deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-35465
Published: 2021-08-23
Description: Certain Arm products before 2021-08-23 do not properly consider the effect of exceptions on a VLLDM instruction. A Non-secure handler may have read or write access to part of a Secure context. This affects Arm Cortex-M33 r0p0 through r1p0, Arm Cortex-M35P r0, Arm Cortex-M55 r0p0 through r1p0, and Arm China STAR-MC1 (in the STAR SE configuration).
CVSS Score: 3.4 (LOW)
References: https://developer.arm.com/support/arm-security-updates; https://developer.arm.com/support/arm-security-updates/vlldm-instruction-security-vulnerability; https://developer.arm.com/support/arm-security-updates
CVE: CVE-2021-3693
Published: 2021-08-23
Description: LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://huntr.dev/bounties/daf1384d-648a-43fd-9b35-5c37d8ead667; https://ledgersmb.org/cve-2021-3693-cross-site-scripting; https://www.debian.org/security/2021/dsa-4962
CVE: CVE-2021-3694
Published: 2021-08-23
Description: LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/ledgersmb/ledgersmb/commit/98fa476d46a4a7e5e9492ed69b4fa190be5547fc; https://huntr.dev/bounties/ef7f4cf7-3a81-4516-b261-f5b6ac21430c; https://ledgersmb.org/cve-2021-3694-cross-site-scripting
CVE: CVE-2021-3728
Published: 2021-08-23
Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/firefly-iii/firefly-iii/commit/14cdce113e0eb8090d09066fcd2b5cf03b5ac84e; https://huntr.dev/bounties/dd54c5a1-0d4a-4f02-a111-7ce4ddc67a4d; https://github.com/firefly-iii/firefly-iii/commit/14cdce113e0eb8090d09066fcd2b5cf03b5ac84e
CVE: CVE-2021-3729
Published: 2021-08-23
Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/firefly-iii/firefly-iii/commit/06d319cd71b7787aa919b3ba1ccf51e4ade67712; https://huntr.dev/bounties/d32f3d5a-0738-41ba-89de-34f2a772de76; https://github.com/firefly-iii/firefly-iii/commit/06d319cd71b7787aa919b3ba1ccf51e4ade67712
CVE: CVE-2021-3730
Published: 2021-08-23
Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/firefly-iii/firefly-iii/commit/f80178b1b2b7864d17500a131d570c353c9a26f6; https://huntr.dev/bounties/ea181323-51f8-46a2-a60f-6a401907feb7; https://github.com/firefly-iii/firefly-iii/commit/f80178b1b2b7864d17500a131d570c353c9a26f6
CVE: CVE-2021-3731
Published: 2021-08-23
Description: LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://huntr.dev/bounties/5664331d-f5f8-4412-8566-408f8655888a; https://ledgersmb.org/cve-2021-3731-clickjacking; https://www.debian.org/security/2021/dsa-4962
CVE: CVE-2021-29704
Published: 2021-08-23
Description: IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200660; https://www.ibm.com/support/pages/node/6482585; https://exchange.xforce.ibmcloud.com/vulnerabilities/200660
CVE: CVE-2021-29802
Published: 2021-08-23
Description: IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204059; https://www.ibm.com/support/pages/node/6482689; https://exchange.xforce.ibmcloud.com/vulnerabilities/204059
CVE: CVE-2021-39139
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434, CWE-502
References: https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39141
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434, CWE-502
References: https://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39144
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94, CWE-502, CWE-306, CWE-502
References: http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html; https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html
CVE: CVE-2021-39145
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434
References: https://github.com/x-stream/xstream/security/advisories/GHSA-8jrj-525p-826v; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39146
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434, CWE-502
References: https://github.com/x-stream/xstream/security/advisories/GHSA-p8pq-r894-fm8f; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39147
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434, CWE-502
References: https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39148
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434, CWE-502
References: https://github.com/x-stream/xstream/security/advisories/GHSA-qrx8-8545-4wg2; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39149
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434, CWE-502
References: https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39151
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434, CWE-502
References: https://github.com/x-stream/xstream/security/advisories/GHSA-hph2-m3g5-xxv4; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39153
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434, CWE-502
References: https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39154
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434, CWE-502, CWE-434, CWE-502
References: https://github.com/x-stream/xstream/security/advisories/GHSA-6w62-hx7r-mw68; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39140
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502, CWE-835, CWE-502, CWE-835
References: https://github.com/x-stream/xstream/security/advisories/GHSA-6wf9-jmg9-vxcc; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39150
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.
CVSS Score: 8.5 (HIGH)
CWE: CWE-502, CWE-918, CWE-502, CWE-918
References: https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-39152
Published: 2021-08-23
Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.
CVSS Score: 8.5 (HIGH)
CWE: CWE-502, CWE-918, CWE-502, CWE-918
References: https://github.com/x-stream/xstream/security/advisories/GHSA-xw4p-crpj-vjx2; https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
CVE: CVE-2021-22248
Published: 2021-08-23
Description: Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only
CVSS Score: 5.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22248.json; https://gitlab.com/gitlab-org/gitlab/-/issues/336074; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22248.json
CVE: CVE-2021-22249
Published: 2021-08-23
Description: A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22249.json; https://gitlab.com/gitlab-org/gitlab/-/issues/331857; https://hackerone.com/reports/1204320
CVE: CVE-2021-22251
Published: 2021-08-23
Description: Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22251.json; https://gitlab.com/gitlab-org/gitlab/-/issues/14004; https://hackerone.com/reports/679567
CVE: CVE-2021-22252
Published: 2021-08-23
Description: A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers
CVSS Score: 6.5 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22252.json; https://gitlab.com/gitlab-org/gitlab/-/issues/330364; https://hackerone.com/reports/1186135
CVE: CVE-2021-22253
Published: 2021-08-23
Description: Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22253.json; https://gitlab.com/gitlab-org/gitlab/-/issues/323794; https://hackerone.com/reports/1113783
CVE: CVE-2021-22328
Published: 2021-08-23
Description: There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling of the packets, an attacker may craft the specific packet. Successful exploit may cause some services abnormal. Affected product versions include:CloudEngine 12800 V200R005C00SPC800, CloudEngine 5800 V200R005C00SPC800, CloudEngine 6800 V200R005C00SPC800, CloudEngine 7800 V200R005C00SPC800.
CVSS Score: 7.5 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210407-01-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210407-01-dos-en
CVE: CVE-2021-22357
Published: 2021-08-23
Description: There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages due to validating inputs insufficiently. Attackers can exploit this vulnerability by sending specific messages to affected module. This can cause denial of service. Affected product versions include: S12700 V200R013C00SPC500, V200R019C00SPC500; S5700 V200R013C00SPC500, V200R019C00SPC500; S6700 V200R013C00SPC500, V200R019C00SPC500; S7700 V200R013C00SPC500, V200R019C00SPC500.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210512-01-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210512-01-dos-en
CVE: CVE-2021-22449
Published: 2021-08-23
Description: There is a logic vulnerability in Elf-G10HN 1.0.0.608. An unauthenticated attacker could perform specific operations to exploit this vulnerability. Due to insufficient security design, successful exploit could allow an attacker to add users to be friends without prompting in the target device.
CVSS Score: 7.5 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210630-01-logic-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210630-01-logic-en
CVE: CVE-2020-18730
Published: 2021-08-23
Description: A segmentation violation in the Iec104_Deal_I function of IEC104 v1.0 allows attackers to cause a denial of service (DOS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://cwe.mitre.org/data/definitions/476.html; https://github.com/airpig2011/IEC104/issues/4; https://cwe.mitre.org/data/definitions/476.html
CVE: CVE-2020-18731
Published: 2021-08-23
Description: A segmentation violation in the Iec104_Deal_FirmUpdate function of IEC104 v1.0 allows attackers to cause a denial of service (DOS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://cwe.mitre.org/data/definitions/476.html; https://github.com/airpig2011/IEC104/issues/5; https://cwe.mitre.org/data/definitions/476.html
CVE: CVE-2020-18734
Published: 2021-08-23
Description: A stack buffer overflow in /ddsi/q_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/eclipse-cyclonedds/cyclonedds; https://github.com/eclipse-cyclonedds/cyclonedds/issues/476; https://projects.eclipse.org/projects/iot.cyclonedds
CVE: CVE-2020-18735
Published: 2021-08-23
Description: A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/eclipse-cyclonedds/cyclonedds; https://github.com/eclipse-cyclonedds/cyclonedds/issues/501; https://projects.eclipse.org/projects/iot.cyclonedds
CVE: CVE-2021-39158
Published: 2021-08-23
Description: NVCaffe's python required dependencies list used to contain `gfortran`version prior to 0.17.4, entry which does not exist in the repository pypi.org. An attacker could potentially have posted malicious files to pypi.org causing a user to install it within NVCaffe.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://github.com/NVIDIA/caffe/security/advisories/GHSA-fmpp-8pwg-vwh9; https://github.com/NVIDIA/caffe/security/advisories/GHSA-fmpp-8pwg-vwh9
CVE: CVE-2021-39608
Published: 2021-08-23
Description: Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/164047/FlatCore-CMS-2.0.7-Remote-Code-Execution.html; https://github.com/flatCore/flatCore-CMS/issues/52; http://packetstormsecurity.com/files/164047/FlatCore-CMS-2.0.7-Remote-Code-Execution.html