-amd-mini-pc-b7bfb217b437
CVE: CVE-2021-26799
Published: 2021-07-23
Description: Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/omeka/Omeka/commit/08bfdf470e234edb68e5307a2fef8c899d89256c; https://github.com/omeka/Omeka/issues/935; https://github.com/omeka/Omeka/commit/08bfdf470e234edb68e5307a2fef8c899d89256c
CVE: CVE-2021-20333
Published: 2021-07-23
Description: Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.10.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-117, CWE-116
References: https://jira.mongodb.org/browse/SERVER-50605; https://jira.mongodb.org/browse/SERVER-50605
CVE: CVE-2019-9983
Published: 2021-07-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2021-25207
Published: 2021-07-23
Description: Arbitrary file upload vulnerability in SourceCodester E-Commerce Website v 1.0 allows attackers to execute arbitrary code via the file upload to prodViewUpdate.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/BigTiger2020/E-Commerce-Website/blob/main/E-Commerce%20Website%20-upload.md; https://github.com/BigTiger2020/E-Commerce-Website/blob/main/E-Commerce%20Website%20-upload.md
CVE: CVE-2021-25201
Published: 2021-07-23
Description: SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id parameter to obtain sensitive database information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/TCSWT/Learning-Management-System/blob/main/README.md; https://github.com/TCSWT/Learning-Management-System/blob/main/README.md
CVE: CVE-2021-25203
Published: 2021-07-23
Description: Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_add_post.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/TCSWT/Victor-CMS/blob/main/README.md; https://github.com/TCSWT/Victor-CMS/blob/main/README.md
CVE: CVE-2021-25204
Published: 2021-07-23
Description: Cross-site scripting (XSS) vulnerability in SourceCodester E-Commerce Website v 1.0 allows remote attackers to inject arbitrary web script or HTM via the subject field to feedback_process.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/BigTiger2020/E-Commerce-Website/blob/main/E-Commerce%20Website-xss.md; https://github.com/BigTiger2020/E-Commerce-Website/blob/main/E-Commerce%20Website-xss.md
CVE: CVE-2021-25206
Published: 2021-07-23
Description: Arbitrary file upload vulnerability in SourceCodester Responsive Ordering System v 1.0 allows attackers to execute arbitrary code via the file upload to Product_model.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/BigTiger2020/Responsive-Ordering-System/blob/main/Responsive%20Ordering%20System.md; https://github.com/BigTiger2020/Responsive-Ordering-System/blob/main/Responsive%20Ordering%20System.md
CVE: CVE-2021-25208
Published: 2021-07-23
Description: Arbitrary file upload vulnerability in SourceCodester Travel Management System v 1.0 allows attackers to execute arbitrary code via the file upload to updatepackage.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/BigTiger2020/Travel-Management-System/blob/main/Travel%20Management%20System.md; https://github.com/BigTiger2020/Travel-Management-System/blob/main/Travel%20Management%20System.md
CVE: CVE-2021-3159
Published: 2021-07-23
Description: A stored cross site scripting (XSS) vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG, SHTML, or MHT file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/fa1c0n1/m01e-wiki/blob/main/my-vulns/landray-ekp.md; https://github.com/fa1c0n1/m01e-wiki/blob/main/my-vulns/landray-ekp.md
CVE: CVE-2021-23412
Published: 2021-07-23
Description: All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://hackerone.com/reports/808942; https://snyk.io/vuln/SNYK-JS-GITLOGPLUS-1315832; https://www.npmjs.com/package/gitlogplus
CVE: CVE-2021-25790
Published: 2021-07-23
Description: Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49352; https://www.sourcecodester.com; https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html
CVE: CVE-2021-25791
Published: 2021-07-23
Description: Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49396; https://www.sourcecodester.com; https://www.sourcecodester.com/php/14663/online-doctor-appointment-system-php-full-source-code.html
CVE: CVE-2020-20741
Published: 2021-07-23
Description: Incorrect Access Control in Beckhoff Automation GmbH & Co. KG CX9020 with firmware version CX9020_CB3011_WEC7_HPS_v602_TC31_B4016.6 allows remote attackers to bypass authentication via the "CE Remote Display Tool" as it does not close the incoming connection on the Windows CE side if the credentials are incorrect.
CVSS Score: 9.8 (CRITICAL)
References: https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-006.pdf; https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-006.pdf
CVE: CVE-2021-25808
Published: 2021-07-23
Description: A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://github.com/bludit/bludit/issues/1298; https://github.com/bludit/bludit/issues/1298
CVE: CVE-2021-25809
Published: 2021-07-23
Description: UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/Gingsguard/ucms/blob/main/UCMS%20v.1.5.0%20Information%20leakage.md; https://github.com/Gingsguard/ucms/blob/main/UCMS%20v.1.5.0%20Information%20leakage.md
CVE: CVE-2021-3169
Published: 2021-07-23
Description: An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://blog.fit2cloud.com/?p=1764; https://mp.weixin.qq.com/s/5tgcaIrnDnGP-LvWPw9YCg; https://s.tencent.com/research/bsafe/1228.html