60
CVE-2021-36356
- CVSS 3.1
- 9.8 critical
- EPSS
- 54%p99
- Published
- ·
- Modified
Description · NVD
KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.