diff --git a/2012/0xxx/CVE-2012-0881.json b/2012/0xxx/CVE-2012-0881.json index be3e47b84f8..2bf9808a274 100644 --- a/2012/0xxx/CVE-2012-0881.json +++ b/2012/0xxx/CVE-2012-0881.json @@ -101,6 +101,11 @@ "url": "https://www.oracle.com//security-alerts/cpujul2021.html", "refsource": "MISC", "name": "https://www.oracle.com//security-alerts/cpujul2021.html" + }, + { + "refsource": "MLIST", + "name": "[hadoop-common-issues] 20210928 [GitHub] [hadoop] warrenzhu25 opened a new pull request #3496: HADOOP-17941. Update xerces to 2.12", + "url": "https://lists.apache.org/thread.html/rea7b831dceeb2a2fa817be6f63b08722042e3647fb2d47c144370a56@%3Ccommon-issues.hadoop.apache.org%3E" } ] } diff --git a/2021/21xxx/CVE-2021-21522.json b/2021/21xxx/CVE-2021-21522.json index 641d0ae529c..6db445c37a8 100644 --- a/2021/21xxx/CVE-2021-21522.json +++ b/2021/21xxx/CVE-2021-21522.json @@ -1,10 +1,10 @@ { "CVE_data_meta": { - "ASSIGNER": "secure@dell.com", - "DATE_PUBLIC": "2021-09-16", - "ID": "CVE-2021-21522", + "ASSIGNER": "secure@dell.com", + "DATE_PUBLIC": "2021-09-16", + "ID": "CVE-2021-21522", "STATE": "PUBLIC" - }, + }, "affects": { "vendor": { "vendor_data": [ @@ -12,59 +12,60 @@ "product": { "product_data": [ { - "product_name": "CPG BIOS", + "product_name": "CPG BIOS", "version": { "version_data": [ { - "version_affected": "<", + "version_affected": "<", "version_value": "1.13.0" } ] } } ] - }, + }, "vendor_name": "Dell" } ] } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { - "lang": "eng", + "lang": "eng", "value": "Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface." } ] - }, + }, "impact": { "cvss": { - "baseScore": 8.2, - "baseSeverity": "High", - "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", + "baseScore": 8.2, + "baseSeverity": "High", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" } - }, + }, "problemtype": { "problemtype_data": [ { "description": [ { - "lang": "eng", + "lang": "eng", "value": "CWE-255: Credentials Management" } ] } ] - }, + }, "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://www.dell.com/support/kbdoc/000191495" + "refsource": "MISC", + "url": "https://www.dell.com/support/kbdoc/000191495", + "name": "https://www.dell.com/support/kbdoc/000191495" } ] } diff --git a/2021/21xxx/CVE-2021-21569.json b/2021/21xxx/CVE-2021-21569.json index aff51e2162a..8c34c1897fd 100644 --- a/2021/21xxx/CVE-2021-21569.json +++ b/2021/21xxx/CVE-2021-21569.json @@ -1,10 +1,10 @@ { "CVE_data_meta": { - "ASSIGNER": "secure@dell.com", - "DATE_PUBLIC": "2021-09-02", - "ID": "CVE-2021-21569", + "ASSIGNER": "secure@dell.com", + "DATE_PUBLIC": "2021-09-02", + "ID": "CVE-2021-21569", "STATE": "PUBLIC" - }, + }, "affects": { "vendor": { "vendor_data": [ @@ -12,59 +12,60 @@ "product": { "product_data": [ { - "product_name": "NetWorker", + "product_name": "NetWorker", "version": { "version_data": [ { - "version_affected": "=", + "version_affected": "=", "version_value": "18.x, 19.x" } ] } } ] - }, + }, "vendor_name": "Dell" } ] } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { - "lang": "eng", + "lang": "eng", "value": "Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and gain access to unauthorized information." } ] - }, + }, "impact": { "cvss": { - "baseScore": 6.8, - "baseSeverity": "Medium", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", + "baseScore": 6.8, + "baseSeverity": "Medium", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" } - }, + }, "problemtype": { "problemtype_data": [ { "description": [ { - "lang": "eng", + "lang": "eng", "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" } ] } ] - }, + }, "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://www.dell.com/support/kbdoc/en-us/000188311/" + "refsource": "MISC", + "url": "https://www.dell.com/support/kbdoc/en-us/000188311/", + "name": "https://www.dell.com/support/kbdoc/en-us/000188311/" } ] } diff --git a/2021/21xxx/CVE-2021-21570.json b/2021/21xxx/CVE-2021-21570.json index a452e5d4d24..9451d5e68a4 100644 --- a/2021/21xxx/CVE-2021-21570.json +++ b/2021/21xxx/CVE-2021-21570.json @@ -1,10 +1,10 @@ { "CVE_data_meta": { - "ASSIGNER": "secure@dell.com", - "DATE_PUBLIC": "2021-09-02", - "ID": "CVE-2021-21570", + "ASSIGNER": "secure@dell.com", + "DATE_PUBLIC": "2021-09-02", + "ID": "CVE-2021-21570", "STATE": "PUBLIC" - }, + }, "affects": { "vendor": { "vendor_data": [ @@ -12,59 +12,60 @@ "product": { "product_data": [ { - "product_name": "NetWorker", + "product_name": "NetWorker", "version": { "version_data": [ { - "version_affected": "=", + "version_affected": "=", "version_value": "18.x, 19.x" } ] } } ] - }, + }, "vendor_name": "Dell" } ] } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { - "lang": "eng", + "lang": "eng", "value": "Dell NetWorker, versions 18.x and 19.x contain an Information disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and gain access to unauthorized information." } ] - }, + }, "impact": { "cvss": { - "baseScore": 6.8, - "baseSeverity": "Medium", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", + "baseScore": 6.8, + "baseSeverity": "Medium", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" } - }, + }, "problemtype": { "problemtype_data": [ { "description": [ { - "lang": "eng", + "lang": "eng", "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" } ] } ] - }, + }, "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://www.dell.com/support/kbdoc/en-us/000188311/dsa-2021-124-dell-networker-security-update-for-multiple-vulnerabilities" + "refsource": "MISC", + "url": "https://www.dell.com/support/kbdoc/en-us/000188311/dsa-2021-124-dell-networker-security-update-for-multiple-vulnerabilities", + "name": "https://www.dell.com/support/kbdoc/en-us/000188311/dsa-2021-124-dell-networker-security-update-for-multiple-vulnerabilities" } ] } diff --git a/2021/36xxx/CVE-2021-36283.json b/2021/36xxx/CVE-2021-36283.json index 4267a11104f..e713c315dba 100644 --- a/2021/36xxx/CVE-2021-36283.json +++ b/2021/36xxx/CVE-2021-36283.json @@ -1,10 +1,10 @@ { "CVE_data_meta": { - "ASSIGNER": "secure@dell.com", - "DATE_PUBLIC": "2021-09-16", - "ID": "CVE-2021-36283", + "ASSIGNER": "secure@dell.com", + "DATE_PUBLIC": "2021-09-16", + "ID": "CVE-2021-36283", "STATE": "PUBLIC" - }, + }, "affects": { "vendor": { "vendor_data": [ @@ -12,59 +12,60 @@ "product": { "product_data": [ { - "product_name": "CPG BIOS", + "product_name": "CPG BIOS", "version": { "version_data": [ { - "version_affected": "<", + "version_affected": "<", "version_value": "1.3.1" } ] } } ] - }, + }, "vendor_name": "Dell" } ] } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { - "lang": "eng", + "lang": "eng", "value": "Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM." } ] - }, + }, "impact": { "cvss": { - "baseScore": 7.5, - "baseSeverity": "High", - "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", + "baseScore": 7.5, + "baseSeverity": "High", + "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" } - }, + }, "problemtype": { "problemtype_data": [ { "description": [ { - "lang": "eng", + "lang": "eng", "value": "CWE-20: Improper Input Validation" } ] } ] - }, + }, "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://www.dell.com/support/kbdoc/000191495/" + "refsource": "MISC", + "url": "https://www.dell.com/support/kbdoc/000191495/", + "name": "https://www.dell.com/support/kbdoc/000191495/" } ] } diff --git a/2021/36xxx/CVE-2021-36284.json b/2021/36xxx/CVE-2021-36284.json index 359115b3f69..0fa39f2a6bc 100644 --- a/2021/36xxx/CVE-2021-36284.json +++ b/2021/36xxx/CVE-2021-36284.json @@ -1,10 +1,10 @@ { "CVE_data_meta": { - "ASSIGNER": "secure@dell.com", - "DATE_PUBLIC": "2021-09-16", - "ID": "CVE-2021-36284", + "ASSIGNER": "secure@dell.com", + "DATE_PUBLIC": "2021-09-16", + "ID": "CVE-2021-36284", "STATE": "PUBLIC" - }, + }, "affects": { "vendor": { "vendor_data": [ @@ -12,59 +12,60 @@ "product": { "product_data": [ { - "product_name": "CPG BIOS", + "product_name": "CPG BIOS", "version": { "version_data": [ { - "version_affected": "<", + "version_affected": "<", "version_value": "1.7.0" } ] } } ] - }, + }, "vendor_name": "Dell" } ] } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { - "lang": "eng", + "lang": "eng", "value": "Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive admin password attempt mitigations in order to carry out a brute force attack." } ] - }, + }, "impact": { "cvss": { - "baseScore": 5.7, - "baseSeverity": "Medium", - "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", + "baseScore": 5.7, + "baseSeverity": "Medium", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "version": "3.1" } - }, + }, "problemtype": { "problemtype_data": [ { "description": [ { - "lang": "eng", + "lang": "eng", "value": "CWE-307: Improper Restriction of Excessive Authentication Attempts" } ] } ] - }, + }, "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://www.dell.com/support/kbdoc/000191495" + "refsource": "MISC", + "url": "https://www.dell.com/support/kbdoc/000191495", + "name": "https://www.dell.com/support/kbdoc/000191495" } ] } diff --git a/2021/36xxx/CVE-2021-36285.json b/2021/36xxx/CVE-2021-36285.json index 743bc78e2a3..5ca69c2b07b 100644 --- a/2021/36xxx/CVE-2021-36285.json +++ b/2021/36xxx/CVE-2021-36285.json @@ -1,10 +1,10 @@ { "CVE_data_meta": { - "ASSIGNER": "secure@dell.com", - "DATE_PUBLIC": "2021-09-16", - "ID": "CVE-2021-36285", + "ASSIGNER": "secure@dell.com", + "DATE_PUBLIC": "2021-09-16", + "ID": "CVE-2021-36285", "STATE": "PUBLIC" - }, + }, "affects": { "vendor": { "vendor_data": [ @@ -12,59 +12,60 @@ "product": { "product_data": [ { - "product_name": "CPG BIOS", + "product_name": "CPG BIOS", "version": { "version_data": [ { - "version_affected": "<", + "version_affected": "<", "version_value": "1.7.0" } ] } } ] - }, + }, "vendor_name": "Dell" } ] } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { - "lang": "eng", + "lang": "eng", "value": "Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack." } ] - }, + }, "impact": { "cvss": { - "baseScore": 5.7, - "baseSeverity": "Medium", - "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", + "baseScore": 5.7, + "baseSeverity": "Medium", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "version": "3.1" } - }, + }, "problemtype": { "problemtype_data": [ { "description": [ { - "lang": "eng", + "lang": "eng", "value": "CWE-307: Improper Restriction of Excessive Authentication Attempts" } ] } ] - }, + }, "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://www.dell.com/support/kbdoc/000191495/" + "refsource": "MISC", + "url": "https://www.dell.com/support/kbdoc/000191495/", + "name": "https://www.dell.com/support/kbdoc/000191495/" } ] } diff --git a/2021/36xxx/CVE-2021-36286.json b/2021/36xxx/CVE-2021-36286.json index 62d2f2811eb..29d2b0a7db9 100644 --- a/2021/36xxx/CVE-2021-36286.json +++ b/2021/36xxx/CVE-2021-36286.json @@ -1,10 +1,10 @@ { "CVE_data_meta": { - "ASSIGNER": "secure@dell.com", - "DATE_PUBLIC": "2021-08-31", - "ID": "CVE-2021-36286", + "ASSIGNER": "secure@dell.com", + "DATE_PUBLIC": "2021-08-31", + "ID": "CVE-2021-36286", "STATE": "PUBLIC" - }, + }, "affects": { "vendor": { "vendor_data": [ @@ -12,59 +12,60 @@ "product": { "product_data": [ { - "product_name": "SupportAssist Client Consumer", + "product_name": "SupportAssist Client Consumer", "version": { "version_data": [ { - "version_affected": "<=", + "version_affected": "<=", "version_value": "3.9.13.0 " } ] } } ] - }, + }, "vendor_name": "Dell" } ] } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { - "lang": "eng", - "value": "Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited by using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by any(non-privileged) user under some object directories, but by themselves are not sufficient to successfully escalate privileges. However, combining them with a different object, such as the NTFS junction point allows for the exploitation. Support assist clean files functionality do not distinguish junction points from the physical folder and proceeds to clean the target of the junction that allows nonprivileged users to create junction points and delete arbitrary files on the system which can be accessed only by the admin. " + "lang": "eng", + "value": "Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited by using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by any(non-privileged) user under some object directories, but by themselves are not sufficient to successfully escalate privileges. However, combining them with a different object, such as the NTFS junction point allows for the exploitation. Support assist clean files functionality do not distinguish junction points from the physical folder and proceeds to clean the target of the junction that allows nonprivileged users to create junction points and delete arbitrary files on the system which can be accessed only by the admin." } ] - }, + }, "impact": { "cvss": { - "baseScore": 7.1, - "baseSeverity": "High", - "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", + "baseScore": 7.1, + "baseSeverity": "High", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" } - }, + }, "problemtype": { "problemtype_data": [ { "description": [ { - "lang": "eng", + "lang": "eng", "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" } ] } ] - }, + }, "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities" + "refsource": "MISC", + "url": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities", + "name": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities" } ] } diff --git a/2021/36xxx/CVE-2021-36297.json b/2021/36xxx/CVE-2021-36297.json index 016f64d9e2b..f0d5358c16e 100644 --- a/2021/36xxx/CVE-2021-36297.json +++ b/2021/36xxx/CVE-2021-36297.json @@ -1,10 +1,10 @@ { "CVE_data_meta": { - "ASSIGNER": "secure@dell.com", - "DATE_PUBLIC": "2021-08-31", - "ID": "CVE-2021-36297", + "ASSIGNER": "secure@dell.com", + "DATE_PUBLIC": "2021-08-31", + "ID": "CVE-2021-36297", "STATE": "PUBLIC" - }, + }, "affects": { "vendor": { "vendor_data": [ @@ -12,59 +12,60 @@ "product": { "product_data": [ { - "product_name": "SupportAssist Client Consumer", + "product_name": "SupportAssist Client Consumer", "version": { "version_data": [ { - "version_affected": "=", + "version_affected": "=", "version_value": "3.8, 3.9" } ] } } ] - }, + }, "vendor_name": "Dell" } ] } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { - "lang": "eng", + "lang": "eng", "value": "SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting/hijacking, only by a separate administrative action that is not a default part of the SOSInstallerTool.exe installation for executing arbitrary dll's," } ] - }, + }, "impact": { "cvss": { - "baseScore": 7.8, - "baseSeverity": "High", - "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "baseScore": 7.8, + "baseSeverity": "High", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } - }, + }, "problemtype": { "problemtype_data": [ { "description": [ { - "lang": "eng", + "lang": "eng", "value": "CWE-426: Untrusted Search Path" } ] } ] - }, + }, "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities" + "refsource": "MISC", + "url": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities", + "name": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities" } ] }