rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-35493 TIBCO WebFOCUS Cross Site Scripting vulnerabilities
The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO WebFOCUS Client: versions 8207.27.0 and below, TIBCO WebFOCUS Installer: versions 8207.27.0 and below, and TIBCO WebFOCUS Reporting Server: versions 8207.27.0 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system or the victim's local system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO WebFOCUS Client
vendor: TIBCO Software Inc.
product: TIBCO WebFOCUS Installer
vendor: TIBCO Software Inc.
product: TIBCO WebFOCUS Reporting Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-09-14T17:20:10.187Z
CVE-2021-35494 TIBCO JasperReports unauthorized access to temporary object
The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.
Problem types: description: Successful execution of this vulnerability results in the attacker gaining unauthorized read access to the data of other users on the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-10-12T17:35:11.042Z
CVE-2021-35495 TIBCO JasperReports FTP Password exposed
The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.
Problem types: description: Successful execution of this vulnerability can result in an attacker gaining access to the victim’s FTP server at the privilege level of the victim.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-10-12T17:35:12.623Z
CVE-2021-35496 TIBCO JasperReports XML Eternal Entity (XXE) vulnerability
The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.
Problem types: description: Successful execution of this vulnerability can result in unauthorized read, update, insert or delete access to the affected systems data and the ability to cause a denial of service (DOS) on the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: TIBCO would like to extend its appreciation to Dr. Florian Hauser, CODE WHITE GmbH for discovery of this vulnerability.
Published: 2021-10-12T17:35:14.158Z
CVE-2021-35497 TIBCO FTL unvalidated SAN in client certificates
The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a malicious non-administrative user can gain full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveSpaces - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO ActiveSpaces - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO ActiveSpaces - Enterprise Edition
vendor: TIBCO Software Inc.
product: TIBCO FTL - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO FTL - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO FTL - Enterprise Edition
vendor: TIBCO Software Inc.
product: TIBCO eFTL - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO eFTL - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO eFTL - Enterprise Edition
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-05T17:25:10.057Z
CVE-2021-35498 TIBCO EBX Insecure Login Mechanism
The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it will be accepted as valid. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.123 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, and 5.9.14, TIBCO EBX: versions 6.0.0 and 6.0.1, and TIBCO Product and Service Catalog powered by TIBCO EBX: version 1.0.0.
Problem types: description: In the worst case, if the targeted account is a privileged administrator, successful exploitation of this vulnerability can result in an attacker gaining full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO EBX
vendor: TIBCO Software Inc.
product: TIBCO EBX
vendor: TIBCO Software Inc.
product: TIBCO EBX
vendor: TIBCO Software Inc.
product: TIBCO Product and Service Catalog powered by TIBCO EBX
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-13T16:55:10.753Z
CVE-2021-35499 TIBCO Nimbus Stored Cross-site Scripting (XSS) vulnerabilities
The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: versions 10.4.0 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system or the victim's local system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Nimbus
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-10-26T16:35:09.440Z
CVE-2021-35500 TIBCO Data Virtualization Arbitrary File Download vulnerability
The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below.
Problem types: description: Successful execution of this vulnerability can result in unauthorized read access to all files on the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Data Virtualization
vendor: TIBCO Software Inc.
product: TIBCO Data Virtualization
vendor: TIBCO Software Inc.
product: TIBCO Data Virtualization
vendor: TIBCO Software Inc.
product: TIBCO Data Virtualization for AWS Marketplace
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2022-01-12T18:40:11.398Z
CVE-2021-35501 
PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-25T15:05:04.000Z
CVE-2021-35502 
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-25T20:49:50.000Z
CVE-2021-35503 
Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-05T11:58:28.000Z
CVE-2021-35504 
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-05T11:59:27.000Z
CVE-2021-35505 
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-05T12:00:17.000Z
CVE-2021-35506 
Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-05T12:01:19.000Z
CVE-2021-35508 
NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged user account. To exploit this, a low-privileged user must change the service configuration or overwrite the binary service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-01T13:20:16.000Z
CVE-2021-35512 
An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-21T11:18:13.000Z
CVE-2021-35513 
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-27T11:03:30.000Z
CVE-2021-35514 
Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T11:29:24.000Z
CVE-2021-35515 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Problem types: cwe_id: CWE-834
description: CWE-834 Excessive Iteration
Affected products: vendor: Apache Software Foundation
product: Apache Commons Compress
Credits: lang: en
value: This issue was discovered by OSS Fuzz.
Published: 2021-07-13T07:15:19.000Z
CVE-2021-35516 Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Apache Software Foundation
product: Apache Commons Compress
Credits: lang: en
value: This issue was first reported to the project's issue tracker as COMPRESS-542 by Robin Schimpf. Later OSS Fuzz detected ways to exploit this issue which managed to escape the initial attempt to fix it.
Published: 2021-07-13T07:15:20.000Z
CVE-2021-35517 Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Apache Software Foundation
product: Apache Commons Compress
Credits: lang: en
value: This issue was discovered by OSS Fuzz.
Published: 2021-07-13T07:15:22.000Z
CVE-2021-35520 
A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate authenticated attackers to achieve code execution, denial of services, and information disclosure via serial ports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T11:32:33.000Z
CVE-2021-35521 
A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T11:32:42.000Z
CVE-2021-35522 
A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T11:32:50.000Z
CVE-2021-35523 
Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T16:51:50.000Z
CVE-2021-35525 
PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T17:38:24.000Z
CVE-2021-35526 Storage of Sensitive Information Vulnerability in Hitachi ABB Power Grids System Data Manager – SDM600 Product
Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior to FP2 HF6 (Build Nr. 1.2.14002.257).
Problem types: description: cleartext storage
cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: Hitachi ABB Power Grids
product: System Data Manager – SDM600
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2021-09-08T15:10:08.403Z