Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rg/plugins/image-hover-effects-ultimate/#developers - https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-6-1-unauthenticated-arbitrary-options-update-leading-to-full-website-compromise
CVE ID: CVE-2021-36889 State: PUBLISHED Published: 2021-12-20T20:08:22.410Z Last Updated: 2025-03-28T16:16:14.510Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: Tarteaucitron Products: tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin) Problem Types: CWE-79 Description: Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/tarteaucitronjs/#developers - https://patchstack.com/database/vulnerability/tarteaucitro
- https://wordpress.org/plugins/tarteaucitronjs/#developers - https://patchstack.com/database/vulnerability/tarteaucitronjs/wordpress-tarteaucitron-js-cookies-legislation-gdpr-plugin-1-6-multiple-stored-authenticated-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2021-36890 State: PUBLISHED Published: 2022-05-31T19:30:51.204Z Last Updated: 2025-02-20T20:20:20.091Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: supsystic.com Products: Social Share Buttons by Supsystic (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/social-share-buttons-by-supsystic/ - https://patchstack.com/database/vulnerability/social-share-buttons-by-supsystic/wordpress-social-share-buttons-by-sups
- https://patchstack.com/database/vulnerability/social-share-buttons-by-supsystic/wordpress-social-share-buttons-by-supsystic-plugin-2-2-2-cross-site-request-forgery-csrf-vulnerability
CVE ID: CVE-2021-36891 State: PUBLISHED Published: 2022-06-15T19:16:58.016Z Last Updated: 2025-02-20T20:18:27.663Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Supsystic Products: Photo Gallery by Supsystic (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/gallery-by-supsystic/#developers - https://patchstack.com/database/vulnerability/gallery-by-supsystic/wordpress-photo-gallery-by-supsyst
stic/#developers - https://patchstack.com/database/vulnerability/gallery-by-supsystic/wordpress-photo-gallery-by-supsystic-plugin-1-15-5-cross-site-request-forgery-csrf-leading-to-plugin-settings-change
CVE ID: CVE-2021-36893 State: PUBLISHED Published: 2022-04-11T19:37:48.651Z Last Updated: 2025-02-20T20:28:06.448Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: WP Darko Products: Responsive Tabs (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress plugin) <= 4.0.5 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/responsive-tabs/ - https://patchstack.com/database/vulnerability/responsive-tabs/wordpress-responsive-tabs-plugin-4-0-5-cross-site-scripting-xss-vulnerabili
k.com/database/vulnerability/responsive-tabs/wordpress-responsive-tabs-plugin-4-0-5-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36895 State: PUBLISHED Published: 2022-04-26T18:13:02.891Z Last Updated: 2025-02-20T20:25:13.382Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Tripetto Products: Tripetto (WordPress plugin) Problem Types: CWE-79 Description: Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/tripetto/#developers - https://patchstack.com/database/vulnerability/tripetto/wordpress-tripetto-plugin-5-1-4-unauthenticated-cross-site-scripting-xss-vulnerability-via-s
base/vulnerability/tripetto/wordpress-tripetto-plugin-5-1-4-unauthenticated-cross-site-scripting-xss-vulnerability-via-svg-image-upload
CVE ID: CVE-2021-36896 State: PUBLISHED Published: 2022-04-11T19:36:57.094Z Last Updated: 2025-02-20T20:28:20.605Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: W3 Eden, Inc. Products: Pricing Table (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/pricing-table/#developers - https://patchstack.com/database/vulnerability/pricing-table/wordpress-pricing-table-plugin-1-5-2-authenticated-stored-
- https://patchstack.com/database/vulnerability/pricing-table/wordpress-pricing-table-plugin-1-5-2-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36898 State: PUBLISHED Published: 2022-10-28T17:07:26.197Z Last Updated: 2025-02-20T19:57:35.698Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: ExpressTech Products: Quiz And Survey Master (WordPress plugin) Problem Types: CWE-89 Description: Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/quiz-master-next/#developers - https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-auth-sql-injection-sqli-vulnerability?_s_id=c
lnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-auth-sql-injection-sqli-vulnerability?_s_id=cve
CVE ID: CVE-2021-36899 State: PUBLISHED Published: 2022-10-11T17:02:09.977Z Last Updated: 2025-02-20T19:59:30.167Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Gabe Livan Products: Asset CleanUp: Page Speed Booster (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-asset-clean-up/wordpress-asset-cleanup-page-speed-booster-plugin-1-3-8-4-authenticated-reflected-cr
ase/vulnerability/wp-asset-clean-up/wordpress-asset-cleanup-page-speed-booster-plugin-1-3-8-4-authenticated-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/plugins/wp-asset-clean-up/#developers
CVE ID: CVE-2021-36901 State: PUBLISHED Published: 2022-06-15T13:09:30.897Z Last Updated: 2025-02-20T20:20:01.007Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Phil Baker Products: Age Gate (WordPress plugin) Problem Types: CWE-79 Description: Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/age-gate/#developers - https://patchstack.com/database/vulnerability/age-gate/wordpress-age-gate-plugin-2-17-0-unauthenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36905 State: PUBLISHED Published: 2022-11-17T22:02:18.619920Z Last Updated: 2024-09-16T16:22:38.099Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: ExpressTech Products: Quiz And Survey Master (WordPress plugin) Problem Types: CWE-79 Description: Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/quiz-master-next/#developers - https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-multiple-auth-stored-cross-sit
com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-multiple-auth-stored-cross-site-scripting-xss-vulnerabilities?_s_id=cve
CVE ID: CVE-2021-36906 State: PUBLISHED Published: 2022-11-03T19:33:45.799Z Last Updated: 2025-02-20T19:56:35.315Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: ExpressTech Products: Quiz And Survey Master (WordPress plugin) Problem Types: Insecure Direct Object References (IDOR) Description: Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/quiz-master-next/#developers - https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey
/quiz-master-next/#developers - https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-6-multiple-insecure-direct-object-references-idor-vulnerabilities?_s_id=cve
CVE ID: CVE-2021-36908 State: PUBLISHED Published: 2021-11-18T14:37:28.627Z Last Updated: 2025-03-28T16:48:04.612Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: WebFactory Ltd. Products: WP Reset PRO Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-reset/wordpress-wp-reset-pro-premium-plugin-5-98-cross-site-request-forgery-csrf-vulnerability-leading-to-database-reset?_s_id=cve - https://patchstack.com/wp-reset-pro-critical-vulnerab
t-forgery-csrf-vulnerability-leading-to-database-reset?_s_id=cve - https://patchstack.com/wp-reset-pro-critical-vulnerability-fixed/
CVE ID: CVE-2021-36909 State: PUBLISHED Published: 2021-11-18T14:41:05.970Z Last Updated: 2025-03-28T16:47:40.819Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WebFactory Ltd. Products: WP Reset PRO Problem Types: CWE-284 Description: Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpreset.com/changelog/ - https://patchstack.com/database/vulnerability/wp-reset/wordp
ulnrichment: References: - https://wpreset.com/changelog/ - https://patchstack.com/database/vulnerability/wp-reset/wordpress-wp-reset-pro-premium-plugin-5-98-authenticated-database-reset-vulnerability - https://patchstack.com/wp-reset-pro-critical-vulnerability-fixed/
CVE ID: CVE-2021-36910 State: PUBLISHED Published: 2022-04-11T19:36:55.404Z Last Updated: 2025-02-20T20:28:35.109Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: Marcel Schmilgeit Products: WP-Appbox (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wp-appbox/#developers - https://patchstack.com/database/vulnerability/wp-appbox/wordpress-wp-appbox-plugin-4-3-20-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36911 State: PUBLISHED Published: 2021-12-10T16:47:40.223Z Last Updated: 2025-03-28T16:45:04.792Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: @rex1989 Products: Comment Engine Pro (WordPress plugin) Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/comment-engine-pro/ - https://patchstack.com/database/vulnerability/comment-engine-pro/wordpress-comment-engine-pro-pl
s/comment-engine-pro/ - https://patchstack.com/database/vulnerability/comment-engine-pro/wordpress-comment-engine-pro-plugin-1-0-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36912 State: PUBLISHED Published: 2022-05-06T16:48:38.122Z Last Updated: 2025-02-20T20:23:32.858Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Andrea Pernici Products: Andrea Pernici News Sitemap for Google (WordPress plugin) Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or higher user role. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/google-news-sitemap/ - https://patchstack.com/database/vulnerability/google-news-sitemap/wo
ttps://wordpress.org/plugins/google-news-sitemap/ - https://patchstack.com/database/vulnerability/google-news-sitemap/wordpress-andrea-pernici-news-sitemap-for-google-plugin-1-0-16-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36913 State: PUBLISHED Published: 2022-10-11T17:04:23.133Z Last Updated: 2025-02-20T19:59:21.400Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: Qube One Products: Redirection for Contact Form 7 (WordPress plugin) Problem Types: CWE-284 Description: Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) AccessiBe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerabil
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpcf7-redirect/wordpress-redirection-for-contact-form-7-plugin-2-4-0-unauthenticated-options-change-vulnerability?_s_id=cve - https://wordpress.org/plugins/wpcf7-redirect/#developers
CVE ID: CVE-2021-36914 State: PUBLISHED Published: 2022-04-12T16:11:18.833Z Last Updated: 2025-02-20T20:27:25.674Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Desertsnowman, Shelob9 Products: CalderaWP License Manager (WordPress plugin) Problem Types: CWE-352, CWE-79 Description: Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CalderaWP/calderawp-license-manager - https://patchstack.com/database/vulnerability/calderawp-license-manager/wordpre
om/CalderaWP/calderawp-license-manager - https://patchstack.com/database/vulnerability/calderawp-license-manager/wordpress-calderawp-license-manager-plugin-1-2-11-cross-site-request-forgery-csrf-vulnerability-leading-to-reflected-cross-site-scripting-xss
CVE ID: CVE-2021-36915 State: PUBLISHED Published: 2022-10-11T19:33:59.929Z Last Updated: 2025-02-20T19:59:07.095Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Cozmoslabs Products: Profile Builder – User Profile & User Registration Forms (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file and updating the options. Requires Import and Export add-on. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/profile-builder/wordpress-profile-b
- CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/profile-builder/wordpress-profile-builder-plugin-3-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve - https://wordpress.org/plugins/profile-builder/#developers
CVE ID: CVE-2021-36916 State: PUBLISHED Published: 2021-11-24T16:29:41.073Z Last Updated: 2025-03-28T16:45:57.640Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: wpWave Products: Hide My WP (WordPress plugin) Problem Types: CWE-89 Description: The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwp_get_user_ip" tries to retrieve the IP address from multiple headers, including IP address headers that the user can spoof, such as "X-Forwarded-For." As a result, the malicious payload supplied in one of these IP address headers will
an spoof, such as "X-Forwarded-For." As a result, the malicious payload supplied in one of these IP address headers will be directly inserted into the SQL query, making SQL injection possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158 - https://patchstack.com/hide-my-wp-vulnerabilities-fixed/ - https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-sql-injection-sqli-vulnerability
CVE ID: CVE-2021-36917 State: PUBLISHED Published: 2021-11-24T16:19:08.984Z Last Updated: 2025-03-28T16:47:04.153Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: wpWave Products: Hide My WP (WordPress plugin) Problem Types: CWE-284 Description: WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158 - https://patchstack.com/hide-my-wp-vulnerabilities-fixed/
tem/hide-my-wp-amazing-security-plugin-for-wordpress/4177158 - https://patchstack.com/hide-my-wp-vulnerabilities-fixed/ - https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability
CVE ID: CVE-2021-36919 State: PUBLISHED Published: 2021-11-26T16:41:29.514Z Last Updated: 2025-03-28T16:45:19.788Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Awesome Support Products: Awesome Support (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/awesome-support/#developers - https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-supp
ugins/awesome-support/#developers - https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-0-6-multiple-authenticated-reflected-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2021-36920 State: PUBLISHED Published: 2022-01-14T19:11:39.468Z Last Updated: 2025-02-20T20:32:47.978Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: WPChill Products: Download Monitor (WordPress plugin) Problem Types: CWE-79 Description: Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/download-monitor/#developers - https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-reflected-cr
atchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-reflected-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36921 State: PUBLISHED Published: 2021-08-12T17:21:01 Last Updated: 2024-08-04T01:09:07.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 has Improper Authentication. An attacker can gain administrative access by modifying the response to an authentication check request. Additional Analyst Notes: - CVE Program Container: References: - https://www.monitorapp.com/waf/ - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0021/FEYE-2021-0021.md - https://github.com/monitorapp-aicc/report/wiki/CVE-2021-36921
CVE ID: CVE-2021-36922 State: PUBLISHED Published: 2021-11-02T12:36:57 Last Updated: 2024-08-04T01:09:06.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB devices (Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentinelone.com/resources/category/report/ - https://www.realtek.com/images/safe-report/Realtek_RtsUpx_Security_Advisory_Report.pdf
CVE ID: CVE-2021-36923 State: PUBLISHED Published: 2021-11-02T12:37:07 Last Updated: 2024-08-04T01:09:06.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB device privileged IN and OUT instructions (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentinelone.com/resources/category/report/ - https://www.realtek.com/images/safe-report/Realtek_RtsUp
ces: - https://www.sentinelone.com/resources/category/report/ - https://www.realtek.com/images/safe-report/Realtek_RtsUpx_Security_Advisory_Report.pdf
CVE ID: CVE-2021-36924 State: PUBLISHED Published: 2021-11-02T12:37:15 Last Updated: 2024-08-04T01:09:07.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to Escalation of Privileges, Denial of Service, and Code Execution) via a crafted Device IO Control packet to a device. Additional Analyst Notes: - CVE Program Container: References: - https://www.sentinelone.com/resources/category/report/ - https://www.realtek.com/images/safe-report/Realtek_RtsUpx_Security_Advisory_Report.pdf