Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-25923 State: PUBLISHED Published: 2021-06-24T10:52:31 Last Updated: 2024-08-03T20:11:28.477Z Vendors: n/a Products: openemr Problem Types: Weak Password Requirements Description: In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25923 - https://github.com/openemr/openemr/commit/28ca5c008d4a408b60001a67dfd3e0915f9181e0
CVE ID: CVE-2021-25924 State: PUBLISHED Published: 2021-04-01T17:58:47 Last Updated: 2024-08-03T20:11:28.452Z Vendors: n/a Products: gocd Problem Types: Cross-Site Request Forgery Description: In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25924%2C - https://github.com/gocd/gocd/commit/7d0baab0d361c3
ww.whitesourcesoftware.com/vulnerability-database/CVE-2021-25924%2C - https://github.com/gocd/gocd/commit/7d0baab0d361c377af84994f95ba76c280048548
CVE ID: CVE-2021-25925 State: PUBLISHED Published: 2021-04-12T13:48:51.000Z Last Updated: 2025-04-30T17:34:39.989Z Vendors: n/a Products: sickrage Problem Types: Cross-Site Scripting Description: in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4 - https://www.whiteso
References: - https://github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25925
CVE ID: CVE-2021-25926 State: PUBLISHED Published: 2021-04-12T13:45:57.000Z Last Updated: 2025-04-30T17:34:46.041Z Vendors: n/a Products: sickrage Problem Types: Cross-Site Scripting Description: In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25926%2C - https://github.c
nrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25926%2C - https://github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4
CVE ID: CVE-2021-25927 State: PUBLISHED Published: 2021-04-26T10:54:42.000Z Last Updated: 2025-04-30T20:23:08.316Z Vendors: n/a Products: safe-flat Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25927 - https://github.com/jessie-codes/safe-flat/commit/4b9b7db976bba8c968354f4315f5f9c219b7cbf3
CVE ID: CVE-2021-25928 State: PUBLISHED Published: 2021-04-26T10:54:47.000Z Last Updated: 2025-04-30T20:23:03.217Z Vendors: n/a Products: safe-obj Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25928 - https://github.com/mantacode/safe-obj/blob/6ab63529182b6cf11704ac84f10800290afd3f9f/lib/index.js#L122
CVE ID: CVE-2021-25929 State: PUBLISHED Published: 2021-05-20T14:09:45.000Z Last Updated: 2025-04-30T20:22:43.392Z Vendors: n/a Products: OpenNMS Problem Types: Cross-Site Scripting Description: In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downl
ndpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25929 - https://github.com/OpenNMS/opennms/commit/66c1f626bf38a7d1a9530b4d68598269ee5245a2
CVE ID: CVE-2021-25930 State: PUBLISHED Published: 2021-05-20T13:57:58.000Z Last Updated: 2025-04-30T20:22:48.246Z Vendors: n/a Products: OpenNMS Problem Types: Cross-Site Request Forgery Description: In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the
result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25930 - https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84 - https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c
CVE ID: CVE-2021-25931 State: PUBLISHED Published: 2021-05-20T14:54:36.000Z Last Updated: 2025-04-30T20:22:38.164Z Vendors: n/a Products: OpenNMS Problem Types: Cross-Site Request Forgery Description: In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator priv
DMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84 - https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25931
CVE ID: CVE-2021-25932 State: PUBLISHED Published: 2021-06-01T11:15:51 Last Updated: 2024-08-03T20:11:28.465Z Vendors: n/a Products: OpenNMS Problem Types: Cross-Site Scripting Description: In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database
e `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25932 - https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10e - https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01
CVE ID: CVE-2021-25933 State: PUBLISHED Published: 2021-05-20T14:59:24.000Z Last Updated: 2025-04-30T20:22:32.622Z Vendors: n/a Products: OpenNMS Problem Types: Cross-Site Scripting Description: In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary scr
to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c - https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10e - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25933 - https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01%2C
CVE ID: CVE-2021-25934 State: PUBLISHED Published: 2021-05-25T18:42:29 Last Updated: 2024-08-03T20:11:28.482Z Vendors: n/a Products: OpenNMS Problem Types: Cross-Site Scripting Description: In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in t
t to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c - https://github.com/OpenNMS/opennms/commit/101e3aa06ec9a1f8f266335fc6f5685c062c6117 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25934
CVE ID: CVE-2021-25935 State: PUBLISHED Published: 2021-05-25T18:32:59 Last Updated: 2024-08-03T20:11:28.488Z Vendors: n/a Products: OpenNMS Problem Types: Cross-Site Scripting Description: In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script whi
e` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25935 - https://github.com/OpenNMS/opennms/commit/101e3aa06ec9a1f8f266335fc6f5685c062c6117
CVE ID: CVE-2021-25938 State: PUBLISHED Published: 2021-05-24T10:54:10 Last Updated: 2024-08-03T20:11:28.489Z Vendors: n/a Products: ArangoDB Problem Types: Cross-Site Scripting Description: In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for leveraging self XSS by attackers. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25938 - https://github.com/arangodb/arangod
ences: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25938 - https://github.com/arangodb/arangodb/commit/3e486b9bc33cc97e92645dd279899000e57f61f4
CVE ID: CVE-2021-25939 State: PUBLISHED Published: 2022-02-09T12:15:14.213568Z Last Updated: 2024-09-16T18:29:04.751Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: arangodb Products: arangodb Problem Types: CWE-918 Description: In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vuln
to localhost. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25939 - https://github.com/arangodb/arangodb/commit/d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175 - https://github.com/arangodb/arangodb/commit/d9b7f019d2435f107b19a59190bf9cc27d5f34dd
CVE ID: CVE-2021-25940 State: PUBLISHED Published: 2021-11-16T09:25:09.000Z Last Updated: 2025-04-30T15:45:47.172Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: arangodb Products: arangodb Problem Types: CWE-613 Description: In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323
ntainer: - CISA ADP Vulnrichment: References: - https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25940
CVE ID: CVE-2021-25941 State: PUBLISHED Published: 2021-05-14T13:43:16.000Z Last Updated: 2025-04-30T20:22:53.346Z Vendors: n/a Products: deep-override Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25941 - https://github.com/ASaiAnudeep/deep-override/commit/2aced17651fb684959a6e04b1465a8329b3d5268
CVE ID: CVE-2021-25943 State: PUBLISHED Published: 2021-05-14T13:32:19.000Z Last Updated: 2025-04-30T20:22:58.308Z Vendors: n/a Products: 101 Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25943 - https://github.com/tjmehta/101/blob/d87f63ce2a4cbdc476e8287abd78327c3144d646/set.js#L52
CVE ID: CVE-2021-25944 State: PUBLISHED Published: 2021-05-25T18:26:38 Last Updated: 2024-08-03T20:19:18.518Z Vendors: n/a Products: deep-defaults Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25944
CVE ID: CVE-2021-25945 State: PUBLISHED Published: 2021-05-26T14:22:31 Last Updated: 2024-08-03T20:19:18.525Z Vendors: n/a Products: js-extend Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25945
CVE ID: CVE-2021-25946 State: PUBLISHED Published: 2021-05-25T18:48:25 Last Updated: 2024-08-03T20:19:18.523Z Vendors: n/a Products: nconf-toml Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25946 - https://github.com/RobLoach/nconf-toml/blob/8ade08cd1cfb9691ab7cc5c3514cc05c5085918f/index.js#L8
CVE ID: CVE-2021-25947 State: PUBLISHED Published: 2021-06-03T19:51:14 Last Updated: 2024-08-03T20:19:18.514Z Vendors: n/a Products: nestie Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25947
CVE ID: CVE-2021-25948 State: PUBLISHED Published: 2021-06-10T11:55:36 Last Updated: 2024-08-03T20:19:18.547Z Vendors: n/a Products: expand-hash Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25948 - https://github.com/doowb/expand-hash/blob/556913f6c2f05848110b5b8261cfc78e5ce3dc77/index.js#L19
CVE ID: CVE-2021-25949 State: PUBLISHED Published: 2021-06-10T12:00:13 Last Updated: 2024-08-03T20:19:18.991Z Vendors: n/a Products: set-getter Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25949 - https://github.com/doowb/set-getter/blob/5bc2750fe1c3db9651d936131be187744111378d/index.js#L56
CVE ID: CVE-2021-25950 State: REJECTED Published: 2021-06-23T14:11:13 Last Updated: 2021-06-23T14:11:13 Description: No description available.
CVE ID: CVE-2021-25951 State: PUBLISHED Published: 2021-06-30T11:42:24 Last Updated: 2024-08-03T20:19:18.944Z Vendors: n/a Products: XML2Dict Problem Types: XXE Description: XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25951
CVE ID: CVE-2021-25952 State: PUBLISHED Published: 2021-07-07T11:47:13 Last Updated: 2024-08-03T20:19:18.981Z Vendors: n/a Products: just-safe-set Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25952 - https://github.com/angus-c/just/commit/dd57a476f4bb9d78c6f60741898dc04c71d2eb53
CVE ID: CVE-2021-25953 State: PUBLISHED Published: 2021-07-14T10:34:46 Last Updated: 2024-08-03T20:19:18.976Z Vendors: n/a Products: putil-merge Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25953
CVE ID: CVE-2021-25954 State: PUBLISHED Published: 2021-08-09T16:58:31.962736Z Last Updated: 2024-09-17T00:31:24.945Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Dolibarr Products: dolibarr Problem Types: CWE-284 Description: In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25954 - h
es: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25954 - https://github.com/Dolibarr/dolibarr/commit/8cc100012d46282799fb19f735a53b7101569377
CVE ID: CVE-2021-25955 State: PUBLISHED Published: 2021-08-15T20:35:25.743897Z Last Updated: 2024-09-16T21:02:55.699Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Dolibarr Products: dolibarr Problem Types: CWE-79 Description: In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. In the worst case, the victim who inadvertently triggers the attack is a highly priv
ge containing the vulnerable field. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account takeover of the admin and due to other vulnerability (Improper Access Control on Private notes) a low privileged user can update the private notes which could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25955 - https://github.com/Dolibarr/dolibarr/commit/796b2d201acb9938b903fb2afa297db289ecc93e