deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-35568
Published: 2021-02-16
Description: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information about other users and devices in the account.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://cert.vde.com/en/advisories/VDE-2021-003; https://cert.vde.com/en/advisories/VDE-2022-039; https://mbconnectline.com/security-advice/
CVE: CVE-2020-35569
Published: 2021-02-16
Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://mbconnectline.com/security-advice/; https://cert.vde.com/de-de/advisories/vde-2021-003
CVE: CVE-2020-35570
Published: 2021-02-16
Description: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://cert.vde.com/en/advisories/VDE-2021-003; https://cert.vde.com/en/advisories/VDE-2022-039; https://mbconnectline.com/security-advice/
CVE: CVE-2021-20986
Published: 2021-02-16
Description: A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert.vde.com/en-us/advisories/vde-2021-006; https://kb.hilscher.com/display/ISMS/2020-12-03+Denial+of+Service+vulnerability+in+PROFINET+IO+Device; https://cert.vde.com/en-us/advisories/vde-2021-006
CVE: CVE-2021-20987
Published: 2021-02-16
Description: A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through network or make devices crash without recovery.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert.vde.com/en-us/advisories/vde-2021-007; https://kb.hilscher.com/pages/viewpage.action?pageId=108969480; https://cert.vde.com/en-us/advisories/vde-2021-007
CVE: CVE-2021-21315
Published: 2021-02-16
Description: The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVSS Score: 7.1 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525; https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v; https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E
CVE: CVE-2021-23839
Published: 2021-02-16
Description: OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is supposed to reject connection attempts from a client where this special form of padding is present, because this indicates that a version rollback has occurred (i.e. both client and server support greater than SSLv2, and yet this is the version that is being requested). The implementation of this padding check inverted the logic so that the connection attempt is accepted if the padding is present, and rejected if it is absent. This means that such as server will accept a connection if a version rollback attack has occurred. Further the server will erroneously reject a connection if a normal SSLv2 connection attempt is made. Only OpenSSL 1.0.2 servers from version 1.0.2s to 1.0.2x are affected by this issue. In order to be vulnerable a 1.0.2 server must: 1) have configured SSLv2 support at compile time (this is off by default), 2) have configured SSLv2 support at runtime (this is off by default), 3) have configured SSLv2 ciphersuites (these are not in the default ciphersuite list) OpenSSL 1.1.1 does not have SSLv2 support and therefore is not vulnerable to this issue. The underlying error is in the implementation of the RSA_padding_check_SSLv23() function. This also affects the RSA_SSLV23_PADDING padding mode used by various other functions. Although 1.1.1 does not support SSLv2 the RSA_padding_check_SSLv23() function still exists, as does the RSA_SSLV23_PADDING padding mode. Applications that directly call that function or use that padding mode will encounter this issue. However since there is no support for the SSLv2 protocol in 1.1.1 this is considered a bug and not a security issue in that version. OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.0.2y (Affected 1.0.2s-1.0.2x).
CVSS Score: 3.7 (LOW)
CWE: CWE-327
References: https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=30919ab80a478f2d81f2e9acdcca3fa4740cd547; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846
CVE: CVE-2021-23840
Published: 2021-02-16
Description: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
CVE: CVE-2021-23841
Published: 2021-02-16
Description: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2021/May/67; http://seclists.org/fulldisclosure/2021/May/68; http://seclists.org/fulldisclosure/2021/May/70
CVE: CVE-2021-21316
Published: 2021-02-16
Description: less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources (i.e. `*.less` files) with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be executed in the context of the build process. While this is a feature of the Less.js library it is an unexpected behavior in the context of OpenUI5 and SAPUI5 development. Especially in the context of UI5 Tooling which relies on less-openui5. An attacker might create a library or theme-library containing a custom control or theme, hiding malicious JavaScript code in one of the .less files. Refer to the referenced GHSA-3crj-w4f5-gwh4 for examples. Starting with Less.js version 3.0.0, the Inline JavaScript feature is disabled by default. less-openui5 however currently uses a fork of Less.js v1.6.3. Note that disabling the Inline JavaScript feature in Less.js versions 1.x, still evaluates code has additional double codes around it. We decided to remove the inline JavaScript evaluation feature completely from the code of our Less.js fork. This fix is available in less-openui5 version 0.10.0.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74
References: http://lesscss.org/usage/#less-options-enable-inline-javascript-deprecated-; https://github.com/SAP/less-openui5/commit/c0d3a8572974a20ea6cee42da11c614a54f100e8; https://github.com/SAP/less-openui5/releases/tag/v0.10.0
CVE: CVE-2021-21317
Published: 2021-02-16
Description: uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://github.com/ua-parser/uap-core/commit/dc9925d458214cfe87b93e[PII_REDACTED]2f6ae96c; https://github.com/ua-parser/uap-core/security/advisories/GHSA-p4pj-mg4r-x6v4; https://www.npmjs.com/package/uap-core
CVE: CVE-2021-27237
Published: 2021-02-16
Description: The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/BlackCatDevelopment/BlackCatCMS/commits/release-1.4/upload/backend/preferences/ajax_save.php; https://github.com/BlackCatDevelopment/BlackCatCMS/compare/1.3.6...1.4Beta; https://www.exploit-db.com/exploits/49565
CVE: CVE-2020-11635
Published: 2021-02-16
Description: The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited actions for which they did not have privileges.
CVSS Score: 7.8 (HIGH)
References: https://trust.zscaler.com/posts/7316; https://trust.zscaler.com/posts/7316
CVE: CVE-2020-28918
Published: 2021-02-16
Description: DualShield 5.9.8.0821 allows username enumeration on its login form. A valid username results in prompting for the password, whereas an invalid one will produce an "unknown username" error message.
CVSS Score: 5.3 (MEDIUM)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28918; https://deepnetsecurity.com/multi-factor-authentication/; https://excellium-services.com/cert-xlm-advisory/CVE-2020-28918
CVE: CVE-2020-29457
Published: 2021-02-16
Description: A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-295
References: https://github.com/OPCFoundation/UA-.NETStandard; https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2020-29457.pdf; https://www.nuget.org/packages/OPCFoundation.NetStandard.Opc.Ua/
CVE: CVE-2021-20066
Published: 2021-02-16
Description: JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.
CVSS Score: 5.6 (MEDIUM)
References: https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951; https://www.tenable.com/security/research/tra-2021-05; https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951
CVE: CVE-2021-20067
Published: 2021-02-16
Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://www.tenable.com/security/research/tra-2021-04; https://www.tenable.com/security/research/tra-2021-04
CVE: CVE-2021-20068
Published: 2021-02-16
Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the error handling functionality of web pages.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-04; https://www.tenable.com/security/research/tra-2021-04
CVE: CVE-2021-20069
Published: 2021-02-16
Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the regionalSettings.php dialogs.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-04; https://www.tenable.com/security/research/tra-2021-04
CVE: CVE-2021-20070
Published: 2021-02-16
Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the virtualization.php dialogs.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-04; https://www.tenable.com/security/research/tra-2021-04
CVE: CVE-2021-20071
Published: 2021-02-16
Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-04; https://www.tenable.com/security/research/tra-2021-04
CVE: CVE-2021-20072
Published: 2021-02-16
Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an authenticated directory traveral.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://www.tenable.com/security/research/tra-2021-04; https://www.tenable.com/security/research/tra-2021-04
CVE: CVE-2021-20073
Published: 2021-02-16
Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2021-04; https://www.tenable.com/security/research/tra-2021-04
CVE: CVE-2021-20074
Published: 2021-02-16
Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows users to escape the provided command line interface and execute arbitrary OS commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.tenable.com/security/research/tra-2021-04; https://www.tenable.com/security/research/tra-2021-04
CVE: CVE-2021-20075
Published: 2021-02-16
Description: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.tenable.com/security/research/tra-2021-04; https://www.tenable.com/security/research/tra-2021-04
CVE: CVE-2021-27203
Published: 2021-02-16
Description: In Dekart Private Disk 2.15, invalid use of the Type3 user buffer for IOCTL codes using METHOD_NEITHER results in arbitrary memory dereferencing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://www.dekart.com/products/encryption/private_disk; https://www.rootshellsecurity.net/rootshell-discover-denial-of-service-flaw-dekart-private-disk-encryption-software/; https://www.dekart.com/products/encryption/private_disk
CVE: CVE-2021-27101
Published: 2021-02-16
Description: Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/accellion/CVEs/blob/main/CVE-2021-27101.txt; https://www.accellion.com/products/fta/; https://github.com/accellion/CVEs/blob/main/CVE-2021-27101.txt
CVE: CVE-2021-27102
Published: 2021-02-16
Description: Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/accellion/CVEs/blob/main/CVE-2021-27102.txt; https://www.accellion.com/products/fta/; https://github.com/accellion/CVEs/blob/main/CVE-2021-27102.txt
CVE: CVE-2021-27103
Published: 2021-02-16
Description: Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://github.com/accellion/CVEs/blob/main/CVE-2021-27103.txt; https://www.accellion.com/products/fta/; https://github.com/accellion/CVEs/blob/main/CVE-2021-27103.txt
CVE: CVE-2021-27104
Published: 2021-02-16
Description: Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/accellion/CVEs/blob/main/CVE-2021-27104.txt; https://www.accellion.com/products/fta/; https://github.com/accellion/CVEs/blob/main/CVE-2021-27104.txt
CVE: CVE-2021-26930
Published: 2021-02-17
Description: An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c.
CVSS Score: 7.8 (HIGH)
References: http://xenbits.xen.org/xsa/advisory-365.html; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=871997bc9e423f05c7da7c9178e62dde5df2a7f8; https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
CVE: CVE-2021-26931
Published: 2021-02-17
Description: An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: http://xenbits.xen.org/xsa/advisory-362.html; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3194a1746e8aabe86075fd3c5e7cf1f4632d7f16; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5a264285ed1cd32e26d9de4f3c8c6855e467fd63
CVE: CVE-2021-26932
Published: 2021-02-17
Description: An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c.
CVSS Score: 5.5 (MEDIUM)
References: http://xenbits.xen.org/xsa/advisory-361.html; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ebee0eab08594b2bd5db716288a4f1ae5936e9bc; https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
CVE: CVE-2021-26933
Published: 2021-02-17
Description: An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory.
CVSS Score: 5.5 (MEDIUM)
References: http://xenbits.xen.org/xsa/advisory-364.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
CVE: CVE-2021-26934
Published: 2021-02-17
Description: An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this wasn't stated accordingly in its support status entry.
CVSS Score: 7.8 (HIGH)
References: http://xenbits.xen.org/xsa/advisory-363.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
CVE: CVE-2021-20653
Published: 2021-02-17
Description: Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://jpn.nec.com/security-info/secinfo/nv21-006.html; https://jvn.jp/en/jp/JVN87164507/index.html; https://jpn.nec.com/security-info/secinfo/nv21-006.html
CVE: CVE-2021-20655
Published: 2021-02-17
Description: FileZen (V3.0.0 to V4.2.7 and V5.0.0 to V5.0.2) allows a remote attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN58774946/index.html; https://www.soliton.co.jp/support/2021/004334.html; https://jvn.jp/en/jp/JVN58774946/index.html