Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
m Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/ - https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-44769/
CVE ID: CVE-2021-44771 State: REJECTED Published: 2021-12-28T18:25:21 Last Updated: 2021-12-28T18:25:21 Description: No description available.
CVE ID: CVE-2021-44775 State: PUBLISHED Published: 2023-04-25T18:33:38.887Z Last Updated: 2024-08-04T04:32:13.292Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-79 Description: Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/107691 - https://www.debian.org/security/2023/dsa-5399
CVE ID: CVE-2021-44776 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-05-07T15:52:23.428Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Lanner Inc Products: IAC-AST2500A Problem Types: CWE-284 Description: A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-fir
Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/blog/vulnerabilities-in-bmc-firmware-affect-ot-iot-device-security-part-1/ - https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-44776/
CVE ID: CVE-2021-44777 State: PUBLISHED Published: 2022-01-19T20:38:58.767Z Last Updated: 2025-02-20T20:32:40.620Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Prashant Baldha Products: Email Tracker (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/email-tracker/#developers - https://patchstack.com/database/vulnerability/email-tracker/wordpress-email-tracker-plugin-5-2
ail-tracker/#developers - https://patchstack.com/database/vulnerability/email-tracker/wordpress-email-tracker-plugin-5-2-6-cross-site-request-forgery-csrf-vulnerabilities-leading-to-single-or-bulk-e-mail-entries-deletion
CVE ID: CVE-2021-44779 State: PUBLISHED Published: 2022-02-04T22:29:16.585Z Last Updated: 2025-02-20T20:31:52.121Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: G.J.P. Products: [GWA] AutoResponder (WordPress plugin) Problem Types: CWE-89 Description: Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched version available, plugin closed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/gwa-autoresponder/ - https://patchstack.com/database/vulnerability/gwa-autoresponder/wordpress-gwa-auto
ress.org/plugins/gwa-autoresponder/ - https://patchstack.com/database/vulnerability/gwa-autoresponder/wordpress-gwa-autoresponder-plugin-2-3-unauthenticated-sql-injection-sqli-vulnerability
CVE ID: CVE-2021-44780 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:16.238Z Description: No description available.
CVE ID: CVE-2021-44781 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:15.806Z Description: No description available.
CVE ID: CVE-2021-44782 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:15.352Z Description: No description available.
CVE ID: CVE-2021-44783 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:14.914Z Description: No description available.
CVE ID: CVE-2021-44784 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:14.488Z Description: No description available.
CVE ID: CVE-2021-44785 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:14.045Z Description: No description available.
CVE ID: CVE-2021-44786 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:13.607Z Description: No description available.
CVE ID: CVE-2021-44787 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:13.175Z Description: No description available.
CVE ID: CVE-2021-44788 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:12.744Z Description: No description available.
CVE ID: CVE-2021-44789 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:12.302Z Description: No description available.
CVE ID: CVE-2021-44790 State: PUBLISHED Published: 2021-12-20T00:00:00 Last Updated: 2024-08-04T04:32:13.543Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-787 Description: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. Additional Analyst Notes: - CVE Program Container: References: - http://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2021/12/20/4 - htt
http://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2021/12/20/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/ - https://www.debian.org/security/2022/dsa-5035 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20211224-0001/ - https://www.tenable.com/security/tns-2022-01 - https://www.tenable.com/security/tns-2022-03 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ - https://lists.fedoraproject.org/archives/list/package-annou
edoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://support.apple.com/kb/HT213257 - https://support.apple.com/kb/HT213256 - https://support.apple.com/kb/HT213255 - http://seclists.org/fulldisclosure/2022/May/33 - http://seclists.org/fulldisclosure/2022/May/35 - http://seclists.org/fulldisclosure/2022/May/38 - https://security.gentoo.org/glsa/202208-20 - http
closure/2022/May/35 - http://seclists.org/fulldisclosure/2022/May/38 - https://security.gentoo.org/glsa/202208-20 - http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html
CVE ID: CVE-2021-44791 State: PUBLISHED Published: 2022-07-07T18:35:16 Last Updated: 2024-08-04T04:32:13.108Z Vendors: Apache Software Foundation Products: Apache Druid Problem Types: CWE-79 Description: In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/lh2kcl4j45q7xj4w6rqf6kwf0mvyp2o6
CVE ID: CVE-2021-44792 State: PUBLISHED Published: 2022-01-27T12:27:12.288958Z Last Updated: 2024-09-17T03:38:14.900Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Kron Products: Single Connect Problem Types: CWE-862 Description: Single Connect does not perform an authorization check when using the "log-monitor" module. A remote attacker could exploit this vulnerability to access the logging interface. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-22-0093
CVE ID: CVE-2021-44793 State: PUBLISHED Published: 2022-01-27T12:27:13.221647Z Last Updated: 2024-09-17T04:10:26.927Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Kron Products: Single Connect Problem Types: CWE-862 Description: Single Connect does not perform an authorization check when using the sc-reports-ui" module. A remote attacker could exploit this vulnerability to access the device configuration page and export the data to an external file. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information including the database credentials. Since the database runs with high privileges it is possible to execute com
formation including the database credentials. Since the database runs with high privileges it is possible to execute commands with the attained credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-22-0093
CVE ID: CVE-2021-44794 State: PUBLISHED Published: 2022-01-27T12:27:14.063432Z Last Updated: 2024-09-16T18:48:33.569Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Kron Products: Single Connect Problem Types: CWE-862 Description: Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module. A remote attacker could exploit this vulnerability to access the device information page. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-22-0093
CVE ID: CVE-2021-44795 State: PUBLISHED Published: 2022-01-27T12:27:14.892382Z Last Updated: 2024-09-17T00:40:52.613Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Kron Products: Single Connect Problem Types: CWE-862 Description: Single Connect does not perform an authorization check when using the "sc-assigned-credential-ui" module. A remote attacker could exploit this vulnerability to modify users permissions. The exploitation of this vulnerability might allow a remote attacker to delete permissions from other users without authenticating. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-22-0093
CVE ID: CVE-2021-44827 State: PUBLISHED Published: 2022-03-04T21:27:48 Last Updated: 2024-08-04T04:32:13.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/us/security - https://Full-Disclosure.eu - https://full-disclosure.eu/reports/2022/CVE-2021-44827-tplink-authenticated-remote-code-execution.html
CVE ID: CVE-2021-44828 State: PUBLISHED Published: 2022-01-14T19:49:05 Last Updated: 2024-08-04T04:32:13.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a non-privileged user to achieve write access to read-only memory, and possibly obtain root privileges, corrupt memory, and modify the memory of other processes. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver
CVE ID: CVE-2021-44829 State: PUBLISHED Published: 2022-01-20T16:24:36 Last Updated: 2024-08-04T04:32:13.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.afi-solutions.com/ - https://www.to.com - https://blog.to.com/advisory-webacms-2-1-0-cross-site-scripting/ - http://seclists.org/fulldisclosure/2022/Jan/41 - http://packetstormsecurity.com/files/165684/WebACMS-2.1.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-44832 State: PUBLISHED Published: 2021-12-28T19:35:11 Last Updated: 2024-08-04T04:32:13.076Z Vendors: Apache Software Foundation Products: Apache Log4j2 Problem Types: CWE-20, CWE-74 Description: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://tools.c
4j2 versions 2.17.1, 2.12.4, and 2.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd - https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143 - https://issues.apache.org/jira/browse/LOG4J2-3293 - http://www.openwall.com/lists/oss-security/2021/12/28/1 - https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html - https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/ - https://lists.fedoraproject.org/archives/list/pa
e%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC/ - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20220104-0001/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-44833 State: PUBLISHED Published: 2021-12-12T05:32:02 Last Updated: 2024-08-04T04:32:13.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opensearch-project/opensearch-cli/blob/275085730f791daccaac81c566a25f541656d9f9/commands/root.go#L43 - https://github.com/opensearch-project/opensearch-cli/commit/69dc712d0d0d05dc2bc2bd0d733c73e3641b633a
CVE ID: CVE-2021-44835 State: PUBLISHED Published: 2022-09-09T18:09:00 Last Updated: 2024-08-04T04:32:13.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Active Intelligent Visualization 5. The Vdc header is used in a SQL query without being sanitized. This causes SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.aivhub.com - https://gist.github.com/rntcruz23/199782fb65b7dc3c4492d168770b71e5
CVE ID: CVE-2021-44836 State: PUBLISHED Published: 2022-01-18T19:26:28 Last Updated: 2024-08-04T04:32:13.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Delta RM 1.2. The /risque/risque/workflow/reset endpoint is lacking access controls, and it is possible for an unprivileged user to reopen a risk with a POST request, using the risqueID parameter to identify the risk to be re-opened. Additional Analyst Notes: - CVE Program Container: References: - https://www.deltarm.com - https://gist.github.com/rntcruz23/01af412813c63d6e0cc41c26f52893be
CVE ID: CVE-2021-44837 State: PUBLISHED Published: 2022-01-19T13:42:36 Last Updated: 2024-08-04T04:32:13.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Delta RM 1.2. It is possible for an unprivileged user to access the same information as an admin user regarding the risk creation information in the /risque/administration/referentiel/json/create/categorie endpoint, using the id_cat1 query parameter to indicate the risk. Additional Analyst Notes: - CVE Program Container: References: - https://www.deltarm.com - https://gist.github.com/rntcruz23/8a91e6366a8247a0692c8ce2dfe87f21
CVE ID: CVE-2021-44838 State: PUBLISHED Published: 2022-01-18T19:06:57 Last Updated: 2024-08-04T04:32:12.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Delta RM 1.2. Using the /risque/risque/ajax-details endpoint, with a POST request indicating the risk to access with the id parameter, it is possible for users to access risks of other companies. Additional Analyst Notes: - CVE Program Container: References: - https://www.deltarm.com - https://gist.github.com/rntcruz23/6575c0ef45c30687c538361910bb8ab3
CVE ID: CVE-2021-44839 State: PUBLISHED Published: 2022-01-18T19:19:35 Last Updated: 2024-08-04T04:32:13.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Delta RM 1.2. It is possible to request a new password for any other account using the account ID. Using the /listes/DTsendmaildata/adm_utilisateur/send-mail.json endpoint, a user can send a JSON array with user IDs that will have their passwords reset (and new ones sent to their respective e-mail addresses). Additional Analyst Notes: - CVE Program Container: References: - https://www.deltarm.com - https://gist.github.com/rntcruz23/16ac2d9dfc7e32b0f57dc7b20f17cd29
CVE ID: CVE-2021-44840 State: PUBLISHED Published: 2022-01-18T18:25:50 Last Updated: 2024-08-04T04:32:13.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Delta RM 1.2. Using an privileged account, it is possible to edit, create, and delete risk labels, such as Criticality and Priority Indication labels. By using the /core/table/query endpoint, and by using a POST request and indicating the affected label with tableUid parameter and the operation with datas[query], it is possible to edit, create, and delete the following labels: Priority Indication, Quality Evaluation, Progress Margin and Priority. Furthermore, it is also possible to export Criticalit
rity Indication, Quality Evaluation, Progress Margin and Priority. Furthermore, it is also possible to export Criticality labels with an unprivileged user. Additional Analyst Notes: - CVE Program Container: References: - https://www.deltarm.com - https://gist.github.com/rntcruz23/81f83f9e406198b08ab40ffae8336a92
CVE ID: CVE-2021-44847 State: PUBLISHED Published: 2021-12-13T00:53:26 Last Updated: 2024-08-04T04:32:12.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calculation during the handling of received network packets) allows remote attackers to crash the process or potentially execute arbitrary code via a network packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TokTok/c-toxcore/pull/1718 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7
-toxcore/pull/1718 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7EBS3NIRYJ7V3PTNINP3PJSVUHGZTGA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLTKINSPO5T65LB3ZASDPCREKUE22RYE/
CVE ID: CVE-2021-44848 State: PUBLISHED Published: 2021-12-13T01:08:27 Last Updated: 2024-08-04T04:32:12.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cybelesoft/virtualui/issues/1 - http://packetstormsecurity.com/files/165327/Cibele-Thinfinity-VirtualUI-2.5.41.0-User-Enumeration.html
CVE ID: CVE-2021-44850 State: PUBLISHED Published: 2022-02-10T18:19:00 Last Updated: 2024-08-04T04:32:13.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use, an attacker can modify the boot header stored on an SD card so that a secure image appears to be unencrypted, and they will be able to modify the full range of register initialization values. Normally, these registers will be restricted when booting securely. Of importance to this attack are two registers that control
y, these registers will be restricted when booting securely. Of importance to this attack are two registers that control the SD card's transfer type and transfer size. These registers could be modified a way that causes a buffer overflow in the ROM. Additional Analyst Notes: - CVE Program Container: References: - https://support.xilinx.com/s/article/47915 - https://support.xilinx.com/s/article/76964
CVE ID: CVE-2021-44852 State: PUBLISHED Published: 2022-01-01T05:11:28 Last Updated: 2024-08-04T04:32:13.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the driver's device object and issue IOCTLs to read or write to arbitrary physical memory locations (or call an arbitrary address), leading to execution of arbitrary code. This is associated with 0x226040, 0x226044, and 0x226000. Additional Analyst Notes: - CVE Program Container: References: - https://nephosec.com/biostar-exploit/
CVE ID: CVE-2021-44854 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T15:55:34.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T292763 - https://security.gentoo.org/glsa/202305-24
CVE ID: CVE-2021-44855 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T15:52:12.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T293589 - https://security.gentoo.org/glsa/202305-24
CVE ID: CVE-2021-44856 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T15:49:47.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:ChangeContentModel due to the mishandling of the EditFilterMergedContent hook return value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T271037 - https://security.gentoo.org/glsa/202305-24