deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-40994
Published: 2021-10-15
Description: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40995
Published: 2021-10-15
Description: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40996
Published: 2021-10-15
Description: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 9.8 (CRITICAL)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40997
Published: 2021-10-15
Description: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 9.8 (CRITICAL)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2021-40998
Published: 2021-10-15
Description: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-018.txt
CVE: CVE-2020-4951
Published: 2021-10-15
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive information.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192027; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6491661
CVE: CVE-2021-28021
Published: 2021-10-15
Description: Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nothings/stb/issues/1108; https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TDGZFLBOP27LZKLH45WQLSNPSPP7S7Z/
CVE: CVE-2021-29679
Published: 2021-10-15
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include (SSI) directive. IBM X-Force ID: 199915.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199915; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6491661
CVE: CVE-2021-29745
Published: 2021-10-15
Description: IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' page to which they should not have access to. IBM X-Force ID: 201695.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201695; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6491661
CVE: CVE-2021-41320
Published: 2021-10-15
Description: A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the vendor disputes this because the password is not hardcoded (it can be changed during installation or at any later time).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-41320; https://client-connect.iongroup.com/library/content/treasury-management/wallstreet-suite/security/suite-7-4-83/user-passwords/; https://excellium-services.com/cert-xlm-advisory/CVE-2021-41320
CVE: CVE-2021-27561
Published: 2021-10-15
Description: Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://ssd-disclosure.com/?p=4688; https://ssd-disclosure.com/?p=4688; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27561
CVE: CVE-2018-16060
Published: 2021-10-15
Description: Mitsubishi Electric Europe B.V. SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: http://packetstormsecurity.com/files/164538/Mitsubishi-Electric-INEA-SmartRTU-Source-Code-Disclosure.html; https://drive.google.com/open?id=1QMHwTnBbIqrTkR0NEpnTKssYdi8vRsHH; http://packetstormsecurity.com/files/164538/Mitsubishi-Electric-INEA-SmartRTU-Source-Code-Disclosure.html
CVE: CVE-2018-16061
Published: 2021-10-15
Description: Mitsubishi Electric Europe B.V. SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164537/Mitsubishi-Electric-INEA-SmartRTU-Cross-Site-Scripting.html; https://drive.google.com/open?id=1DEZQqfpIgcflY2cF6O0y7vtlWYe8Wjjv; http://packetstormsecurity.com/files/164537/Mitsubishi-Electric-INEA-SmartRTU-Cross-Site-Scripting.html
CVE: CVE-2021-38297
Published: 2021-10-18
Description: Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://groups.google.com/forum/#%21forum/golang-announce; https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A; https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
CVE: CVE-2021-36097
Published: 2021-10-18
Description: Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.
CVSS Score: 3.5 (LOW)
CWE: CWE-266
References: https://otrs.com/release-notes/otrs-security-advisory-2021-20/; https://otrs.com/release-notes/otrs-security-advisory-2021-20/
CVE: CVE-2021-42565
Published: 2021-10-18
Description: myfactory.FMS before 7.1-912 allows XSS via the UID parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.redteam-pentesting.de/advisories/rt-sa-2021-001; https://www.redteam-pentesting.de/advisories/rt-sa-2021-001
CVE: CVE-2021-42566
Published: 2021-10-18
Description: myfactory.FMS before 7.1-912 allows XSS via the Error parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.redteam-pentesting.de/advisories/rt-sa-2021-001; https://www.redteam-pentesting.de/advisories/rt-sa-2021-001
CVE: CVE-2021-38562
Published: 2021-10-18
Description: Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://docs.bestpractical.com/release-notes/rt/index.html; https://github.com/bestpractical/rt/commit/70749bb66cb13dd70bd53340c371038a5f3ca57c; https://lists.debian.org/debian-lts-announce/2022/06/msg00019.html
CVE: CVE-2021-41611
Published: 2021-10-18
Description: An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2021/12/23/2; http://www.squid-cache.org/Versions/v6/changesets/squid-6-43d6b5c81b88ec2256b430c69a872a1e4f324e4a.patch; https://github.com/squid-cache/squid/security/advisories/GHSA-47m4-g3mv-9q5r
CVE: CVE-2010-2496
Published: 2021-10-18
Description: stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2010-2496; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2010-2496
CVE: CVE-2020-8291
Published: 2021-10-18
Description: A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/RocketChat/Rocket.Chat/pull/19854; https://github.com/RocketChat/Rocket.Chat/pull/19854
CVE: CVE-2021-21796
Published: 2021-10-18
Description: An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause an object containing the path to a document to be destroyed and then later reused, resulting in a use-after-free vulnerability, which can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1265; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1265
CVE: CVE-2021-21797
Published: 2021-10-18
Description: An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a reference to a timeout object to be stored in two different places. When closed, the document will result in the reference being released twice. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1266; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1266
CVE: CVE-2021-22942
Published: 2021-10-18
Description: A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: http://www.openwall.com/lists/oss-security/2021/12/14/5; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://weblog.rubyonrails.org/2021/8/19/Rails-6-0-4-1-and-6-1-4-1-have-been-released/
CVE: CVE-2021-22961
Published: 2021-10-18
Description: A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a file in the user path on first execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://hackerone.com/reports/1193641; https://hackerone.com/reports/1193641
CVE: CVE-2021-33023
Published: 2021-10-18
Description: Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-285-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-285-02
CVE: CVE-2021-38389
Published: 2021-10-18
Description: Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-285-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-285-02
CVE: CVE-2021-38426
Published: 2021-10-18
Description: FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06; https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE: CVE-2021-38430
Published: 2021-10-18
Description: FATEK Automation WinProladder versions 3.30 and prior proper validation of user-supplied data when parsing project files, which could result in a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06; https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE: CVE-2021-38434
Published: 2021-10-18
Description: FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an unexpected sign extension. An attacker could leverage this vulnerability to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-194
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06; https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE: CVE-2021-38436
Published: 2021-10-18
Description: FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a memory-corruption condition. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06; https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE: CVE-2021-38438
Published: 2021-10-18
Description: A use after free vulnerability in FATEK Automation WinProladder versions 3.30 and prior may be exploited when a valid user opens a malformed project file, which may allow arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06; https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE: CVE-2021-38440
Published: 2021-10-18
Description: FATEK Automation WinProladder versions 3.30 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to read unauthorized information.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06; https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE: CVE-2021-38442
Published: 2021-10-18
Description: FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a heap-corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06; https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE: CVE-2021-24412
Published: 2021-10-18
Description: The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c4ed3e52-cbe0-46dc-ab43-65de78cfb225; https://wpscan.com/vulnerability/c4ed3e52-cbe0-46dc-ab43-65de78cfb225
CVE: CVE-2021-24413
Published: 2021-10-18
Description: The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ce6d17c3-6741-4c80-ab13-e1824960ae24; https://wpscan.com/vulnerability/ce6d17c3-6741-4c80-ab13-e1824960ae24
CVE: CVE-2021-24415
Published: 2021-10-18
Description: The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fd312bfd-7c98-4682-877d-846442e9c6a2; https://wpscan.com/vulnerability/fd312bfd-7c98-4682-877d-846442e9c6a2
CVE: CVE-2021-24416
Published: 2021-10-18
Description: The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/260c7e2d-d48c-42d6-ae05-bad3f3bac01d; https://wpscan.com/vulnerability/260c7e2d-d48c-42d6-ae05-bad3f3bac01d
CVE: CVE-2021-24516
Published: 2021-10-18
Description: The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c; https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c
CVE: CVE-2021-24595
Published: 2021-10-18
Description: The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/c809bdb3-d820-4ce1-9cbc-e41985fb5052; https://wpscan.com/vulnerability/c809bdb3-d820-4ce1-9cbc-e41985fb5052
CVE: CVE-2021-24612
Published: 2021-10-18
Description: The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/12f1ed97-d392-449d-b25c-42d241693888; https://wpscan.com/vulnerability/12f1ed97-d392-449d-b25c-42d241693888
CVE: CVE-2021-24615
Published: 2021-10-18
Description: The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/9d48313b-76d7-4252-9b81-2fdd0373561b; https://wpscan.com/vulnerability/9d48313b-76d7-4252-9b81-2fdd0373561b
CVE: CVE-2021-24617
Published: 2021-10-18
Description: The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3e262cd7-ca64-4190-8d8c-38b07bbe63e0; https://wpscan.com/vulnerability/3e262cd7-ca64-4190-8d8c-38b07bbe63e0
CVE: CVE-2021-24622
Published: 2021-10-18
Description: The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/41a2c72c-7db1-473a-8844-47f6ae9d0594; https://wpscan.com/vulnerability/41a2c72c-7db1-473a-8844-47f6ae9d0594
CVE: CVE-2021-24642
Published: 2021-10-18
Description: The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/8d9129ab-33c3-44ee-b150-f7552d88e658; https://wpscan.com/vulnerability/8d9129ab-33c3-44ee-b150-f7552d88e658
CVE: CVE-2021-24672
Published: 2021-10-18
Description: The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/762c506a-f57d-450f-99c0-32d750306ddc; https://wpscan.com/vulnerability/762c506a-f57d-450f-99c0-32d750306ddc
CVE: CVE-2021-24675
Published: 2021-10-18
Description: The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/9b9a55d5-c121-4b5b-80df-f9f419c0dc55; https://wpscan.com/vulnerability/9b9a55d5-c121-4b5b-80df-f9f419c0dc55
CVE: CVE-2021-24677
Published: 2021-10-18
Description: The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://wpscan.com/vulnerability/40c7e424-9a97-41ab-a312-2a06b607609a; https://wpscan.com/vulnerability/40c7e424-9a97-41ab-a312-2a06b607609a
CVE: CVE-2021-24684
Published: 2021-10-18
Description: The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://wpscan.com/vulnerability/b5295bf9-8cf6-416e-b215-074742a5fc63; https://wpscan.com/vulnerability/b5295bf9-8cf6-416e-b215-074742a5fc63