Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ls-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/08/critical-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&repo
nerability-patched-in-booster-for-woocommerce/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2581212%40woocommerce-jetpack&new=2581212%40woocommerce-jetpack&sfp_email=&sfph_mail=
CVE ID: CVE-2021-34647 State: PUBLISHED Published: 2021-09-22T17:53:18.503Z Last Updated: 2025-03-31T18:12:36.488Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Saturday Drive Products: Ninja Forms Problem Types: CWE-863 Description: The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information. Additional Analyst Notes: - CVE
forms-submissions/export REST API which can include personally identifiable information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/09/recently-patched-vulnerabilities-in-ninja-forms-plugin-affects-over-1-million-site-owners/ - https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Routes/Submissions.php?rev=2543837#L107
CVE ID: CVE-2021-34648 State: PUBLISHED Published: 2021-09-22T17:53:11.689Z Last Updated: 2025-03-31T18:20:03.844Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Saturday Drive Products: Ninja Forms Problem Types: CWE-863 Description: The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims. Additional Analyst Notes: - CVE Progr
-submissions/email-action REST API which can be used to socially engineer victims. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/09/recently-patched-vulnerabilities-in-ninja-forms-plugin-affects-over-1-million-site-owners/ - https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Routes/Submissions.php?rev=2543837#L155
CVE ID: CVE-2021-34649 State: PUBLISHED Published: 2021-08-16T18:22:26.249Z Last Updated: 2025-05-05T18:47:39.313Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Simple Behance Portfolio Products: Simple Behance Portfolio Problem Types: CWE-79 Description: The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `dark` parameter in the ~/titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34649 - https://plugins.trac.wordpress.org/browser/simple-behace-portfolio/trunk/titan-framework/iframe-font-preview.php#L141
CVE ID: CVE-2021-34650 State: PUBLISHED Published: 2021-09-20T20:16:57.429Z Last Updated: 2025-03-31T18:20:49.523Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: eID Easy Products: eID Easy Problem Types: CWE-79 Description: The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34650 - https://plugins.trac.wordpress.org/browser/smart-id/trun
://www.wordfence.com/vulnerability-advisories/#CVE-2021-34650 - https://plugins.trac.wordpress.org/browser/smart-id/trunk/admin.php?rev=2451347#L30
CVE ID: CVE-2021-34651 State: PUBLISHED Published: 2021-08-16T18:22:31.254Z Last Updated: 2025-05-05T18:21:28.999Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Scribble Maps Products: Scribble Maps Problem Types: CWE-79 Description: The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34651 - https://plugins.trac.wordpress.org/brows
erences: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34651 - https://plugins.trac.wordpress.org/browser/scribble-maps/trunk/includes/admin.php#L233
CVE ID: CVE-2021-34652 State: PUBLISHED Published: 2021-08-16T18:22:24.706Z Last Updated: 2025-05-05T18:48:22.673Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Media Usage Products: Media Usage Problem Types: CWE-79 Description: The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34652 - https://plugins.trac.wordpress.org/browser/media-u
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34652 - https://plugins.trac.wordpress.org/browser/media-usage/trunk/mmu_admin.php#L91
CVE ID: CVE-2021-34653 State: PUBLISHED Published: 2021-08-16T18:22:27.826Z Last Updated: 2025-05-05T18:44:35.579Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WP Fountain Products: WP Fountain Problem Types: CWE-79 Description: The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34653 - https://plugins.trac.wordpress
hment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34653 - https://plugins.trac.wordpress.org/browser/wp-fountain/trunk/wp-fountain.php#L123
CVE ID: CVE-2021-34654 State: PUBLISHED Published: 2021-08-16T18:22:29.437Z Last Updated: 2025-05-05T18:43:27.930Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Custom Post Type Relations Products: Custom Post Type Relations Problem Types: CWE-79 Description: The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptr[name] parameter found in the ~/pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34654 - https://plugins.trac.wordpress.org/browser/custom-post-type-relations/trunk/pages/admin-page.php#L60
CVE ID: CVE-2021-34655 State: PUBLISHED Published: 2021-08-16T18:22:36.550Z Last Updated: 2025-05-23T20:03:11.719Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WP Songbook Products: WP Songbook Problem Types: CWE-79 Description: The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the ~/inc/class.ajax.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34655 - https://plugins.trac.wordpress.org/br
References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34655 - https://plugins.trac.wordpress.org/browser/wp-songbook/tags/2.0.11/inc/class.ajax.php#L21
CVE ID: CVE-2021-34656 State: PUBLISHED Published: 2021-08-16T18:22:33.174Z Last Updated: 2025-05-05T18:20:54.108Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat Products: 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat Problem Types: CWE-79 Description: The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_notice` function found in the ~/inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7. Additional Analyst Notes: - CVE Program Container: -
nject arbitrary web scripts, in versions up to and including 5.2.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34656 - https://plugins.trac.wordpress.org/browser/webcam-2way-videochat/trunk/inc/requirements.php#L182
CVE ID: CVE-2021-34657 State: PUBLISHED Published: 2021-08-16T18:22:34.836Z Last Updated: 2025-05-05T18:18:13.064Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: TypoFR Products: TypoFR Problem Types: CWE-79 Description: The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the ~/vendor/Org_Heigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34657 - https://plugins.trac.wordpress.org
t: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34657 - https://plugins.trac.wordpress.org/browser/typofr/trunk/vendor/Org_Heigl/Hyphenator/index.php#L82
CVE ID: CVE-2021-34658 State: PUBLISHED Published: 2021-08-16T18:22:38.268Z Last Updated: 2025-05-23T20:02:51.976Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Simple Popup Newsletter Products: Simple Popup Newsletter Problem Types: CWE-79 Description: The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34658 - https://plugins.trac.wordpress.org/browser/simple-popup-newsletter/trunk/simple-popup-newsletter.php#L319
CVE ID: CVE-2021-34659 State: PUBLISHED Published: 2021-08-16T18:22:41.900Z Last Updated: 2025-05-23T20:02:11.872Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Plugmatter Pricing Table Lite Products: Plugmatter Pricing Table Lite Problem Types: CWE-79 Description: The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `email` parameter in the ~/license.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.32. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-
Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34659 - https://plugins.trac.wordpress.org/browser/plugmatter-pricing-table/trunk/license.php#L123
CVE ID: CVE-2021-34660 State: PUBLISHED Published: 2021-08-09T12:23:26.100Z Last Updated: 2025-05-23T20:11:00.382Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Very Good Plugins Products: WP Fusion Lite Problem Types: CWE-79 Description: The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.37.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-20
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34660 - https://plugins.trac.wordpress.org/browser/wp-fusion-lite/trunk/includes/admin/logging/class-log-table-list.php?rev=2497097#L427
CVE ID: CVE-2021-34661 State: PUBLISHED Published: 2021-08-09T12:23:20.384Z Last Updated: 2025-05-23T20:11:24.408Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L) Vendors: Very Good Plugins Products: WP Fusion Lite Problem Types: CWE-352 Description: The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34661 - https://plugins.trac.wordpress.org/browser/wp-fusion-lite/trunk/includes/admin/logging/class-log-handler.php?rev=2533608#L302
CVE ID: CVE-2021-34663 State: PUBLISHED Published: 2021-08-16T18:22:40.032Z Last Updated: 2025-05-23T20:02:35.807Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jQuery Tagline Rotator Products: jQuery Tagline Rotator Problem Types: CWE-79 Description: The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34663 - https://plugins.trac.wordpress.org/browser/jquery-tagline-rotator/trunk/jquery-tagline-rotator.php#L166
CVE ID: CVE-2021-34664 State: PUBLISHED Published: 2021-08-16T18:22:43.815Z Last Updated: 2025-05-23T20:01:30.178Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Moova for WooCommerce Products: Moova for WooCommerce Problem Types: CWE-79 Description: The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34664 - https://plugi
CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34664 - https://plugins.trac.wordpress.org/browser/moova-for-woocommerce/tags/3.5/Checkout/Checkout.php#L57
CVE ID: CVE-2021-34665 State: PUBLISHED Published: 2021-08-16T18:22:46.073Z Last Updated: 2025-05-23T20:01:06.887Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WP SEO Tags Products: WP SEO Tags Problem Types: CWE-79 Description: The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saq_txt_the_filter parameter in the ~/wp-seo-tags.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34665 - https://plugins.trac.wordpress.o
ent: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34665 - https://plugins.trac.wordpress.org/browser/wp-seo-tags/trunk/wp-seo-tags.php#L378
CVE ID: CVE-2021-34666 State: PUBLISHED Published: 2021-08-16T18:22:47.891Z Last Updated: 2025-05-05T18:17:40.827Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Add Sidebar Products: Add Sidebar Problem Types: CWE-79 Description: The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34666 - https://plugins.trac.wordpress.org/browser/s
ces: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34666 - https://plugins.trac.wordpress.org/browser/sidebar-adder/tags/2.0.1/wp_sidebarMenu.php#L124
CVE ID: CVE-2021-34667 State: PUBLISHED Published: 2021-08-16T18:22:49.894Z Last Updated: 2025-05-05T18:16:41.613Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Calendar_plugin Products: Calendar_plugin Problem Types: CWE-79 Description: The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calendar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34667 - https://plugins.trac.
P Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34667 - https://plugins.trac.wordpress.org/browser/calendar-plugin/trunk/calendar.php#L86
CVE ID: CVE-2021-34668 State: PUBLISHED Published: 2021-08-30T18:03:49.377Z Last Updated: 2025-05-05T14:52:36.007Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devowl.io Products: WordPress Real Media Library Problem Types: CWE-79 Description: The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerabili
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34668
CVE ID: CVE-2021-34675 State: PUBLISHED Published: 2021-07-19T16:45:42 Last Updated: 2024-08-04T00:19:47.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports. Additional Analyst Notes: - CVE Program Container: References: - http://basixonline.net/nex-forms-wordpress-form-builder-demo/change-log/ - https://github.com/rauschecker/CVEs/tree/main/CVE-2021-34675
CVE ID: CVE-2021-34676 State: PUBLISHED Published: 2021-07-19T16:40:56 Last Updated: 2024-08-04T00:19:47.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation. Additional Analyst Notes: - CVE Program Container: References: - http://basixonline.net/nex-forms-wordpress-form-builder-demo/change-log/ - https://github.com/rauschecker/CVEs/tree/main/CVE-2021-34676
CVE ID: CVE-2021-34679 State: PUBLISHED Published: 2021-06-11T20:26:53 Last Updated: 2024-08-04T00:19:48.089Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Thycotic Password Reset Server before 5.3.0 allows credential disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://docs.thycotic.com/prs/5.3.0/release-notes/5.3.0.md
CVE ID: CVE-2021-34682 State: PUBLISHED Published: 2021-06-12T20:09:47 Last Updated: 2024-08-04T00:19:47.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=vClCaAAfzGg
CVE ID: CVE-2021-34683 State: PUBLISHED Published: 2021-06-16T11:58:38 Last Updated: 2024-08-04T00:19:47.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0. A remote attacker can use kw/auth/bbs/asp/get_user_email_info_bbs.asp to obtain the contact information (name and e-mail address) of everyone in the entire organization. This information can allow remote attackers to perform social engineering or brute force attacks against the system login page. Additional Analyst Notes: - CVE Program Container: References: - https://www.eic.com.tw/eicHome/pro00.html - https://github.com/ethancsyang/CveProj
CVE Program Container: References: - https://www.eic.com.tw/eicHome/pro00.html - https://github.com/ethancsyang/CveProject/tree/main/CVE-2021-34683
CVE ID: CVE-2021-34684 State: PUBLISHED Published: 2021-11-08T03:34:33 Last Updated: 2024-08-04T00:19:48.084Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the related databases, as demonstrated by an api/repos/dashboards/editor URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.hitachi.com/hirt/security/index.html - http://packetstormsecurity.com/files/164791/Pentaho-Business-Analytics-Pentaho-Business-
.com/hirt/security/index.html - http://packetstormsecurity.com/files/164791/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-SQL-Injection.html