Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t.</p> </li> <li><p>An advanced attacker with some inside knowledge of the target could take a copy of a working package, insert the malicious code (in the package itself or in the install), and then publish it to a public repository. The package will likely install and import correctly, granting the attacker an initial foothold and persistence.</p> </li> </ul> <p>These two methods could affect target organizations at any of these various levels:</p> <ul> <li>Developer machines</li> <li>An entire team if the configuration to import the malicious package is uploaded to a code repository</li> <li>Continuous integration pipelines if they pull the malicious packages during the build, test, and/o
e repository</li> <li>Continuous integration pipelines if they pull the malicious packages during the build, test, and/or deploy stages</li> <li>Customers, download servers, production services if the malicious code has not been detected</li> </ul> <p>This remote code execution vulnerability can only be addressed by reconfiguring installation tools and workflows, and not by correcting anything in the package repositories themselves. See the <strong>FAQ</strong> section of this CVE for configuration guidance.</p> Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24105
CVE ID: CVE-2021-24106 State: PUBLISHED Published: 2021-02-25T23:01:55 Last Updated: 2024-08-03T19:21:18.595Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2 Problem Types: Information Disclosure Description: Windows DirectX Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References:
ion: Windows DirectX Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24106
CVE ID: CVE-2021-24107 State: PUBLISHED Published: 2021-03-11T15:03:33 Last Updated: 2024-10-01T15:55:40.900Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1803, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows Server, version 1909 (Server Core installation), Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8
607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Information Disclosure Description: Windows Event Tracing Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24107
CVE ID: CVE-2021-24108 State: PUBLISHED Published: 2021-03-11T15:05:41 Last Updated: 2024-08-03T19:21:18.341Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1 Problem Types: Remote Code Execution Description: Microsoft Office Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24108
CVE ID: CVE-2021-24109 State: PUBLISHED Published: 2021-02-25T23:01:56 Last Updated: 2024-08-03T19:21:18.355Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Azure Kubernetes Service Problem Types: Elevation of Privilege Description: Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24109
CVE ID: CVE-2021-24110 State: PUBLISHED Published: 2021-03-11T15:06:18 Last Updated: 2024-08-03T19:21:18.211Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: HEVC Video Extensions Problem Types: Remote Code Execution Description: HEVC Video Extensions Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24110
CVE ID: CVE-2021-24111 State: PUBLISHED Published: 2021-02-25T23:01:57 Last Updated: 2024-08-03T19:21:18.371Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.8, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2 Problem Types: Denial of Service Description: .NET Framework Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24111
CVE ID: CVE-2021-24112 State: PUBLISHED Published: 2021-02-25T23:01:57 Last Updated: 2024-08-03T19:21:18.636Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Visual Studio 2019 for Mac, Mono 6.12.0, .NET Core 2.1, .NET Core 3.1, .NET 5.0 Problem Types: Remote Code Execution Description: .NET Core Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24112
CVE ID: CVE-2021-24113 State: PUBLISHED Published: 2021-02-25T23:01:58 Last Updated: 2024-08-03T19:21:18.545Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: Security Feature Bypass Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24113
CVE ID: CVE-2021-24114 State: PUBLISHED Published: 2021-02-25T23:01:58 Last Updated: 2024-08-03T19:21:18.311Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Teams for iOS Problem Types: Information Disclosure Description: Microsoft Teams iOS Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24114
CVE ID: CVE-2021-24115 State: PUBLISHED Published: 2021-02-22T01:57:58 Last Updated: 2024-08-03T19:21:18.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/randombit/botan/compare/2.17.2...2.17.3 - https://github.com/randombit/botan/pull/2549 - https://botan.randombit.net/news.html
CVE ID: CVE-2021-24116 State: PUBLISHED Published: 2021-07-14T12:47:27 Last Updated: 2024-08-03T19:21:18.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wolfSSL/wolfssl/releases - https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md
CVE ID: CVE-2021-24117 State: PUBLISHED Published: 2021-07-14T13:09:52 Last Updated: 2024-08-03T19:21:18.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX. Additional Analyst Notes: - CVE Program Container: References: - https://docs.rs/crate/sgx_tstd/1.1.1 - https://github.com/dingelish/rust-base64/commit/a554b7ae880553db6dde8a387101a093911d5b2a - https:
crate/sgx_tstd/1.1.1 - https://github.com/dingelish/rust-base64/commit/a554b7ae880553db6dde8a387101a093911d5b2a - https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md
CVE ID: CVE-2021-24119 State: PUBLISHED Published: 2021-07-14T00:00:00.000Z Last Updated: 2025-11-03T19:25:39.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/releases - https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md - htt
b.com/ARMmbed/mbedtls/releases - https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRRVY7DMTX3ECFNZKDYTSFEG5AI2HBC6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYJW7HAW3TDV2YMDFYXP3HD6WRQRTLJW/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2021-24122 State: PUBLISHED Published: 2021-01-14T14:45:18.000Z Last Updated: 2025-02-13T16:27:47.566Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-200 Description: When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances. Additional Analyst Notes: - CVE Program Co
nsistent behaviour of the Windows API (FindFirstFileW) in some circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d%40%3Cdev.tomee.apache.org%3E - http://www.openwall.com/lists/oss-securi
7495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d%40%3Cdev.tomee.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/01/14/1 - https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710%40%3Cdev.tomee.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/03/ms
ad77e74c13172d08034e20c18000fe710%40%3Cdev.tomee.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210212-0008/
CVE ID: CVE-2021-24123 State: PUBLISHED Published: 2021-03-18T14:57:47 Last Updated: 2024-08-03T19:21:18.642Z Vendors: Unknown Products: PowerPress Problem Types: CWE-434 Description: Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), allowing high privilege accounts (admin+) being able to upload arbitrary files, such as php, leading to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/43aa30bf-eaf8-467a-93a1-78f9bdb37b36
CVE ID: CVE-2021-24124 State: PUBLISHED Published: 2021-03-18T14:57:48 Last Updated: 2024-08-03T19:21:18.238Z Vendors: Unknown Products: WP Shieldon Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8d0eb0b4-0cc0-44e5-b720-90b01df3a6ee
CVE ID: CVE-2021-24125 State: PUBLISHED Published: 2021-03-18T14:57:48 Last Updated: 2024-08-03T19:21:18.649Z Vendors: Unknown Products: Contact Form Submissions Problem Types: CWE-89 Description: Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitting a filter request as a high privilege user (admin+) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8591b3c9-b041-4ff5-b8d9-6f9f81041178
CVE ID: CVE-2021-24126 State: PUBLISHED Published: 2021-03-18T14:57:48 Last Updated: 2024-08-03T19:21:18.224Z Vendors: Unknown Products: Envira Gallery Lite Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata (namely title) before outputting them in the generated gallery, which could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f3952bd1-ac2f-4007-9e19-6c44a22465f3
CVE ID: CVE-2021-24127 State: PUBLISHED Published: 2021-03-18T14:57:48 Last Updated: 2024-08-03T19:21:18.298Z Vendors: Unknown Products: ThirstyAffiliates Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was vulnerable to authenticated Stored Cross-Site Scripting (XSS), which could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1fbd9f7a-6f99-45a2-9d57-01631a1f35d6
CVE ID: CVE-2021-24128 State: PUBLISHED Published: 2021-03-18T14:57:48 Last Updated: 2024-08-03T19:21:18.315Z Vendors: Unknown Products: Team Members Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker (contributor+) to inject arbitrary web script or HTML via the 'Description/biography' of a member. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/11dc3325-e696-4c9e-ba10-968416d5c864
CVE ID: CVE-2021-24129 State: PUBLISHED Published: 2021-03-18T14:57:48 Last Updated: 2024-08-03T19:21:18.611Z Vendors: Unknown Products: Themify Portfolio Post Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c8537e5f-1948-418b-9d29-3cf50cd8f9a6
CVE ID: CVE-2021-24130 State: PUBLISHED Published: 2021-03-18T14:57:48 Last Updated: 2024-08-03T19:21:18.661Z Vendors: Unknown Products: WP Google Map Plugin Problem Types: CWE-89 Description: Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/46af9a4d-67ac-4e08-a753-a2a44245f4f8
CVE ID: CVE-2021-24131 State: PUBLISHED Published: 2021-03-18T14:57:48 Last Updated: 2024-08-03T19:21:18.274Z Vendors: Unknown Products: Anti-Spam by CleanTalk Problem Types: CWE-89 Description: Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, it requires high privilege user (admin+). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1bc28021-28c0-43fa-b89e-6b93c345e5d8
CVE ID: CVE-2021-24132 State: PUBLISHED Published: 2021-03-18T14:57:48 Last Updated: 2024-08-03T19:21:18.202Z Vendors: Unknown Products: Slider by 10Web Problem Types: CWE-89 Description: The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c1f45000-6c16-4606-be80-1938a755af2c
CVE ID: CVE-2021-24133 State: PUBLISHED Published: 2021-03-18T14:57:49 Last Updated: 2024-08-03T19:21:18.611Z Vendors: Unknown Products: ActiveCampaign Problem Types: CWE-352 Description: Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a72a5be4-654b-496f-94cd-3814c0e40120
CVE ID: CVE-2021-24134 State: PUBLISHED Published: 2021-03-18T14:57:49 Last Updated: 2024-08-03T19:21:18.263Z Vendors: Unknown Products: Constant Contact Forms Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8f3cca92-d072-4806-9142-7f1a987f840b
CVE ID: CVE-2021-24135 State: PUBLISHED Published: 2021-03-18T14:57:49 Last Updated: 2024-08-03T19:21:18.346Z Vendors: Unknown Products: WP Customer Reviews Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/07e9e70b-97a6-42e3-b0de-8cb69dedcbd3
CVE ID: CVE-2021-24136 State: PUBLISHED Published: 2021-03-18T14:57:49 Last Updated: 2024-08-03T19:21:18.510Z Vendors: Unknown Products: Testimonials Widget Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/537ee410-3833-4e88-9d4a-ee3c72b44ca1
CVE ID: CVE-2021-24137 State: PUBLISHED Published: 2021-03-18T14:57:49 Last Updated: 2024-08-03T19:21:18.663Z Vendors: Unknown Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-89 Description: Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9eb94e55-765b-4df5-baea-b247ef72aef3
CVE ID: CVE-2021-24138 State: PUBLISHED Published: 2021-03-18T14:57:49 Last Updated: 2024-08-03T19:21:18.282Z Vendors: Unknown Products: AdRotate Problem Types: CWE-89 Description: Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/aafac655-3616-4b27-9d0f-1cbc2faf0151
CVE ID: CVE-2021-24139 State: PUBLISHED Published: 2021-03-18T14:57:49 Last Updated: 2024-08-03T19:21:18.629Z Vendors: Unknown Products: Photo Gallery by 10Web Problem Types: CWE-89 Description: Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2e33088e-7b93-44af-aa6a-e5d924f86e28
CVE ID: CVE-2021-24140 State: PUBLISHED Published: 2021-03-18T14:57:49 Last Updated: 2024-08-03T19:21:18.284Z Vendors: Unknown Products: Ajax Load More Problem Types: CWE-89 Description: Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1876312e-3dba-4909-97a5-afbb76fbc056
CVE ID: CVE-2021-24141 State: PUBLISHED Published: 2021-03-18T14:57:49 Last Updated: 2024-08-03T19:21:18.793Z Vendors: Unknown Products: Advanced Database Cleaner Problem Types: CWE-89 Description: Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5c8adca0-fe19-4624-81ef-465b8d007f93