rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-31261 
The gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T18:29:10.000Z
CVE-2021-31262 
The AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-19T18:29:10.000Z
CVE-2021-31272 
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-18T21:50:00.000Z
CVE-2021-31274 
In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-08T17:12:29.000Z
CVE-2021-31280 
An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-14T00:00:00.000Z
CVE-2021-31292 
An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T00:00:00.000Z
CVE-2021-31294 
Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-15T00:00:00.000Z
CVE-2021-31314 
File upload vulnerability in ejinshan v8+ terminal security system allows attackers to upload arbitrary files to arbitrary locations on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-20T00:00:00.000Z
CVE-2021-31315 
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:45:09.000Z
CVE-2021-31316 
The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:44:58.000Z
CVE-2021-31317 
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:44:46.000Z
CVE-2021-31318 
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:44:37.000Z
CVE-2021-31319 
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:44:26.000Z
CVE-2021-31320 
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:44:14.000Z
CVE-2021-31321 
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:43:44.000Z
CVE-2021-31322 
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:43:37.000Z
CVE-2021-31323 
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:43:27.000Z
CVE-2021-31324 
The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T19:43:15.000Z
CVE-2021-31326 
D-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parameter to /goform/form2Reboot.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:24:55.000Z
CVE-2021-31327 
Stored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T15:49:21.000Z
CVE-2021-31329 
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-21T15:25:02.000Z
CVE-2021-31330 
A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T17:34:27.000Z
CVE-2021-31337 
The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the service is enabled. Telnet is disabled by default on the SINAMICS Medium Voltage Products (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: n/a
product: SINAMICS Medium Voltage Products
Published: 2021-06-28T12:24:58.000Z
CVE-2021-31338 
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1). Affected devices allow to modify configuration settings over an unauthenticated channel. This could allow a local attacker to escalate privileges and execute own code on the device.
Problem types: cwe_id: CWE-15
description: CWE-15: External Control of System or Configuration Setting
Affected products: vendor: Siemens
product: SINEMA Remote Connect Client
Published: 2021-08-19T10:00:11.000Z
CVE-2021-31339 
A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework.
Problem types: cwe_id: CWE-209
description: CWE-209: Generation of Error Message Containing Sensitive Information
Affected products: vendor: Siemens
product: Mendix Excel Importer Module
Published: 2021-05-12T13:18:23.000Z
CVE-2021-31340 
A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (All versions > V1.1 and < V1.3.2), SIMATIC RF186CI (All versions > V1.1 and < V1.3.2), SIMATIC RF188C (All versions > V1.1 and < V1.3.2), SIMATIC RF188CI (All versions > V1.1 and < V1.3.2), SIMATIC RF360R (All versions < V2.0), SIMATIC Reader RF610R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF610R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF610R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF615R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF615R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF615R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF650R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF650R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF680R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF680R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF685R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF685R FCC (All versions > V3.0 < V4.0). Affected devices do not properly handle large numbers of incoming connections. An attacker may leverage this to cause a Denial-of-Service situation.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Siemens
product: SIMATIC RF166C
vendor: Siemens
product: SIMATIC RF185C
vendor: Siemens
product: SIMATIC RF186C
vendor: Siemens
product: SIMATIC RF186CI
vendor: Siemens
product: SIMATIC RF188C
vendor: Siemens
product: SIMATIC RF188CI
vendor: Siemens
product: SIMATIC RF360R
vendor: Siemens
product: SIMATIC Reader RF610R CMIIT
vendor: Siemens
product: SIMATIC Reader RF610R ETSI
vendor: Siemens
product: SIMATIC Reader RF610R FCC
vendor: Siemens
product: SIMATIC Reader RF615R CMIIT
vendor: Siemens
product: SIMATIC Reader RF615R ETSI
vendor: Siemens
product: SIMATIC Reader RF615R FCC
vendor: Siemens
product: SIMATIC Reader RF650R ARIB
vendor: Siemens
product: SIMATIC Reader RF650R CMIIT
vendor: Siemens
product: SIMATIC Reader RF650R ETSI
vendor: Siemens
product: SIMATIC Reader RF650R FCC
vendor: Siemens
product: SIMATIC Reader RF680R ARIB
vendor: Siemens
product: SIMATIC Reader RF680R CMIIT
vendor: Siemens
product: SIMATIC Reader RF680R ETSI
vendor: Siemens
product: SIMATIC Reader RF680R FCC
vendor: Siemens
product: SIMATIC Reader RF685R ARIB
vendor: Siemens
product: SIMATIC Reader RF685R CMIIT
vendor: Siemens
product: SIMATIC Reader RF685R ETSI
vendor: Siemens
product: SIMATIC Reader RF685R FCC
Published: 2021-06-08T19:47:16.000Z
CVE-2021-31341 
Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1).
Problem types: cwe_id: CWE-209
description: GENERATION OF ERROR MESSAGE CONTAINING SENSITIVE INFORMATION CWE-209
Affected products: vendor: n/a
product: Mendix Database Replication Module
Published: 2021-05-12T13:18:23.000Z
CVE-2021-31342 
The ugeom2d.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Siemens Solid Edge
Published: 2021-06-08T19:47:16.000Z
CVE-2021-31343 
The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocation structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Siemens Solid Edge
Published: 2021-06-08T19:47:16.000Z
CVE-2021-31344 
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)
Problem types: cwe_id: CWE-843
description: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Siemens
product: Capital Embedded AR Classic 431-422
default_status: unknown
vendor: Siemens
product: Capital Embedded AR Classic R20-11
default_status: unknown
vendor: Siemens
product: PLUSCONTROL 1st Gen
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2021-11-09T11:31:51.000Z
CVE-2021-31345 
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions). The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006)
Problem types: cwe_id: CWE-1284
description: CWE-1284: Improper Validation of Specified Quantity in Input
Affected products: vendor: Siemens
product: Capital Embedded AR Classic 431-422
default_status: unknown
vendor: Siemens
product: Capital Embedded AR Classic R20-11
default_status: unknown
vendor: Siemens
product: PLUSCONTROL 1st Gen
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Published: 2021-11-09T11:31:52.000Z
CVE-2021-31346 
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)
Problem types: cwe_id: CWE-1284
description: CWE-1284: Improper Validation of Specified Quantity in Input
Affected products: vendor: Siemens
product: Capital Embedded AR Classic 431-422
default_status: unknown
vendor: Siemens
product: Capital Embedded AR Classic R20-11
default_status: unknown
vendor: Siemens
product: PLUSCONTROL 1st Gen
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
baseScore: 8.2
baseSeverity: HIGH
Published: 2021-11-09T11:31:53.000Z
CVE-2021-31347 
An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (writing outside a memory region created by mmap).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-16T17:32:30.000Z
CVE-2021-31348 
An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (out-of-bounds read after a certain strcspn failure).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-16T17:41:08.000Z
CVE-2021-31349 Session Smart Router: Authentication Bypass Vulnerability
The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Juniper Networks
product: 128 Technology Session Smart Router
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: 128 Technology was notified via the JVN community of the vulnerability as JVN#85073657.
Published: 2021-10-19T18:16:28.461Z
CVE-2021-31350 Junos OS and Junos OS Evolved: Privilege escalation vulnerability in Juniper Extension Toolkit (JET)
An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on Juniper Networks Junos OS and Junos OS Evolved, allows a network-based, low-privileged authenticated attacker to perform operations as root, leading to complete compromise of the targeted system. The issue is caused by the JET service daemon (jsd) process authenticating the user, then passing configuration operations directly to the management daemon (mgd) process, which runs as root. This issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R1-S8, 18.4R2-S8, 18.4R3-S8; 19.1 versions prior to 19.1R2-S3, 19.1R3-S5; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2-S1, 20.3R3; 20.4 versions prior to 20.4R2. This issue does not affect Juniper Networks Junos OS versions prior to 18.4R1. Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-EVO; 21.1-EVO versions prior to 21.1R2-EVO.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Juniper Networks
product: Junos OS
vendor: Juniper Networks
product: Junos OS Evolved
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-19T18:16:30.117Z
CVE-2021-31351 Junos OS: MX Series: Receipt of specific packet on MS-MPC/MS-MIC causes line card reset
An Improper Check for Unusual or Exceptional Conditions in packet processing on the MS-MPC/MS-MIC utilized by Juniper Networks Junos OS allows a malicious attacker to send a specific packet, triggering the MS-MPC/MS-MIC to reset, causing a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue only affects specific versions of Juniper Networks Junos OS on MX Series: 17.3R3-S11; 17.4R2-S13; 17.4R3 prior to 17.4R3-S5; 18.1R3-S12; 18.2R2-S8, 18.2R3-S7, 18.2R3-S8; 18.3R3-S4; 18.4R3-S7; 19.1R3-S4, 19.1R3-S5; 19.2R1-S6; 19.3R3-S2; 19.4R2-S4, 19.4R2-S5; 19.4R3-S2; 20.1R2-S1; 20.2R2-S2, 20.2R2-S3, 20.2R3; 20.3R2, 20.3R2-S1; 20.4R1, 20.4R1-S1, 20.4R2; 21.1R1; This issue does not affect any version of Juniper Networks Junos OS prior to 15.1X49-D240;
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
description: Denial of Service (DoS)
Affected products: vendor: Juniper Networks
product: Junos OS
vendor: Juniper Networks
product: Junos OS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-10-19T18:16:31.714Z
CVE-2021-31352 SRC Series: NETCONF over SSH allows negotiation of weak ciphers
An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which could allow a remote attacker to obtain sensitive information. A remote attacker with read and write access to network data could exploit this vulnerability to display plaintext bits from a block of ciphertext and obtain sensitive information. This issue affects all Juniper Networks SRC Series versions prior to 4.13.0-R6.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Juniper Networks
product: SRC Series
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2021-10-19T18:16:33.308Z