Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
cripts, in versions up to and including 2.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39344 - https://github.com/BigTiger2020/word-press/blob/main/KJM%20Admin%20Notices.md - https://plugins.trac.wordpress.org/browser/kjm-admin-notices/trunk/admin/class-kjm-admin-notices-admin.php
CVE ID: CVE-2021-39345 State: PUBLISHED Published: 2021-10-15T12:15:35.349Z Last Updated: 2025-03-31T18:00:09.597Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: HAL Products: HAL Problem Types: CWE-79 Description: The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/wp-hal.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.1.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additio
installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39345 - https://github.com/BigTiger2020/word-press/blob/main/HAL.md - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2614075%40hal&new=2614075%40hal&sfp_email=&sfph_mail=
CVE ID: CVE-2021-39346 State: PUBLISHED Published: 2021-11-01T20:59:29.030Z Last Updated: 2025-03-31T17:47:24.024Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Google Maps Easy Products: Google Maps Easy Problem Types: CWE-79 Description: The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/modules/marker_groups/views/tpl/mgrEditMarkerGroup.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.9.33. This affects multi-site installations where unfiltered_html
itrary web scripts, in versions up to and including 1.9.33. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/BigTiger2020/word-press/blob/main/Google%20Maps%20Easy.md - https://plugins.trac.wordpress.org/changeset/2620851/google-maps-easy/trunk/modules/marker_groups/views/tpl/mgrEditMarkerGroup.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39346
CVE ID: CVE-2021-39347 State: PUBLISHED Published: 2021-10-04T17:21:49.430Z Last Updated: 2025-03-31T18:11:15.927Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Stripe for WooCommerce Products: Stripe for WooCommerce Problem Types: CWE-862 Description: The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9. Additional Analyst Notes: - CVE Program Conta
urchases with their payment accounts. This affects versions 3.0.0 - 3.3.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39347 - https://plugins.trac.wordpress.org/changeset/2601162/woo-stripe-payment/trunk/includes/admin/class-wc-stripe-admin-user-edit.php
CVE ID: CVE-2021-39348 State: PUBLISHED Published: 2021-10-21T19:38:25.592Z Last Updated: 2025-02-14T17:55:29.986Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: LearnPress Products: LearnPress Problem Types: CWE-80 Description: The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites wher
ding 4.1.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Please note that this is seperate from CVE-2021-24702. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2614592%40learnpress&new=2614592%40learnpress&sfp_email=&sfph_mail= - https://wordfence.com/vulnerability-advisories/#CVE-2021-39348 - https://github.com/BigTiger2020/word-press/blob/main/LearnPress.md
CVE ID: CVE-2021-39349 State: PUBLISHED Published: 2021-10-15T12:15:58.251Z Last Updated: 2025-02-14T17:56:10.077Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Author Bio Box Products: Author Bio Box Problem Types: CWE-79 Description: The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.3.1. This affects multi-site installations where unfiltered_html is disabled for
pts, in versions up to and including 3.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39349 - https://github.com/BigTiger2020/word-press/blob/main/Author%20Bio%20Box.md - https://plugins.trac.wordpress.org/changeset/2613798/author-bio-box/tags/3.3.2/includes/admin/class-author-bio-box-admin.php
CVE ID: CVE-2021-39350 State: PUBLISHED Published: 2021-10-06T15:21:54.011Z Last Updated: 2025-02-14T18:27:18.032Z Vendors: FV Flowplayer Video Player Products: FV Flowplayer Video Player Problem Types: CWE-79 Description: The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39350 - https://plugins.trac.wordpress.org/changeset/2580834/fv-wordpress-fl
ence.com/vulnerability-advisories/#CVE-2021-39350 - https://plugins.trac.wordpress.org/changeset/2580834/fv-wordpress-flowplayer/trunk/view/stats.php
CVE ID: CVE-2021-39351 State: PUBLISHED Published: 2021-10-06T15:22:00.606Z Last Updated: 2025-02-14T18:24:43.170Z Vendors: WP Bannerize Products: WP Bannerize Problem Types: CWE-89 Description: The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39351 - https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wp
.com/vulnerability-advisories/#CVE-2021-39351 - https://plugins.trac.wordpress.org/browser/wp-bannerize/trunk/Classes/wpBannerizeAdmin.php#L1681
CVE ID: CVE-2021-39352 State: PUBLISHED Published: 2021-10-21T19:38:41.649Z Last Updated: 2025-02-14T17:54:38.315Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Catch Themes Demo Import Products: Catch Themes Demo Import Problem Types: CWE-434 Description: The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution. Additional Analys
administrative privileges to upload malicious files that can be used to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352 - https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php - https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md - http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html - http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html - https://github.com/Hacker5pre
acketstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html - https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352 - https://www.exploit-db.com/exploits/50580
CVE ID: CVE-2021-39353 State: PUBLISHED Published: 2021-11-19T15:34:11.033Z Last Updated: 2025-02-14T17:51:15.687Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Easy Registration Forms Products: Easy Registration Forms Problem Types: CWE-352 Description: The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found in the ~/includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 2.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.word
luding 2.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39353 - https://plugins.trac.wordpress.org/browser/easy-registration-forms/tags/2.1.1/includes/class-form.php#L256
CVE ID: CVE-2021-39354 State: PUBLISHED Published: 2021-10-21T19:38:58.093Z Last Updated: 2025-03-31T17:57:42.708Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Easy Digital Downloads Products: Easy Digital Downloads Problem Types: CWE-79 Description: The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfenc
g 2.11.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39354 - https://plugins.trac.wordpress.org/changeset/2616149/easy-digital-downloads/trunk/includes/admin/payments/class-payments-table.php - https://github.com/BigTiger2020/word-press/blob/main/Easy%20Digital%20Downloads.md
CVE ID: CVE-2021-39355 State: PUBLISHED Published: 2021-10-19T14:15:01.579Z Last Updated: 2025-02-14T17:55:50.738Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Indeed Job Importer Products: Indeed Job Importer Problem Types: CWE-79 Description: The Indeed Job Importer WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/indeed-job-importer/trunk/indeed-job-importer.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.5. This affects multi-site installations where unfiltered_ht
arbitrary web scripts, in versions up to and including 1.0.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39355 - https://plugins.trac.wordpress.org/browser/indeed-job-importer/trunk/indeed-job-importer.php#L224 - https://github.com/BigTiger2020/word-press/blob/main/Indeed%20Job%20Importer.md
CVE ID: CVE-2021-39356 State: PUBLISHED Published: 2021-10-21T19:38:35.787Z Last Updated: 2025-02-14T17:54:55.274Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Content Staging Products: Content Staging Problem Types: CWE-79 Description: The Content Staging WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via several parameters that are echo'd out via the ~/templates/settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.0.1. This affects multi-site installations where unfiltered_html is disabled for administr
ersions up to and including 2.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/content-staging/trunk/templates/settings.php - https://wordfence.com/vulnerability-advisories/#CVE-2021-39356 - https://github.com/BigTiger2020/word-press/blob/main/Content%20Staging.md
CVE ID: CVE-2021-39357 State: PUBLISHED Published: 2021-10-21T19:38:30.480Z Last Updated: 2025-02-14T17:55:12.748Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Leaky Paywall Products: Leaky Paywall Problem Types: CWE-79 Description: The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the ~/class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.16.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Addit
e installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset/2615195/leaky-paywall/trunk/class.php - https://wordfence.com/vulnerability-advisories/#CVE-2021-39357 - https://github.com/BigTiger2020/word-press/blob/main/Leaky%20Paywall.md
CVE ID: CVE-2021-39358 State: PUBLISHED Published: 2021-08-22T18:47:08 Last Updated: 2024-08-04T02:06:42.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libgfbgraph/-/issues/17 - https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/ - https://lists.fedoraproject.org/archive
upsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYI47UX6S5PAOWVWQ2KID64MCTXTH7SE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRCVZUNPTNFQQQCEZVP7RYY6OKHPDBC5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXXAF56BYLSES4UCLXKFCODZXTNAZ2G6/
CVE ID: CVE-2021-39359 State: PUBLISHED Published: 2021-08-22T00:00:00 Last Updated: 2024-08-04T02:06:42.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/ - https://gitlab.gnome.org/GNOME/libgda/-/issues/249 - https://lists.fedoraproject.org/archives/list/
cate-verification/ - https://gitlab.gnome.org/GNOME/libgda/-/issues/249 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLMVVIJNY5NMOT3FH36RFBWOTPVW7GME/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRPPP47WRCAPAEJGRMEKYYJZBQCYXTLQ/ - https://github.com/GNOME/libgda/commit/bd7b9568bcd9f6d3e6680bb04323a670c842a62d
CVE ID: CVE-2021-39360 State: PUBLISHED Published: 2021-08-22T18:46:40 Last Updated: 2024-08-04T02:06:42.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/ - https://gitlab.gnome.org/GNOME/libzapojit/-/issues/4 - https://lists.fedoraproject.org/archives/lis
cate-verification/ - https://gitlab.gnome.org/GNOME/libzapojit/-/issues/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNSIMQXP6VQWJXI7VW7ZCLCS4NWW465T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDXCHOCVP3VSAKDBQSLER2DQHFIOUHAT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UG7TUICJM4QJHI4QJ2RHOSQE2QWD3KO3/
CVE ID: CVE-2021-39361 State: PUBLISHED Published: 2021-08-22T18:46:17 Last Updated: 2024-08-04T02:06:42.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/ - https://gitlab.gnome.org/GNOME/evolution-rss/-/issues/11
CVE ID: CVE-2021-39362 State: PUBLISHED Published: 2021-08-22T19:04:28 Last Updated: 2024-08-04T02:06:42.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in ReCaptcha Solver 5.7. A response from Anti-Captcha.com, RuCaptcha.com, 2captcha.com, DEATHbyCAPTCHA.com, ImageTyperz.com, or BestCaptchaSolver.com in setCaptchaCode() is inserted into the DOM as HTML, resulting in full control over the user's browser by these servers. Additional Analyst Notes: - CVE Program Container: References: - https://thesamarkand.tumblr.com/post/660171228514009088/xss-vulnerability-in-recaptcha-solver-by-dozz
CVE ID: CVE-2021-39363 State: PUBLISHED Published: 2022-02-24T21:13:52 Last Updated: 2024-08-04T02:06:42.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved. Additional Analyst Notes: - CVE Program Container: References: - https://www.honeywell.com/us/en/product-security - https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices - https://buildings.honeywell.com/content/dam/hbtbt/en/documents/downloads/Security_Notification_SN_2022-01-26-01_CVE-2021-39363_Command_Injection
ell.com/content/dam/hbtbt/en/documents/downloads/Security_Notification_SN_2022-01-26-01_CVE-2021-39363_Command_Injection_HDZP252DI.pdf
CVE ID: CVE-2021-39364 State: PUBLISHED Published: 2022-02-24T21:13:07 Last Updated: 2024-08-04T02:06:42.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved. Additional Analyst Notes: - CVE Program Container: References: - https://www.honeywell.com/us/en/product-security - https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices - https://buildings.honeywell.com/content/dam/hbtbt/en/documents/downloads/Security_Notification_SN_2022-01-26-02_CVE-2021-39364_V
buildings.honeywell.com/content/dam/hbtbt/en/documents/downloads/Security_Notification_SN_2022-01-26-02_CVE-2021-39364_Video_Replay_HBW2PER1.pdf
CVE ID: CVE-2021-39365 State: PUBLISHED Published: 2021-08-22T21:18:23 Last Updated: 2024-08-04T02:06:42.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/ - https://gitlab.gnome.org/GNOME/grilo/-/issues/146 - https://www.debian.org/security/2021/dsa-4964 - https
erification/ - https://gitlab.gnome.org/GNOME/grilo/-/issues/146 - https://www.debian.org/security/2021/dsa-4964 - https://lists.debian.org/debian-lts-announce/2021/09/msg00010.html
CVE ID: CVE-2021-39367 State: PUBLISHED Published: 2021-08-22T23:21:03 Last Updated: 2024-08-04T02:06:42.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: Canon Oce Print Exec Workgroup 1.3.2 allows Host header injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IthacaLabs/Canon/tree/main/OCE_Print_Exec_Workgroup_Version_1_3_2/HHI
CVE ID: CVE-2021-39368 State: PUBLISHED Published: 2021-08-22T23:21:13 Last Updated: 2024-08-04T02:06:42.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IthacaLabs/Canon/tree/main/OCE_Print_Exec_Workgroup_Version_1_3_2/XSS_HTMLi
CVE ID: CVE-2021-39369 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T16:13:10.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=7zC84TNpIxw - https://www.usa.philips.com/healthcare - https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01