deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-22215
Published: 2021-06-08
Description: An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects
CVSS Score: 7.5 (HIGH)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22215.json; https://gitlab.com/gitlab-org/gitlab/-/issues/328668; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22215.json
CVE: CVE-2021-22218
Published: 2021-06-08
Description: All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits.
CVSS Score: 2.6 (LOW)
CWE: CWE-295
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22218.json; https://gitlab.com/gitlab-org/gitlab/-/issues/297665; https://hackerone.com/reports/1077019
CVE: CVE-2021-32015
Published: 2021-06-08
Description: In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Common Criteria (CC) certified. Nuvoton recommends that users apply the NPCT75x TPM 1.2 firmware update.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-862
References: https://www.nuvoton.com/support/product-related-information/security-advisories/sa-001/; https://www.nuvoton.com/support/product-related-information/security-advisories/sa-001/
CVE: CVE-2021-32673
Published: 2021-06-08
Description: reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-78
References: https://github.com/reg-viz/reg-suit/commit/f84ad9c7a22144d6c147dc175c52756c0f444d87; https://github.com/reg-viz/reg-suit/releases/tag/v0.10.16; https://github.com/reg-viz/reg-suit/security/advisories/GHSA-49q3-8867-5wmp
CVE: CVE-2020-25817
Published: 2021-06-08
Description: SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE-2021-25817]).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-611
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2020-26138
Published: 2021-06-08
Description: In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2021-21558
Published: 2021-06-08
Description: Dell EMC NetWorker, 18.x, 19.1.x, 19.2.x 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. A local administrator of the gstd system may potentially exploit this vulnerability to read LDAP credentials from local logs and use the stolen credentials to make changes to the network domain.
CVSS Score: 8.2 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000186638/dsa-2021-104-dell-emc-networker-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000186638/dsa-2021-104-dell-emc-networker-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-21559
Published: 2021-06-08
Description: Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client (NetWorker Management Console) components which uses SSL encrypted connection in order to communicate with the application server. An unauthenticated attacker in the same network collision domain as the NetWorker Management Console client could potentially exploit this vulnerability to perform man-in-the-middle attacks to intercept and tamper the traffic between the client and the application server.
CVSS Score: 7.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.dell.com/support/kbdoc/en-us/000186638/dsa-2021-104-dell-emc-networker-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000186638/dsa-2021-104-dell-emc-networker-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-28293
Published: 2021-06-08
Description: Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct configuration leads to recovery of the password reset link generated via the password reset functionality, and thus an unauthenticated attacker can set an arbitrary password for any user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://0xdb9.in/2021/06/07/cve-2021-28293.html; https://www.seceon.com/advanced-siem-aisiem; https://0xdb9.in/2021/06/07/cve-2021-28293.html
CVE: CVE-2021-32674
Published: 2021-06-08
Description: Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.2.1 and 4.6.1. The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/zopefoundation/Zope/commit/1d897910139e2c0b11984fc9b78c1da1365bec21; https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36; https://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2mq6
CVE: CVE-2021-33203
Published: 2021-06-08
Description: Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://docs.djangoproject.com/en/3.2/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
CVE: CVE-2021-33571
Published: 2021-06-08
Description: In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://docs.djangoproject.com/en/3.2/releases/security/; https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e; https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
CVE: CVE-2020-28713
Published: 2021-06-08
Description: Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via an exposed PNS server. A remote attacker can passively record push notification events which are sent over an insecure web request. The web service does not authenticate requests, and allows attackers to send an indefinite amount of motion or doorbell events to a user's mobile application by either replaying or deliberately crafting false events.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-294
References: https://cloud.binary.ninja/embed/26671c64-6859-48fb-b58e-af35dc982b35; https://gist.github.com/tj-oconnor/dbfbef4d3b271d53fefbd24e1f0024f0; https://cloud.binary.ninja/embed/26671c64-6859-48fb-b58e-af35dc982b35
CVE: CVE-2021-22213
Published: 2021-06-08
Description: A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari
CVSS Score: 8.8 (HIGH)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22213.json; https://gitlab.com/gitlab-org/gitlab/-/issues/300308; https://hackerone.com/reports/1089277
CVE: CVE-2021-22217
Published: 2021-06-08
Description: A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request
CVSS Score: 6.5 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22217.json; https://gitlab.com/gitlab-org/gitlab/-/issues/300709; https://hackerone.com/reports/1090049
CVE: CVE-2021-22219
Published: 2021-06-08
Description: All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 allow a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22219.json; https://gitlab.com/gitlab-org/gitlab/-/issues/296995; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22219.json
CVE: CVE-2021-22221
Published: 2021-06-08
Description: An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2. Insufficient expired password validation in various operations allow user to maintain limited access after their password expired
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22221.json; https://gitlab.com/gitlab-org/gitlab/-/issues/292006; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22221.json
CVE: CVE-2021-26471
Published: 2021-06-08
Description: In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands.
CVSS Score: 9.8 (CRITICAL)
References: https://csirt.divd.nl/2021/05/11/Vembu-zero-days/; https://csirt.divd.nl/cases/DIVD-2020-00011/; https://csirt.divd.nl/cves/CVE-2021-26471/
CVE: CVE-2021-26472
Published: 2021-06-08
Description: In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://csirt.divd.nl/2021/05/11/Vembu-zero-days/; https://csirt.divd.nl/cases/DIVD-2020-00011/; https://csirt.divd.nl/cves/CVE-2021-26472/
CVE: CVE-2021-26473
Published: 2021-06-08
Description: In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://csirt.divd.nl/2021/05/11/Vembu-zero-days/; https://csirt.divd.nl/cases/DIVD-2020-00011/; https://csirt.divd.nl/cves/CVE-2021-26473/
CVE: CVE-2021-26474
Published: 2021-06-08
Description: Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)
CVSS Score: 8.6 (HIGH)
CWE: CWE-352
References: https://csirt.divd.nl/2021/05/11/Vembu-zero-days/; https://csirt.divd.nl/cases/DIVD-2020-00011/; https://csirt.divd.nl/cves/CVE-2021-26474/
CVE: CVE-2021-32658
Published: 2021-06-08
Description: Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that the Nextcloud Android App is upgraded to 3.16.1
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200, CWE-212
References: https://github.com/nextcloud/android/commit/355f3c745b464b741b20a3b[PII_REDACTED]0c26333; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g5gf-rmhm-wpxw; https://hackerone.com/reports/1189168
CVE: CVE-2020-26136
Published: 2021-06-08
Description: In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2021-22216
Published: 2021-06-08
Description: A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22216.json; https://gitlab.com/gitlab-org/gitlab/-/issues/329890; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22216.json
CVE: CVE-2021-22220
Published: 2021-06-08
Description: An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22220.json; https://gitlab.com/gitlab-org/gitlab/-/issues/294128; https://hackerone.com/reports/1060114
CVE: CVE-2021-27387
Published: 2021-06-08
Description: A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27399. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12819)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-133038.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-780/; https://cert-portal.siemens.com/productcert/pdf/ssa-133038.pdf
CVE: CVE-2021-27390
Published: 2021-06-08
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.3), Teamcenter Visualization (All versions < V13.1.0.3). The TIFF_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13131)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-645530.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-694/; https://cert-portal.siemens.com/productcert/pdf/ssa-645530.pdf
CVE: CVE-2021-27399
Published: 2021-06-08
Description: A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27387. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12820)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-133038.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-781/; https://cert-portal.siemens.com/productcert/pdf/ssa-133038.pdf
CVE: CVE-2021-31340
Published: 2021-06-08
Description: A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (All versions > V1.1 and < V1.3.2), SIMATIC RF186CI (All versions > V1.1 and < V1.3.2), SIMATIC RF188C (All versions > V1.1 and < V1.3.2), SIMATIC RF188CI (All versions > V1.1 and < V1.3.2), SIMATIC RF360R (All versions < V2.0), SIMATIC Reader RF610R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF610R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF610R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF615R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF615R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF615R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF650R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF650R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF680R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF680R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF685R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF685R FCC (All versions > V3.0 < V4.0). Affected devices do not properly handle large numbers of incoming connections. An attacker may leverage this to cause a Denial-of-Service situation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://cert-portal.siemens.com/productcert/pdf/ssa-787292.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-787292.pdf
CVE: CVE-2021-31342
Published: 2021-06-08
Description: The ugeom2d.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09; https://www.zerodayinitiative.com/advisories/ZDI-21-998/; https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09
CVE: CVE-2021-31343
Published: 2021-06-08
Description: The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocation structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09; https://www.zerodayinitiative.com/advisories/ZDI-21-999/; https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09
CVE: CVE-2021-31807
Published: 2021-06-08
Description: An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://seclists.org/fulldisclosure/2023/Oct/14; http://www.openwall.com/lists/oss-security/2023/10/11/3; http://www.squid-cache.org/Versions/v4/changesets/squid-4-e7cf864f938f24eea8af0692c04d16790983c823.patch
CVE: CVE-2021-33712
Published: 2021-06-08
Description: A vulnerability has been identified in Mendix SAML Module (All versions < V2.1.2). The configuration of the SAML module does not properly check various restrictions and validations imposed by an identity provider. This could allow a remote authenticated attacker to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://cert-portal.siemens.com/productcert/pdf/ssa-522654.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-522654.pdf
CVE: CVE-2021-1675
Published: 2021-06-08
Description: Windows Print Spooler Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/163349/Microsoft-PrintNightmare-Proof-Of-Concept.html; http://packetstormsecurity.com/files/163351/PrintNightmare-Windows-Spooler-Service-Remote-Code-Execution.html; http://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.html
CVE: CVE-2021-26414
Published: 2021-06-08
Description: Windows DCOM Server Security Feature Bypass
CVSS Score: 4.8 (MEDIUM)
References: http://packetstormsecurity.com/files/163206/Windows-Kerberos-AppContainer-Enterprise-Authentication-Capability-Bypass.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26414; http://packetstormsecurity.com/files/163206/Windows-Kerberos-AppContainer-Enterprise-Authentication-Capability-Bypass.html
CVE: CVE-2021-26420
Published: 2021-06-08
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 7.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26420; https://www.zerodayinitiative.com/advisories/ZDI-21-755/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26420
CVE: CVE-2021-31199
Published: 2021-06-08
Description: Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
CVSS Score: 5.2 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31199; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31199; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31199
CVE: CVE-2021-31201
Published: 2021-06-08
Description: Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
CVSS Score: 5.2 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31201; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31201; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31201