Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-36380 State: PUBLISHED Published: 2021-08-13T15:53:59.000Z Last Updated: 2025-10-21T23:25:38.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sunhillo.com/product/sureline/ - https://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380/
CVE ID: CVE-2021-36381 State: PUBLISHED Published: 2021-07-12T15:46:28 Last Updated: 2024-08-04T00:54:51.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?logon_error= on the login screen of the Web application. Additional Analyst Notes: - CVE Program Container: References: - https://www.edifecs.com/services/managed-services/ - https://gist.github.com/rvismit/c2da674254f53c40d3a9eb3896277ebc
CVE ID: CVE-2021-36382 State: PUBLISHED Published: 2021-07-12T13:04:50 Last Updated: 2024-08-04T00:54:51.456Z Severity: LOW (CVSS 2.6 CVSS:3.1/AC:H/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext). Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2021-0005
CVE ID: CVE-2021-36383 State: PUBLISHED Published: 2021-07-12T13:18:48 Last Updated: 2024-08-04T00:54:51.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vatesfr/xen-orchestra/issues/5712
CVE ID: CVE-2021-36385 State: PUBLISHED Published: 2021-08-24T11:26:14 Last Updated: 2024-08-04T00:54:51.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe (aka U+FF07) in the default.aspx User ID field. Arbitrary system commands can be executed through the use of xp_cmdshell. Additional Analyst Notes: - CVE Program Container: References: - https://www.blacklanternsecurity.com/blog/ - https://www.cerner.com/solutions/mobility - https://www.blacklanternsecurity.com/2021-08-13-Cerner-MobileCare-CVE/
CVE ID: CVE-2021-36386 State: PUBLISHED Published: 2021-07-29T13:59:24 Last Updated: 2024-08-04T00:54:51.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user. Additional Analyst Notes: - CVE Program Container: References: - https://www.fetchmail.info/security.html - http://www.openwall.com/lists/oss-securit
VE Program Container: References: - https://www.fetchmail.info/security.html - http://www.openwall.com/lists/oss-security/2021/07/28/5 - https://www.fetchmail.info/fetchmail-SA-2021-01.txt - http://www.openwall.com/lists/oss-security/2021/08/09/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIXKO6QW3AUHGJVWKJXBCOVBYJUJRBFC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGYO5AHSXTCKA4NQC2Z4H3XMMYNAGC77/ - https://security.gentoo.org/glsa/202209-14
CVE ID: CVE-2021-36387 State: PUBLISHED Published: 2021-10-14T18:01:38 Last Updated: 2024-08-04T00:54:51.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.html - https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6 - h
https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6 - https://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.html - https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.md - http://seclists.org/fulldisclosure/2021/Oct/15 - https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities/
CVE ID: CVE-2021-36388 State: PUBLISHED Published: 2021-10-14T18:16:25 Last Updated: 2024-08-04T00:54:51.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6 - https://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecu
easeNotesforYellowfin9-Yellowfin9.6 - https://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.html - https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.md - http://seclists.org/fulldisclosure/2021/Oct/15 - https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities/
CVE ID: CVE-2021-36389 State: PUBLISHED Published: 2021-10-14T18:27:27 Last Updated: 2024-08-04T00:54:51.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4". Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.html - https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6 - https:
s://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6 - https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.md - http://seclists.org/fulldisclosure/2021/Oct/15 - https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities/
CVE ID: CVE-2021-36392 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T15:46:37.956Z Vendors: n/a Products: Moodle Problem Types: CWE-89 Description: In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424797
CVE ID: CVE-2021-36393 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T15:45:34.735Z Vendors: n/a Products: Moodle Problem Types: CWE-89 Description: In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424798
CVE ID: CVE-2021-36394 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T15:44:40.701Z Vendors: n/a Products: Moodle Problem Types: CWE-384 Description: In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424799
CVE ID: CVE-2021-36395 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T19:09:18.693Z Vendors: n/a Products: Moodle Problem Types: CWE-400 Description: In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424801
CVE ID: CVE-2021-36396 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-05T15:49:42.195Z Vendors: n/a Products: Moodle Problem Types: CWE-918 Description: In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424802
CVE ID: CVE-2021-36397 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T19:01:13.752Z Vendors: n/a Products: Moodle Problem Types: CWE-276 Description: In Moodle, insufficient capability checks meant message deletions were not limited to the current user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424803
CVE ID: CVE-2021-36398 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T18:58:56.671Z Vendors: n/a Products: Moodle Problem Types: CWE-79 Description: In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424804
CVE ID: CVE-2021-36399 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T18:13:47.571Z Vendors: n/a Products: Moodle Problem Types: CWE-79 Description: In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424805
CVE ID: CVE-2021-36400 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T18:03:53.554Z Vendors: n/a Products: Moodle Problem Types: CWE-276 Description: In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424806
CVE ID: CVE-2021-36401 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T18:02:47.009Z Vendors: n/a Products: Moodle Problem Types: CWE-79 Description: In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424807
CVE ID: CVE-2021-36402 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T17:59:50.456Z Vendors: n/a Products: Moodle Problem Types: CWE-20 Description: In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424808
CVE ID: CVE-2021-36403 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T17:58:48.597Z Vendors: n/a Products: Moodle Problem Types: CWE-912 Description: In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=424809
CVE ID: CVE-2021-36408 State: PUBLISHED Published: 2022-01-10T00:00:00 Last Updated: 2024-08-04T00:54:51.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strukturag/libde265/issues/299 - https://lists.debian.org/debian-lts-announce/2022/12/msg00027.html - https://www.debian.org/security/2023/dsa-5346
CVE ID: CVE-2021-36409 State: PUBLISHED Published: 2022-01-10T00:00:00 Last Updated: 2024-08-04T00:54:51.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strukturag/libde265/issues/300 - https://lists.debian.org/debian-lts-announce/2022/12/msg00027.html - https://www.debian.org/security/2023/dsa-5346
CVE ID: CVE-2021-36410 State: PUBLISHED Published: 2022-01-10T00:00:00 Last Updated: 2024-08-04T00:54:51.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running program dec265. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strukturag/libde265/issues/301 - https://lists.debian.org/debian-lts-announce/2022/12/msg00027.html - https://www.debian.org/security/2023/dsa-5346
CVE ID: CVE-2021-36411 State: PUBLISHED Published: 2022-01-10T00:00:00 Last Updated: 2024-08-04T00:54:51.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in function derive_boundaryStrength of deblock.cc has occurred. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strukturag/libde265/issues/302 - https://lists.debian.org/debian-lts-announce/2022/12/msg00027.html - https://www.debian.org/security/2023/dsa-5346
CVE ID: CVE-2021-36412 State: PUBLISHED Published: 2022-01-10T00:00:00 Last Updated: 2024-08-04T00:54:51.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attackers to possibly have unspecified other impact via a crafted file in the MP4Box command, Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1838 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-36414 State: PUBLISHED Published: 2022-01-10T00:00:00 Last Updated: 2024-08-04T00:54:51.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service or execute arbitrary code via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1840 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-36417 State: PUBLISHED Published: 2022-01-12T00:00:00 Last Updated: 2024-08-04T00:54:51.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, which causes a denial of service or execute arbitrary code via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1846 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2021-36424 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T17:33:53.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/slackero/phpwcms/issues/310
CVE ID: CVE-2021-36425 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T17:33:07.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/slackero/phpwcms/issues/311
CVE ID: CVE-2021-36426 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T17:32:17.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/slackero/phpwcms/issues/312
CVE ID: CVE-2021-36431 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T17:31:27.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check() function in jocms/apps/mask/inc/mask.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mxgbr/jocms/issues/6
CVE ID: CVE-2021-36432 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T17:30:21.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_mask() function in jocms/apps/mask/mask.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mxgbr/jocms/issues/6
CVE ID: CVE-2021-36433 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T17:29:22.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_delete_mask function in jocms/apps/mask/mask.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mxgbr/jocms/issues/6
CVE ID: CVE-2021-36434 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:25:32.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check function in jocms/apps/mask/inc/getmask.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mxgbr/jocms/issues/6
CVE ID: CVE-2021-36436 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:18:43.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Laransec/Mobicint
CVE ID: CVE-2021-36440 State: PUBLISHED Published: 2021-09-08T20:18:25 Last Updated: 2024-08-04T00:54:51.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/star7th/showdoc/issues/1406
CVE ID: CVE-2021-36443 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:24:32.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/peacexie/imcat/issues/9
CVE ID: CVE-2021-36444 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:23:35.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/peacexie/imcat/issues/9
CVE ID: CVE-2021-36450 State: PUBLISHED Published: 2021-12-15T06:55:56 Last Updated: 2024-08-04T00:54:51.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. Additional Analyst Notes: - CVE Program Container: References: - http://verint.com - https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html - https://medium.com/%401nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740
CVE ID: CVE-2021-36454 State: PUBLISHED Published: 2021-08-06T15:19:01 Last Updated: 2024-08-04T00:54:51.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) blocks\blocks.php, 3) brands\brands.php, 4) comments\comments.php, 5) coupons\coupons.php, 6) feeds\feeds.php, 7) functions\functions.php, 8) items\items.php, 9) menus\menus.php, 10) orders\orders.php, 11) payment_methods\payment_methods.php, 12) products\products.php, 13) profiles\profiles.php, 14) shipping_methods\shipping_methods.php, 15) templates\templates.php, 16) users\users.php, 17) we
ofiles\profiles.php, 14) shipping_methods\shipping_methods.php, 15) templates\templates.php, 16) users\users.php, 17) webdictionary\webdictionary.php, 18) websites\websites.php, and 19) webusers\webusers.php because the initial_url function is built in these files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NavigateCMS/Navigate-CMS/issues/24 - https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_4
CVE ID: CVE-2021-36455 State: PUBLISHED Published: 2021-08-06T15:25:39 Last Updated: 2024-08-04T00:54:51.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NavigateCMS/Navigate-CMS/issues/25 - https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_4