alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-39225 (published 2021-10-25)
Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-639
Affected vendors: nextcloud
Affected products: deck
CVE-2021-39226 (published 2021-10-05)
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-287
Affected vendors: fedoraproject, grafana
Affected products: fedora, grafana
Added to CISA KEV catalog: 2022-08-25
KEV required action: Apply updates per vendor instructions.
CVE-2021-39227 (published 2021-09-17)
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1321
Affected vendors: baidu
Affected products: zrender
CVE-2021-39228 (published 2021-09-17)
Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the `state`, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct. The issue has been patched in version 0.11.6 by removing the optimization and always cloning the target expression of a Merge or Patch. If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to `state`.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: linuxfoundation
Affected products: tremor
CVE-2021-39229 (published 2021-09-20)
Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) are subject to a denial of service attack on an inefficient regular expression. The vulnerable regular expression is [here](https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359). The problem has been patched in release version 0.9.5.1. Users who are unable to upgrade are advised to remove `apprise/plugins/NotifyIFTTT.py` to eliminate the service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: nuxref
Affected products: apprise
CVE-2021-3923 (published 2023-03-27)
A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: fedoraproject, linux, redhat
Affected products: enterprise_linux, fedora, linux_kernel
CVE-2021-39230 (published 2021-09-21)
Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to the Trinity kernel. There are no workarounds.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: butter_project
Affected products: butter
CVE-2021-39231 (published 2021-11-19)
In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-862
Affected vendors: apache
Affected products: ozone
CVE-2021-39232 (published 2021-11-19)
In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: apache
Affected products: ozone
CVE-2021-39233 (published 2021-11-19)
In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-306
Affected vendors: apache
Affected products: ozone
CVE-2021-39234 (published 2021-11-19)
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-20
Affected vendors: apache
Affected products: ozone
CVE-2021-39235 (published 2021-11-19)
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-732
Affected vendors: apache
Affected products: ozone
CVE-2021-39236 (published 2021-11-19)
In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: apache
Affected products: ozone
CVE-2021-39237 (published 2021-11-03)
Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers may be vulnerable to potential information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: hp
Affected products: futuresmart_3, futuresmart_4, futuresmart_5
CVE-2021-39238 (published 2021-11-03)
Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential buffer overflow.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: hp
Affected products: futuresmart_3, futuresmart_4, futuresmart_5
CVE-2021-39239 (published 2021-09-16)
A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-611
Affected vendors: apache
Affected products: jena
CVE-2021-3924 (published 2021-11-05)
grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: getgrav
Affected products: grav
CVE-2021-39240 (published 2021-08-17)
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: debian, fedoraproject, haproxy
Affected products: debian_linux, fedora, haproxy
CVE-2021-39241 (published 2021-08-17)
An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: debian, fedoraproject, haproxy
Affected products: debian_linux, fedora, haproxy
CVE-2021-39242 (published 2021-08-17)
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-755
Affected vendors: debian, fedoraproject, haproxy
Affected products: debian_linux, fedora, haproxy
CVE-2021-39243 (published 2021-08-23)
Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via any CGI endpoint. This affects Nexto NX3003 1.8.11.0, Nexto NX3004 1.8.11.0, Nexto NX3005 1.8.11.0, Nexto NX3010 1.8.3.0, Nexto NX3020 1.8.3.0, Nexto NX3030 1.8.3.0, Nexto NX5100 1.8.11.0, Nexto NX5101 1.8.11.0, Nexto NX5110 1.1.2.8, Nexto NX5210 1.1.2.8, Nexto Xpress XP300 1.8.11.0, Nexto Xpress XP315 1.8.11.0, Nexto Xpress XP325 1.8.11.0, Nexto Xpress XP340 1.8.11.0, and Hadron Xtorm HX3040 1.7.58.0.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: altus
Affected products: hadron_xtorm_hx3040, hadron_xtorm_hx3040_firmware, nexto_nx3003, nexto_nx3003_firmware, nexto_nx3004, nexto_nx3004_firmware, nexto_nx3005, nexto_nx3005_firmware, nexto_nx3010, nexto_nx3010_firmware, nexto_nx3020, nexto_nx3020_firmware, nexto_nx3030, nexto_nx3030_firmware, nexto_nx5100, nexto_nx5100_firmware, nexto_nx5101, nexto_nx5101_firmware, nexto_nx5110, nexto_nx5110_firmware, nexto_nx5210, nexto_nx5210_firmware, nexto_xpress_xp300, nexto_xpress_xp300_firmware, nexto_xpress_xp315
CVE-2021-39244 (published 2021-08-23)
Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump feature. This affects Nexto NX3003 1.8.11.0, Nexto NX3004 1.8.11.0, Nexto NX3005 1.8.11.0, Nexto NX3010 1.8.3.0, Nexto NX3020 1.8.3.0, Nexto NX3030 1.8.3.0, Nexto NX5100 1.8.11.0, Nexto NX5101 1.8.11.0, Nexto NX5110 1.1.2.8, Nexto NX5210 1.1.2.8, Nexto Xpress XP300 1.8.11.0, Nexto Xpress XP315 1.8.11.0, Nexto Xpress XP325 1.8.11.0, Nexto Xpress XP340 1.8.11.0, and Hadron Xtorm HX3040 1.7.58.0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: altus
Affected products: hadron_xtorm_hx3040, hadron_xtorm_hx3040_firmware, nexto_nx3003, nexto_nx3003_firmware, nexto_nx3004, nexto_nx3004_firmware, nexto_nx3005, nexto_nx3005_firmware, nexto_nx3010, nexto_nx3010_firmware, nexto_nx3020, nexto_nx3020_firmware, nexto_nx3030, nexto_nx3030_firmware, nexto_nx5100, nexto_nx5100_firmware, nexto_nx5101, nexto_nx5101_firmware, nexto_nx5110, nexto_nx5110_firmware, nexto_nx5210, nexto_nx5210_firmware, nexto_xpress_xp300, nexto_xpress_xp300_firmware, nexto_xpress_xp315
CVE-2021-39245 (published 2021-08-23)
Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices. This affects Nexto NX3003 1.8.11.0, Nexto NX3004 1.8.11.0, Nexto NX3005 1.8.11.0, Nexto NX3010 1.8.3.0, Nexto NX3020 1.8.3.0, Nexto NX3030 1.8.3.0, Nexto NX5100 1.8.11.0, Nexto NX5101 1.8.11.0, Nexto NX5110 1.1.2.8, Nexto NX5210 1.1.2.8, Nexto Xpress XP300 1.8.11.0, Nexto Xpress XP315 1.8.11.0, Nexto Xpress XP325 1.8.11.0, Nexto Xpress XP340 1.8.11.0, and Hadron Xtorm HX3040 1.7.58.0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-798
Affected vendors: altus
Affected products: hadron_xtorm_hx3040, hadron_xtorm_hx3040_firmware, nexto_nx3003, nexto_nx3003_firmware, nexto_nx3004, nexto_nx3004_firmware, nexto_nx3005, nexto_nx3005_firmware, nexto_nx3010, nexto_nx3010_firmware, nexto_nx3020, nexto_nx3020_firmware, nexto_nx3030, nexto_nx3030_firmware, nexto_nx5100, nexto_nx5100_firmware, nexto_nx5101, nexto_nx5101_firmware, nexto_nx5110, nexto_nx5110_firmware, nexto_nx5210, nexto_nx5210_firmware, nexto_xpress_xp300, nexto_xpress_xp300_firmware, nexto_xpress_xp315
CVE-2021-39246 (published 2021-09-24)
Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-532
Affected vendors: apple, linux, microsoft, torproject
Affected products: linux_kernel, macos, tor_browser, windows
CVE-2021-39247 (published 2021-08-17)
Zint Barcode Generator before 2.10.0 has a one-byte buffer over-read, related to is_last_single_ascii in code1.c, and rs_encode_uint in reedsol.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: zint
Affected products: barcode_generator
CVE-2021-39248 (published 2021-08-17)
Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: edx
Affected products: edx-platform
CVE-2021-39249 (published 2021-08-17)
Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through a brute-force attack against the PHP mt_rand function.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-330
Affected vendors: invisioncommunity
Affected products: invision_power_board
CVE-2021-39250 (published 2021-08-17)
Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widgets, disclosure of the admin session ID in a Referer header, and the ability of an admin to use the templating engine (e.g., Edit HTML).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: invisioncommunity
Affected products: invision_power_board
CVE-2021-39251 (published 2021-09-07)
A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: debian, fedoraproject, redhat, tuxera
Affected products: debian_linux, enterprise_linux, fedora, ntfs-3g
CVE-2021-39252 (published 2021-09-07)
A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, fedoraproject, tuxera
Affected products: debian_linux, fedora, ntfs-3g
CVE-2021-39253 (published 2021-09-07)
A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, fedoraproject, tuxera
Affected products: debian_linux, fedora, ntfs-3g
CVE-2021-39254 (published 2021-09-07)
A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: debian, fedoraproject, tuxera
Affected products: debian_linux, fedora, ntfs-3g
CVE-2021-39255 (published 2021-09-07)
A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, tuxera
Affected products: debian_linux, ntfs-3g
CVE-2021-39256 (published 2021-09-07)
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, tuxera
Affected products: debian_linux, ntfs-3g
CVE-2021-39257 (published 2021-09-07)
A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-674
Affected vendors: debian, tuxera
Affected products: debian_linux, ntfs-3g
CVE-2021-39258 (published 2021-09-07)
A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, tuxera
Affected products: debian_linux, ntfs-3g
CVE-2021-39259 (published 2021-09-07)
A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, tuxera
Affected products: debian_linux, ntfs-3g
CVE-2021-39260 (published 2021-09-07)
A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, tuxera
Affected products: debian_linux, ntfs-3g
CVE-2021-39261 (published 2021-09-07)
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, tuxera
Affected products: debian_linux, ntfs-3g
CVE-2021-39262 (published 2021-09-07)
A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, tuxera
Affected products: debian_linux, ntfs-3g
CVE-2021-39263 (published 2021-09-07)
A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, tuxera
Affected products: debian_linux, ntfs-3g
CVE-2021-39267 (published 2021-08-18)
Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution (such as text/xml) are not blocked.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: salesagility
Affected products: suitecrm
CVE-2021-39268 (published 2021-08-18)
Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the clean_file_output protection mechanism can be bypassed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: salesagility
Affected products: suitecrm
CVE-2021-3927 (published 2021-11-05)
vim is vulnerable to Heap-based Buffer Overflow
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: debian, fedoraproject, vim
Affected products: debian_linux, fedora, vim
CVE-2021-39270 (published 2021-08-18)
In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-346
Affected vendors: pingidentity
Affected products: rsa_securid_integration_kit
CVE-2021-39271 (published 2021-08-30)
OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class attribute of a .bscw file. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: bscw
Affected products: bscw_classic
CVE-2021-39272 (published 2021-08-30)
Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-319
Affected vendors: fedoraproject, fetchmail
Affected products: fedora, fetchmail
CVE-2021-39273 (published 2021-08-19)
In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an unprivileged user to modify the application, modules, and configuration files. This leads to arbitrary code execution with root privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: xerosecurity
Affected products: sn1per
CVE-2021-39274 (published 2021-08-19)
In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user to modify the main application and the application configuration file. This results in arbitrary code execution with root privileges.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: xerosecurity
Affected products: sn1per
CVE-2021-39275 (published 2021-09-16)
ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apache, debian, fedoraproject, netapp, oracle, siemens
Affected products: cloud_backup, clustered_data_ontap, debian_linux, fedora, http_server, instantis_enterprisetrack, sinec_nms, sinema_server, storagegrid, zfs_storage_appliance_kit
CVE-2021-39278 (published 2021-09-07)
Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: moxa
Affected products: oncell_g3470a-lte-eu, oncell_g3470a-lte-eu-t, oncell_g3470a-lte-eu-t_firmware, oncell_g3470a-lte-eu_firmware, tap-323-eu-ct-t, tap-323-eu-ct-t_firmware, tap-323-jp-ct-t, tap-323-jp-ct-t_firmware, tap-323-us-ct-t, tap-323-us-ct-t_firmware, wac-1001, wac-1001-t, wac-1001-t_firmware, wac-1001_firmware, wac-2004, wac-2004_firmware, wdr-3124a-eu, wdr-3124a-eu-t, wdr-3124a-eu-t_firmware, wdr-3124a-eu_firmware, wdr-3124a-us, wdr-3124a-us-t, wdr-3124a-us-t_firmware, wdr-3124a-us_firmware
CVE-2021-39279 (published 2021-09-07)
Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: moxa
Affected products: oncell_g3470a-lte-eu, oncell_g3470a-lte-eu-t, oncell_g3470a-lte-eu-t_firmware, oncell_g3470a-lte-eu_firmware, tap-323-eu-ct-t, tap-323-eu-ct-t_firmware, tap-323-jp-ct-t, tap-323-jp-ct-t_firmware, tap-323-us-ct-t, tap-323-us-ct-t_firmware, wac-1001, wac-1001-t, wac-1001-t_firmware, wac-1001_firmware, wac-2004, wac-2004_firmware, wdr-3124a-eu, wdr-3124a-eu-t, wdr-3124a-eu-t_firmware, wdr-3124a-eu_firmware, wdr-3124a-us, wdr-3124a-us-t, wdr-3124a-us-t_firmware, wdr-3124a-us_firmware
CVE-2021-3928 (published 2021-11-05)
vim is vulnerable to Use of Uninitialized Variable
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-457
Affected vendors: debian, fedoraproject, vim
Affected products: debian_linux, fedora, vim
CVE-2021-39280 (published 2022-02-06)
Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affects 2212X before 1.9.1, 2212S before 1.9.1, 2212G before 1.8, 3220 V3 before 1.5.1, 3420 V3 before 1.5.1, and 2311 through 2022-01-31.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: korenix
Affected products: jetwave_2212g, jetwave_2212g_firmware, jetwave_2212s, jetwave_2212s_firmware, jetwave_2212x, jetwave_2212x_firmware, jetwave_2311, jetwave_2311_firmware, jetwave_3220, jetwave_3220_firmware, jetwave_3420, jetwave_3420_firmware
CVE-2021-39282 (published 2021-08-18)
Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: live555
Affected products: live555
CVE-2021-39283 (published 2021-08-18)
liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: live555
Affected products: live555
CVE-2021-39285 (published 2021-09-07)
A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8. An attacker can use the administration web interface URL to create a XSS based attack.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: versa-networks
Affected products: versa_director
CVE-2021-39286 (published 2021-08-18)
Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: webrecorder
Affected products: pywb
CVE-2021-39289 (published 2021-08-23)
Certain NetModule devices have Insecure Password Handling (cleartext or reversible encryption), These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, and NB3800.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: netmodule
Affected products: nb1600, nb1601, nb1800, nb1810, nb2700, nb2710, nb2800, nb2810, nb3700, nb3701, nb3710, nb3711, nb3720, nb3800, nb800, netmodule_router_software
CVE-2021-3929 (published 2022-08-25)
A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: fedoraproject, qemu
Affected products: fedora, qemu
CVE-2021-39290 (published 2021-08-23)
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, and NB3800.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-384
Affected vendors: netmodule
Affected products: nb1600, nb1601, nb1800, nb1810, nb2700, nb2710, nb2800, nb2810, nb3700, nb3701, nb3710, nb3711, nb3720, nb3800, nb800, netmodule_router_software
CVE-2021-39291 (published 2021-08-23)
Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, and NB3800.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-532
Affected vendors: netmodule
Affected products: nb1600, nb1601, nb1800, nb1810, nb2700, nb2710, nb2800, nb2810, nb3700, nb3701, nb3710, nb3711, nb3720, nb3800, nb800, netmodule_router_software
CVE-2021-39293 (published 2022-01-24)
In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: golang, netapp
Affected products: cloud_insights_telegraf, go
CVE-2021-39295 (published 2023-04-15)
In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: openbmc-project
Affected products: openbmc
CVE-2021-39296 (published 2021-09-09)
In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: openbmc-project
Affected products: openbmc
CVE-2021-39297 (published 2022-02-16)
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: hp
Affected products: 260_g3_desktop_mini_pc, 260_g3_desktop_mini_pc_firmware, elite_dragonfly, elite_dragonfly_firmware, elite_dragonfly_g2, elite_dragonfly_g2_firmware, elite_dragonfly_max, elite_dragonfly_max_firmware, elite_x2_1013_g3, elite_x2_1013_g3_firmware, elite_x2_g4, elite_x2_g4_firmware, elite_x2_g8_tablet, elite_x2_g8_tablet_firmware, elitebook_1050_g1, elitebook_1050_g1_firmware, elitebook_830_g5, elitebook_830_g5_firmware, elitebook_830_g6, elitebook_830_g6_firmware, elitebook_830_g7, elitebook_830_g7_firmware, elitebook_830_g8, elitebook_830_g8_firmware, elitebook_836_g5
CVE-2021-39298 (published 2022-02-16)
A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: hp
Affected products: 260_g3_desktop_mini_pc, 260_g3_desktop_mini_pc_firmware, elite_dragonfly, elite_dragonfly_firmware, elite_dragonfly_g2, elite_dragonfly_g2_firmware, elite_dragonfly_max, elite_dragonfly_max_firmware, elite_x2_1013_g3, elite_x2_1013_g3_firmware, elite_x2_g4, elite_x2_g4_firmware, elite_x2_g8_tablet, elite_x2_g8_tablet_firmware, elitebook_1050_g1, elitebook_1050_g1_firmware, elitebook_830_g5, elitebook_830_g5_firmware, elitebook_830_g6, elitebook_830_g6_firmware, elitebook_830_g7, elitebook_830_g7_firmware, elitebook_830_g8, elitebook_830_g8_firmware, elitebook_836_g5
CVE-2021-39299 (published 2022-02-16)
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: hp
Affected products: 260_g3_desktop_mini_pc, 260_g3_desktop_mini_pc_firmware, elite_dragonfly, elite_dragonfly_firmware, elite_dragonfly_g2, elite_dragonfly_g2_firmware, elite_dragonfly_max, elite_dragonfly_max_firmware, elite_x2_1013_g3, elite_x2_1013_g3_firmware, elite_x2_g4, elite_x2_g4_firmware, elite_x2_g8_tablet, elite_x2_g8_tablet_firmware, elitebook_1050_g1, elitebook_1050_g1_firmware, elitebook_830_g5, elitebook_830_g5_firmware, elitebook_830_g6, elitebook_830_g6_firmware, elitebook_830_g7, elitebook_830_g7_firmware, elitebook_830_g8, elitebook_830_g8_firmware, elitebook_836_g5
CVE-2021-3930 (published 2022-02-18)
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-193
Affected vendors: debian, qemu, redhat
Affected products: codeready_linux_builder, codeready_linux_builder_for_ibm_z_systems, codeready_linux_builder_for_power_little_endian, debian_linux, enterprise_linux, enterprise_linux_advanced_virtualization_eus, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_power_little_endian, openstack, qemu
CVE-2021-39300 (published 2022-02-16)
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: hp
Affected products: 260_g3_desktop_mini_pc, 260_g3_desktop_mini_pc_firmware, elite_dragonfly, elite_dragonfly_firmware, elite_dragonfly_g2, elite_dragonfly_g2_firmware, elite_dragonfly_max, elite_dragonfly_max_firmware, elite_x2_1013_g3, elite_x2_1013_g3_firmware, elite_x2_g4, elite_x2_g4_firmware, elite_x2_g8_tablet, elite_x2_g8_tablet_firmware, elitebook_1050_g1, elitebook_1050_g1_firmware, elitebook_830_g5, elitebook_830_g5_firmware, elitebook_830_g6, elitebook_830_g6_firmware, elitebook_830_g7, elitebook_830_g7_firmware, elitebook_830_g8, elitebook_830_g8_firmware, elitebook_836_g5
CVE-2021-39301 (published 2022-02-16)
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: hp
Affected products: 260_g3_desktop_mini_pc, 260_g3_desktop_mini_pc_firmware, elite_dragonfly, elite_dragonfly_firmware, elite_dragonfly_g2, elite_dragonfly_g2_firmware, elite_dragonfly_max, elite_dragonfly_max_firmware, elite_x2_1013_g3, elite_x2_1013_g3_firmware, elite_x2_g4, elite_x2_g4_firmware, elite_x2_g8_tablet, elite_x2_g8_tablet_firmware, elitebook_1050_g1, elitebook_1050_g1_firmware, elitebook_830_g5, elitebook_830_g5_firmware, elitebook_830_g6, elitebook_830_g6_firmware, elitebook_830_g7, elitebook_830_g7_firmware, elitebook_830_g8, elitebook_830_g8_firmware, elitebook_836_g5
CVE-2021-39302 (published 2021-08-19)
MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: misp-project
Affected products: misp
CVE-2021-39303 (published 2021-11-12)
The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-918
Affected vendors: jamf
Affected products: jamf
CVE-2021-39304 (published 2021-10-13)
Proofpoint Enterprise Protection before 8.12.0-2108090000 allows security control bypass.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: proofpoint
Affected products: enterprise_protection
CVE-2021-39306 (published 2021-12-22)
A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big size Authentication challenge text in WEP security.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: realtek
Affected products: rtl8195am, rtl8195am_firmware
CVE-2021-39307 (published 2021-09-15)
PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary JavaScript code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pdftron
Affected products: webviewer_ui
CVE-2021-39308 (published 2021-12-14)
The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the ~/processresponse.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.0.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: woo-myghpay-payment-gateway_project
Affected products: woo-myghpay-payment-gateway
CVE-2021-39309 (published 2021-12-14)
The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parameter due to a var_dump() on $_POST variables found in the ~/vendor/dpsoft/parsian-payment/sample/rollback-payment.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dpsoft
Affected products: parsian_bank_gateway_for_woocommerce
CVE-2021-3931 (published 2021-11-13)
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-352
Affected vendors: snipeitapp
Affected products: snipe-it
CVE-2021-39310 (published 2021-12-14)
The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: windyroad
Affected products: real_wysiwyg
CVE-2021-39311 (published 2021-12-14)
The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: link-list-manager_project
Affected products: link-list-manager
CVE-2021-39312 (published 2021-12-14)
The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: trueranker
Affected products: true_ranker
CVE-2021-39313 (published 2021-12-14)
The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: duogeek
Affected products: simple_image_gallery
CVE-2021-39314 (published 2021-12-14)
The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wanderlust-webdesign
Affected products: woo-enviopack
CVE-2021-39315 (published 2021-12-14)
The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: magic-post-voice_project
Affected products: magic-post-voice
CVE-2021-39316 (published 2021-08-31)
The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: digitalzoomstudio
Affected products: zoomsounds
CVE-2021-39317 (published 2021-10-11)
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.3.5 vmagazine-news <= 1.0.5 wpparallax <= 2.0.6 wp-store <= 1.1.9 zigcy-baby <= 1.0.6 zigcy-cosmetics <= 1.0.5 zigcy-lite <= 2.0.9
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-285
Affected vendors: accesspressthemes
Affected products: access_demo_importer, accesspress-lite, accesspress-mag, accesspress-parallax, accesspress-root, accesspress-store, accesspress_basic, agency-lite, arrival, bingle, bloger, brovy, construction-lite, doko, edict-lite, eight-sec, eightlaw-lite, eightmedi-lite, eightstore-lite, enlighten, fotography, opstore, parallaxsome, punte, revolve
CVE-2021-39318 (published 2021-12-14)
The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: h5p-css-editor_project
Affected products: h5p-css-editor
CVE-2021-39319 (published 2021-12-14)
The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: duogeek
Affected products: duofaq-responsive-flat-simple-faq
CVE-2021-3932 (published 2021-11-13)
twill is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-352
Affected vendors: area17
Affected products: twill
CVE-2021-39320 (published 2021-09-01)
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: underconstruction_project
Affected products: underconstruction
CVE-2021-39321 (published 2021-10-21)
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: heateor
Affected products: sassy_social_share