Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-32834 State: PUBLISHED Published: 2021-09-09T01:50:10 Last Updated: 2024-08-03T23:33:55.953Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: eclipse Products: keti Problem Types: CWE-94 Description: Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063. Additional Analyst Notes: - CV
of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/
CVE ID: CVE-2021-32835 State: PUBLISHED Published: 2021-09-09T01:50:11 Last Updated: 2024-08-03T23:33:56.105Z Vendors: eclipse Products: keti Problem Types: CWE-693 Description: Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lead to post-authentication Remote Code execution. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/
CVE ID: CVE-2021-32836 State: PUBLISHED Published: 2021-09-09T02:05:11 Last Updated: 2024-08-03T23:33:55.932Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: zstackio Products: zstack Problem Types: CWE-94 Description: ZStack is open source IaaS(infrastructure as a service) software. In ZStack before versions 3.10.12 and 4.1.6 there is a pre-auth unsafe deserialization vulnerability in the REST API. An attacker in control of the request body will be able to provide both the class name and the data to be deserialized and therefore will be able to instantiate an arbitrary type and assign arbitrary values to its fields. This issue may lead to a Denial Of Service.
to instantiate an arbitrary type and assign arbitrary values to its fields. This issue may lead to a Denial Of Service. If a suitable gadget is available, then an attacker may also be able to exploit this vulnerability to gain pre-auth remote code execution. For additional details see the referenced GHSL-2021-087. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zstackio/zstack/security/advisories/GHSA-jfvq-548h-342x - https://securitylab.github.com/advisories/GHSL-2021-087-zstack/
CVE ID: CVE-2021-32837 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-03-10T21:22:55.702Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: python-mechanize Products: mechanize Problem Types: CWE-1333 Description: mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/a
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-108-python-mechanize-mechanize/ - https://github.com/python-mechanize/mechanize/blob/3acb1836f3fd8edc5a758a417dd46b53832ae3b5/mechanize/_urllib2_fork.py#L878-L879 - https://github.com/python-mechanize/mechanize/releases/tag/v0.4.6 - https://github.com/python-mechanize/mechanize/commit/dd05334448e9f39814bab044d2eaa5ef69b410d6 - https://lists.debian.org/debian-lts-announce/2023/06/msg00022.html
CVE ID: CVE-2021-32838 State: PUBLISHED Published: 2021-09-20T17:30:13 Last Updated: 2024-08-03T23:33:55.752Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: python-restx Products: flask-restx Problem Types: CWE-400 Description: Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/advisories/GHSA-3q6g-vf58-7m4g - https://github.com/python-restx/flask-restx/issues/372 - https://github.com/python-restx/flask
ies/GHSA-3q6g-vf58-7m4g - https://github.com/python-restx/flask-restx/issues/372 - https://github.com/python-restx/flask-restx/commit/bab31e085f355dd73858fd3715f7ed71849656da - https://github.com/python-restx/flask-restx/blob/fd99fe11a88531f5f3441a278f7020589f9d2cc0/flask_restx/inputs.py#L51 - https://pypi.org/project/flask-restx/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5UCTFVDU3677B5OBGK4EF5NMUPJLL6SQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUD6SWZLX52AAZUHDETJ2CDMQGEPGFL3/
CVE ID: CVE-2021-32839 State: PUBLISHED Published: 2021-09-20T17:10:12.000Z Last Updated: 2025-11-03T21:44:47.559Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: andialbrecht Products: sqlparse Problem Types: CWE-400 Description: sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sq
ature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf - https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb
CVE ID: CVE-2021-32840 State: PUBLISHED Published: 2022-01-26T21:05:10.000Z Last Updated: 2025-04-22T18:32:29.435Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: icsharpcode Products: sharpziplib Problem Types: CWE-22 Description: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in the parent directory of `destFolder`. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-1
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/ - https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3 - https://github.com/icsharpcode/SharpZipLib/commit/a0e96de70b5264f4c919b09253b1522bc7a221cc
CVE ID: CVE-2021-32841 State: PUBLISHED Published: 2022-01-26T21:10:15.000Z Last Updated: 2025-04-22T18:28:07.967Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: icsharpcode Products: sharpziplib Problem Types: CWE-22 Description: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because o
s possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/ - https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3 - https://github.com/icsharpcode/SharpZipLib/commit/5c3b293de5d65b108e7f2cd0ea8f81c1b8273f78
CVE ID: CVE-2021-32842 State: PUBLISHED Published: 2022-01-26T21:10:10.000Z Last Updated: 2025-04-22T18:32:19.882Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: icsharpcode Products: sharpziplib Problem Types: CWE-22 Description: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the di
user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/ - https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3
CVE ID: CVE-2021-32843 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-10T21:10:07.604Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: moby Products: hyperkit Problem Types: CWE-476 Description: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has is a call to `vc_cfgread` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit df0e46c7dbfd81a957d85e449ba41b52f6f7beb4. Additional Analyst Notes: - CVE Program Container: - CISA
is fixed in commit df0e46c7dbfd81a957d85e449ba41b52f6f7beb4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/ - https://github.com/moby/hyperkit/pull/313 - https://github.com/moby/hyperkit/commit/df0e46c7dbfd81a957d85e449ba41b52f6f7beb4
CVE ID: CVE-2021-32844 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-10T21:10:00.269Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: moby Products: hyperkit Problem Types: CWE-476 Description: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `vc_cfgwrite` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13. Additional Analyst Notes: - CVE Program Container: -
issue is fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/ - https://github.com/moby/hyperkit/pull/313 - https://github.com/moby/hyperkit/commit/451558fe8aaa8b24e02e34106e3bb9fe41d7ad13
CVE ID: CVE-2021-32845 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-10T21:09:53.340Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: moby Products: hyperkit Problem Types: CWE-908 Description: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to
ad(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/ - https://github.com/moby/hyperkit/pull/313 - https://github.com/moby/hyperkit/commit/41272a980197917df8e58ff90642d14dec8fe948
CVE ID: CVE-2021-32846 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-10T21:09:47.105Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: moby Products: hyperkit Problem Types: CWE-908 Description: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead to to uninitialized memory use. In this situation, there is a check for the return value to be less or equal to `VTSOCK_MAXSEGS`, but that check is not sufficient because the function can return `-1` if it finds an error it cannot recover from. Moreover, the negative return value will
ause the function can return `-1` if it finds an error it cannot recover from. Moreover, the negative return value will be used by `iovec_pull` in a while condition that can further lead to more corruption because the function is not designed to handle a negative `iov_len`. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit af5eba2360a7351c08dfd9767d9be863a50ebaba. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/ - https://github.com/moby/hyperkit/pull/313 - https://githu
tylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/ - https://github.com/moby/hyperkit/pull/313 - https://github.com/moby/hyperkit/commit/af5eba2360a7351c08dfd9767d9be863a50ebaba
CVE ID: CVE-2021-32847 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-10T21:09:34.018Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: moby Products: hyperkit Problem Types: CWE-125 Description: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability in the host by abusing the disk driver that may lead to the disclosure of the host memory into the virtualized guest. This issue is fixed in commit cf60095a4d8c3cb2e182a14415467afd356e982f. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
82a14415467afd356e982f. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-058-moby-hyperkit/ - https://github.com/moby/hyperkit/blob/2f061e447e1435cdf1b9eda364cea6414f2c606b/src/lib/pci_virtio_block.c#L316 - https://github.com/moby/hyperkit/commit/cf60095a4d8c3cb2e182a14415467afd356e982f
CVE ID: CVE-2021-32848 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-10T21:09:27.855Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: octobox Products: octobox Problem Types: CWE-770 Description: Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query string that will trigger a ReDoS vulnerability. This issue is fixed in PR 2807. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-100-octobox-octobox/ - https://github.com/octobox/octobox/pull/2
: - https://securitylab.github.com/advisories/GHSL-2021-100-octobox-octobox/ - https://github.com/octobox/octobox/pull/2807 - https://github.com/octobox/octobox/blob/372a0da981dbf47319fed4116364118fdf09fcc3/lib/search_parser.rb#L5
CVE ID: CVE-2021-32849 State: PUBLISHED Published: 2022-01-26T21:30:14.000Z Last Updated: 2025-04-22T18:27:54.222Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Gerapy Products: gerapy Problem Types: CWE-78 Description: Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-076-gerapy/ - https://github.com/Gerapy/Gerapy/security/advisories/GHSA-756h-r2c9-qp5j - https://git
dvisories/GHSL-2021-076-gerapy/ - https://github.com/Gerapy/Gerapy/security/advisories/GHSA-756h-r2c9-qp5j - https://github.com/Gerapy/Gerapy/issues/197 - https://github.com/Gerapy/Gerapy/issues/217 - https://lgtm.com/projects/g/Gerapy/Gerapy?mode=tree&ruleFocus=1505994646253
CVE ID: CVE-2021-32850 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-10T21:09:21.659Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: npm Products: @claviska/jquery-minicolors Problem Types: CWE-79 Description: jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3 - https://github.com/claviska/jquery-
hub.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3 - https://github.com/claviska/jquery-minicolors/releases/tag/2.3.6 - https://securitylab.github.com/advisories/GHSL-2021-1045_jQuery_MiniColors_Plugin/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDXBWA54A7D6HMR2TN5BAYNCU7HO2PUO/
CVE ID: CVE-2021-32851 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-10T21:09:14.445Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: npm Products: mind-elixir Problem Types: CWE-79 Description: Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This issue is patched in version 0.18.1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-1047_Mind-elixir/ - https://github.com/ssshooter/mind-elixir-core/commit/073485269ac83af24371f35bd08507defa88
/GHSL-2021-1047_Mind-elixir/ - https://github.com/ssshooter/mind-elixir-core/commit/073485269ac83af24371f35bd08507defa885655 - https://github.com/ssshooter/mind-elixir-core/blob/79942a68b14c8875ab7d270b1ad25bfff351b04c/src/plugin/contextMenu.js#L13
CVE ID: CVE-2021-32852 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-10T21:09:07.859Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Countly Products: countly-server Problem Types: CWE-79 Description: Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-104-countly-server/ - https://github.com/Countly/countly-server/releases/tag/v21.11 - https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95 - https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112
CVE ID: CVE-2021-32853 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-10T21:09:01.240Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: npm Products: erxes Problem Types: CWE-79 Description: Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/
rogram Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54 - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14
CVE ID: CVE-2021-32854 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-10T21:08:53.981Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: npm Products: textangular Problem Types: CWE-79 Description: textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no known patches. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-1001-textAngular/
CVE ID: CVE-2021-32855 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-10T21:08:46.394Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: npm Products: vditor Problem Types: CWE-79 Description: Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-1006-vditor/ - ht
Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2021-1006-vditor/ - https://github.com/Vanessa219/vditor/issues/1085 - https://github.com/Vanessa219/vditor/commit/1b2382d7f8a4ee509d9245db4450d926a0b24146