deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-22176
Published: 2021-06-22
Description: PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple areas. Remote unauthenticated users can exploit the vulnerability to obtain user sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-862
References: https://github.com/itodaro/PHPGurukul_Hospital_Management_System4.0_cve; https://github.com/itodaro/PHPGurukul_Hospital_Management_System4.0_cve
CVE: CVE-2021-34428
Published: 2021-06-22
Description: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
CVSS Score: 2.9 (LOW)
CWE: CWE-613, CWE-613
References: https://github.com/eclipse/jetty.project/security/advisories/GHSA-m6cp-vxjx-65j6; https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E; https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E
CVE: CVE-2020-18654
Published: 2021-06-22
Description: Cross Site Scripting (XSS) in Wuzhi CMS v4.1.0 allows remote attackers to execute arbitrary code via the "Title" parameter in the component "/coreframe/app/guestbook/myissue.php".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/174; https://github.com/wuzhicms/wuzhicms/issues/174
CVE: CVE-2021-22361
Published: 2021-06-22
Description: There is an improper authorization vulnerability in eCNS280 V100R005C00, V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200. A file access is not authorized correctly. Attacker with low access may launch privilege escalation in a specific scenario. This may compromise the normal service.
CVSS Score: 7.8 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-02-cgp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-02-cgp-en
CVE: CVE-2021-22365
Published: 2021-06-22
Description: There is an out of bounds read vulnerability in eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. A local attacker can exploit this vulnerability by sending specific message to the target device. Due to insufficient validation of internal message, successful exploit may cause the process and the service abnormal.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210526-02-outbounds-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210526-02-outbounds-en
CVE: CVE-2021-22366
Published: 2021-06-22
Description: There is an out-of-bounds read vulnerability in eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. The vulnerability is due to a function that handles an internal message contains an out-of-bounds read vulnerability. An attacker could crafted messages between system process, successful exploit could cause Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210526-03-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210526-03-dos-en
CVE: CVE-2021-32644
Published: 2021-06-22
Description: Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. This issue has been resolved in 4.4.3.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ampache/ampache/commit/c9453841e1b517a1660c3da1efd1fe5d623c93a5; https://github.com/ampache/ampache/security/advisories/GHSA-vqpj-xgw2-r54q; https://github.com/ampache/ampache/commit/c9453841e1b517a1660c3da1efd1fe5d623c93a5
CVE: CVE-2021-3044
Published: 2021-06-22
Description: An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 builds later than 1016923 and earlier than 1271064; Cortex XSOAR 6.2.0 builds earlier than 1271065. This issue does not impact Cortex XSOAR 5.5.0, Cortex XSOAR 6.0.0, Cortex XSOAR 6.0.1, or Cortex XSOAR 6.0.2 versions. All Cortex XSOAR instances hosted by Palo Alto Networks are upgraded to resolve this vulnerability. No additional action is required for these instances.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: https://security.paloaltonetworks.com/CVE-2021-3044; https://security.paloaltonetworks.com/CVE-2021-3044
CVE: CVE-2021-22342
Published: 2021-06-22
Description: There is an information leak vulnerability in Huawei products. A module does not deal with specific input sufficiently. High privilege attackers can exploit this vulnerability by performing some operations. This can lead to information leak. Affected product versions include: IPS Module versions V500R005C00, V500R005C10, V500R005C20; NGFW Module versions V500R005C00,V500R005C10, V500R005C20; SeMG9811 versions V500R005C00; USG9500 versions V500R001C00, V500R001C20, V500R001C30, V500R001C50, V500R001C60, V500R001C80, V500R005C00, V500R005C10, V500R005C20.
CVSS Score: 4.9 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210428-01-infomationleak-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210428-01-infomationleak-en
CVE: CVE-2021-22363
Published: 2021-06-22
Description: There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650. An attacker needs to perform specific operations to exploit the vulnerability on the affected device. Due to improper resource management of the function, the vulnerability can be exploited to cause service abnormal on affected devices.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210609-01-resource-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210609-01-resource-en
CVE: CVE-2021-22377
Published: 2021-06-22
Description: There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC500, S6700 V200R019C00SPC500 and S7700 V200R019C00SPC500. A module does not verify specific input sufficiently. Attackers can exploit this vulnerability by sending malicious parameters to inject command. This can compromise normal service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210602-01-cmdinj-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210602-01-cmdinj-en
CVE: CVE-2021-22378
Published: 2021-06-22
Description: There is a race condition vulnerability in eCNS280_TD V100R005C00 and V100R005C10. There is a timing window exists in which the database can be operated by another thread that is operating concurrently. Successful exploit may cause the affected device abnormal.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210602-01-cgp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210602-01-cgp-en
CVE: CVE-2021-22382
Published: 2021-06-22
Description: Huawei LTE USB Dongle products have an improper permission assignment vulnerability. An attacker can locally access and log in to a PC to induce a user to install a specially crafted application. After successfully exploiting this vulnerability, the attacker can perform unauthenticated operations. Affected product versions include:E3372 E3372h-153TCPU-V200R002B333D01SP00C00.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210602-01-permission-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210602-01-permission-en
CVE: CVE-2021-22383
Published: 2021-06-22
Description: There is an out-of-bounds read vulnerability in eCNS280_TD V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. The vulnerability is due to a message-handling function that contains an out-of-bounds read vulnerability. An attacker can exploit this vulnerability by sending a specific message to the target device, which could cause a Denial of Service (DoS).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210616-01-cgp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210616-01-cgp-en
CVE: CVE-2021-32699
Published: 2021-06-22
Description: Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually causing the physical server to stop responding. Users should upgrade to `1.4.4` to mitigate the issue. There is no non-code based workaround for impacted versions of the software. Users running customized versions of this software can manually set a PID limit for containers created.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/pterodactyl/wings/commit/e0078eee0a71d61573a94c75e6efcad069d78de3; https://github.com/pterodactyl/wings/security/advisories/GHSA-jj6m-r8jc-2gp7; https://github.com/pterodactyl/wings/commit/e0078eee0a71d61573a94c75e6efcad069d78de3
CVE: CVE-2021-32700
Published: 2021-06-22
Description: Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored. The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables. This has been patched in Ballerina 1.2.14 and Ballerina SwanLake alpha4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://github.com/ballerina-platform/ballerina-lang/commit/4609ffee1744ecd16aac09303b1783bf0a525816; https://github.com/ballerina-platform/ballerina-lang/security/advisories/GHSA-f5qg-fqrw-v5ww; https://github.com/ballerina-platform/ballerina-lang/commit/4609ffee1744ecd16aac09303b1783bf0a525816
CVE: CVE-2021-32701
Published: 2021-06-22
Description: ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired. Whether the token is granted or not to the `bar` scope, introspection will be valid. A patch will be released with `v0.38.12-beta.1`. Per default, caching is disabled for the `oauth2_introspection` authenticator. When caching is disabled, this vulnerability does not exist. The cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97) it seems that it only validates the token expiration date, but ignores whether the token has or not the proper scopes. The vulnerability was introduced in PR #424. During review, we failed to require appropriate test coverage by the submitter which is the primary reason that the vulnerability passed the review process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/ory/oathkeeper/commit/1f9f625c1a49e134ae2299ee95b8cf158feec932; https://github.com/ory/oathkeeper/pull/424; https://github.com/ory/oathkeeper/security/advisories/GHSA-qvp4-rpmr-xwrr
CVE: CVE-2020-36394
Published: 2021-06-22
Description: pam_setquota.c in the pam_setquota module before 2020-05-29 for Linux-PAM allows local attackers to set their quota on an arbitrary filesystem, in certain situations where the attacker's home directory is a FUSE filesystem mounted under /home.
CVSS Score: 7.0 (HIGH)
References: https://seclists.org/oss-sec/2020/q2/169; https://seclists.org/oss-sec/2020/q2/169
CVE: CVE-2021-34372
Published: 2021-06-22
Description: Trusty (the trusted OS produced by NVIDIA for Jetson devices) driver contains a vulnerability in the NVIDIA OTE protocol message parsing code where an integer overflow in a malloc() size calculation leads to a buffer overflow on the heap, which might result in information disclosure, escalation of privileges, and denial of service.
CVSS Score: 8.2 (HIGH)
CWE: CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5205; https://nvidia.custhelp.com/app/answers/detail/a_id/5205
CVE: CVE-2021-34390
Published: 2021-06-22
Description: Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow through a specific SMC call that is triggered by the user, which may lead to denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5205; https://nvidia.custhelp.com/app/answers/detail/a_id/5205
CVE: CVE-2021-34391
Published: 2021-06-22
Description: Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow through a specific SMC call that is triggered by the user, which may lead to denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5205; https://nvidia.custhelp.com/app/answers/detail/a_id/5205
CVE: CVE-2021-34392
Published: 2021-06-22
Description: Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundary checks, which might lead to denial of service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5205; https://nvidia.custhelp.com/app/answers/detail/a_id/5205
CVE: CVE-2021-34393
Published: 2021-06-22
Description: Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. This vulnerability might allow an attacker to exploit the deserializer to impact code execution, causing information disclosure.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-502
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5205; https://nvidia.custhelp.com/app/answers/detail/a_id/5205
CVE: CVE-2021-34394
Published: 2021-06-22
Description: Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows an attacker to use the malicious CA that is run by the user to cause the buffer overflow, which may lead to information disclosure and data modification.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-502
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5205; https://nvidia.custhelp.com/app/answers/detail/a_id/5205
CVE: CVE-2021-34395
Published: 2021-06-22
Description: Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user with local privileges, which might lead to limited information disclosure, a low risk of modifcations to data, and limited denial of service.
CVSS Score: 3.9 (LOW)
CWE: CWE-276
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5205; https://nvidia.custhelp.com/app/answers/detail/a_id/5205
CVE: CVE-2021-34396
Published: 2021-06-22
Description: Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite NVIDIA MB2 code, which would result in limited denial of service.
CVSS Score: 3.0 (LOW)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5205; https://nvidia.custhelp.com/app/answers/detail/a_id/5205
CVE: CVE-2021-34397
Published: 2021-06-22
Description: Bootloader contains a vulnerability in NVIDIA MB2, which may cause free-the-wrong-heap, which may lead to limited denial of service.
CVSS Score: 1.9 (LOW)
CWE: CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5205; https://nvidia.custhelp.com/app/answers/detail/a_id/5205
CVE: CVE-2021-27649
Published: 2021-06-23
Description: Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-29084
Published: 2021-06-23
Description: Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-29085
Published: 2021-06-23
Description: Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 8.6 (HIGH)
CWE: CWE-74
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-29086
Published: 2021-06-23
Description: Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-29087
Published: 2021-06-23
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to write arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-35210
Published: 2021-06-23
Description: Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021.html; https://github.com/contao/contao/security/advisories/GHSA-h58v-c6rf-g9f7; https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021.html
CVE: CVE-2021-21998
Published: 2021-06-23
Description: VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.vmware.com/security/advisories/VMSA-2021-0012.html?; https://www.vmware.com/security/advisories/VMSA-2021-0012.html?
CVE: CVE-2021-21999
Published: 2021-06-23
Description: VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 prior to 2103) contain a local privilege escalation vulnerability. An attacker with normal access to a virtual machine may exploit this issue by placing a malicious file renamed as `openssl.cnf' in an unrestricted directory which would allow code to be executed with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.vmware.com/security/advisories/VMSA-2021-0013.html; https://www.zerodayinitiative.com/advisories/ZDI-21-754/; https://www.vmware.com/security/advisories/VMSA-2021-0013.html
CVE: CVE-2021-31585
Published: 2021-06-23
Description: Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow local access.
CVSS Score: 6.7 (MEDIUM)
References: https://github.com/accellion/CVEs; https://github.com/accellion/CVEs/blob/main/CVE-2021-31585.txt; https://github.com/accellion/CVEs
CVE: CVE-2021-31586
Published: 2021-06-23
Description: Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/accellion/CVEs; https://github.com/accellion/CVEs/blob/main/CVE-2021-31586.txt; https://github.com/accellion/CVEs
CVE: CVE-2021-28976
Published: 2021-06-23
Description: Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1335; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1335
CVE: CVE-2021-28977
Published: 2021-06-23
Description: Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1336; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1336
CVE: CVE-2011-0023
Published: 2021-06-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2011-1177
Published: 2021-06-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2011-1942
Published: 2021-06-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2011-1955
Published: 2021-06-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2011-2926
Published: 2021-06-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-20389
Published: 2021-06-23
Description: Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1321; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1321
CVE: CVE-2020-20391
Published: 2021-06-23
Description: Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1322; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1322