deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-34344
Published: 2021-09-10
Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QUSBCam2. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QUSBCam2: QTS 4.5.4: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 5.0: QUSBCam2 2.0.1 ( 2021/08/03 ) and later QTS 4.3.6: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 4.3.3: QUSBCam2 1.1.4 ( 2021/08/06 ) and later QuTS hero 4.5.3: QUSBCam2 1.1.4 ( 2021/07/30 ) and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-21-34; https://www.qnap.com/en/security-advisory/qsa-21-34
CVE: CVE-2021-34345
Published: 2021-09-10
Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-21-36; https://www.qnap.com/en/security-advisory/qsa-21-36
CVE: CVE-2021-34346
Published: 2021-09-10
Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-21-36; https://www.qnap.com/en/security-advisory/qsa-21-36
CVE: CVE-2021-3645
Published: 2021-09-10
Description: merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/viking04/merge/commit/baba40332080b38b33840d2614df6d4142dedaf6; https://huntr.dev/bounties/ef387a9e-ca3c-4c21-80e3-d34a6a896262; https://github.com/viking04/merge/commit/baba40332080b38b33840d2614df6d4142dedaf6
CVE: CVE-2021-33011
Published: 2021-09-10
Description: All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be able to properly process an ICMP flood, which may allow an attacker to deny Ethernet communications between affected devices.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-245-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-245-02
CVE: CVE-2021-35976
Published: 2021-09-10
Description: The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.plesk.com/hc/en-us/articles/[PII_REDACTED]026; https://tarekbouali.com/cves/cve-2021-35976; https://www.bouali.io/cves/cve-2021-35976
CVE: CVE-2021-38326
Published: 2021-09-10
Description: The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-counter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/post-title-counter/tags/1.1/post-title-counter.php#L87; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38326; https://plugins.trac.wordpress.org/browser/post-title-counter/tags/1.1/post-title-counter.php#L87
CVE: CVE-2021-38327
Published: 2021-09-10
Description: The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/youtube-video-inserter/trunk/adminUI/settings.php#L67; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38327; https://plugins.trac.wordpress.org/browser/youtube-video-inserter/trunk/adminUI/settings.php#L67
CVE: CVE-2021-38328
Published: 2021-09-10
Description: The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/notices.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/notices/trunk/notices.php?rev=606181#L353; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38328; https://plugins.trac.wordpress.org/browser/notices/trunk/notices.php?rev=606181#L353
CVE: CVE-2021-38329
Published: 2021-09-10
Description: The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/dj-email-publish/tags/1.7.2/dj-email-publish.php#L259; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38329; https://plugins.trac.wordpress.org/browser/dj-email-publish/tags/1.7.2/dj-email-publish.php#L259
CVE: CVE-2021-38330
Published: 2021-09-10
Description: The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/yabp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/yabp/tags/1.4/yabp.php#L454; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38330; https://plugins.trac.wordpress.org/browser/yabp/tags/1.4/yabp.php#L454
CVE: CVE-2021-38331
Published: 2021-09-10
Description: The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.13.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-t-wap/tags/1.13.3/wap/writer.php#L34; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38331; https://plugins.trac.wordpress.org/browser/wp-t-wap/tags/1.13.3/wap/writer.php#L34
CVE: CVE-2021-38332
Published: 2021-09-10
Description: The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/ops-robots-txt/tags/1.0.0/settings.php#L175; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38332; https://plugins.trac.wordpress.org/browser/ops-robots-txt/tags/1.0.0/settings.php#L175
CVE: CVE-2021-38333
Published: 2021-09-10
Description: The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp-scrippets.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-scrippets/tags/1.5.1/wp-scrippets.php#L123; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38333; https://plugins.trac.wordpress.org/browser/wp-scrippets/tags/1.5.1/wp-scrippets.php#L123
CVE: CVE-2021-38334
Published: 2021-09-10
Description: The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-design-maps-places/tags/1.2/wpdmp-admin.php#L192; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38334; https://plugins.trac.wordpress.org/browser/wp-design-maps-places/tags/1.2/wpdmp-admin.php#L192
CVE: CVE-2021-38335
Published: 2021-09-10
Description: The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wiseagentleadform/tags/2.0/WiseAgentCaptureForm.php#L44; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38335; https://plugins.trac.wordpress.org/browser/wiseagentleadform/tags/2.0/WiseAgentCaptureForm.php#L44
CVE: CVE-2021-38336
Published: 2021-09-10
Description: The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/edit-comments-xt/tags/1.0/edit-comments-xt.php#L249; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38336; https://plugins.trac.wordpress.org/browser/edit-comments-xt/tags/1.0/edit-comments-xt.php#L249
CVE: CVE-2021-38337
Published: 2021-09-10
Description: The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/rsvpmaker-excel/tags/1.2/phpexcel/PHPExcel/Shared/JAMA/docs/download.php#L61; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38337; https://plugins.trac.wordpress.org/browser/rsvpmaker-excel/tags/1.2/phpexcel/PHPExcel/Shared/JAMA/docs/download.php#L61
CVE: CVE-2021-38338
Published: 2021-09-10
Description: The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/border-loading-bar/trunk/titan-framework/iframe-googlefont-preview.php#L39; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38338; https://plugins.trac.wordpress.org/browser/border-loading-bar/trunk/titan-framework/iframe-googlefont-preview.php#L39
CVE: CVE-2021-38339
Published: 2021-09-10
Description: The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.01.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-matted-thumbnails/tags/1.01/simple-matted-thumbnail.php#L122; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38339; https://plugins.trac.wordpress.org/browser/simple-matted-thumbnails/tags/1.01/simple-matted-thumbnail.php#L122
CVE: CVE-2021-38340
Published: 2021-09-10
Description: The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/webful-simple-grocery-shop/trunk/includes/add_product.php#L80; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38340; https://plugins.trac.wordpress.org/browser/webful-simple-grocery-shop/trunk/includes/add_product.php#L80
CVE: CVE-2021-38341
Published: 2021-09-10
Description: The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wc-payment-gateway-per-category/tags/2.0.10/includes/plugin_settings.php#L31; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38341; https://plugins.trac.wordpress.org/browser/wc-payment-gateway-per-category/tags/2.0.10/includes/plugin_settings.php#L31
CVE: CVE-2021-38347
Published: 2021-09-10
Description: The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-custom-website-data/tags/2.2/views/edit.php#L30; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38347; https://plugins.trac.wordpress.org/browser/simple-custom-website-data/tags/2.2/views/edit.php#L30
CVE: CVE-2021-38348
Published: 2021-09-10
Description: The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/advance-search/trunk/inc/admin/views/html-advance-search-admin-options.php#L88; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38348; https://plugins.trac.wordpress.org/browser/advance-search/trunk/inc/admin/views/html-advance-search-admin-options.php#L88
CVE: CVE-2021-38349
Published: 2021-09-10
Description: The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-moneybird/tags/2.1.1/templates/wcmb-admin.php#L8; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38349; https://plugins.trac.wordpress.org/browser/woo-moneybird/tags/2.1.1/templates/wcmb-admin.php#L8
CVE: CVE-2021-38350
Published: 2021-09-10
Description: The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/spideranalyse/trunk/analyse/index.php#L33; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38350; https://plugins.trac.wordpress.org/browser/spideranalyse/trunk/analyse/index.php#L33
CVE: CVE-2021-38351
Published: 2021-09-10
Description: The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe_options_subscribers.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/osd-subscribe/tags/1.2.3/options/osd_subscribe_options_subscribers.php#L86; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38351; https://plugins.trac.wordpress.org/browser/osd-subscribe/tags/1.2.3/options/osd_subscribe_options_subscribers.php#L86
CVE: CVE-2021-38352
Published: 2021-09-10
Description: The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/push-notification-by-feedify/tags/2.1.1/includes/base.php#L199; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38352; https://plugins.trac.wordpress.org/browser/push-notification-by-feedify/tags/2.1.1/includes/base.php#L199
CVE: CVE-2021-38353
Published: 2021-09-10
Description: The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/dropdown-and-scrollable-text/trunk/index.php?rev=2307131#L176; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38353; https://plugins.trac.wordpress.org/browser/dropdown-and-scrollable-text/trunk/index.php?rev=2307131#L176
CVE: CVE-2021-38354
Published: 2021-09-10
Description: The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/gnu-mailman-integration/trunk/includes/admin/mailing-lists-page.php?rev=859898#L34; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38354; https://plugins.trac.wordpress.org/browser/gnu-mailman-integration/trunk/includes/admin/mailing-lists-page.php?rev=859898#L34
CVE: CVE-2021-38355
Published: 2021-09-10
Description: The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bug-library/trunk/bug-library.php?rev=2571533#L1358; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38355; https://plugins.trac.wordpress.org/browser/bug-library/trunk/bug-library.php?rev=2571533#L1358
CVE: CVE-2021-38357
Published: 2021-09-10
Description: The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sms-ovh/trunk/sms-ovh-sent.php#L44; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38357; https://plugins.trac.wordpress.org/browser/sms-ovh/trunk/sms-ovh-sent.php#L44
CVE: CVE-2021-38358
Published: 2021-09-10
Description: The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/moolamojo/trunk/views/button-generator.html.php#L16; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38358; https://plugins.trac.wordpress.org/browser/moolamojo/trunk/views/button-generator.html.php#L16
CVE: CVE-2021-38359
Published: 2021-09-10
Description: The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/refer-a-friend-widget-for-wp/tags/1.4.1/admin/admin.php#L75; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38359; https://plugins.trac.wordpress.org/browser/refer-a-friend-widget-for-wp/tags/1.4.1/admin/admin.php#L75
CVE: CVE-2021-38360
Published: 2021-09-10
Description: The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which allows attackers to include local zip files and achieve remote code execution, in versions up to and including 0.0.
CVSS Score: 8.3 (HIGH)
CWE: CWE-22, CWE-829
References: https://plugins.trac.wordpress.org/browser/wp-publications/trunk/bibtexbrowser.php?rev=1830330#L49; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38360; https://plugins.trac.wordpress.org/browser/wp-publications/trunk/bibtexbrowser.php?rev=1830330#L49
CVE: CVE-2021-40373
Published: 2021-09-10
Description: playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via the index.php?app=main&inc=core_welcome URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/maikroservice/CVE-2021-40373; https://playsms.org/2021/09/04/playsms-1-4-5-released/; https://github.com/maikroservice/CVE-2021-40373
CVE: CVE-2021-37414
Published: 2021-09-10
Description: Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.manageengine.com/products/desktop-central/help/introduction/release_notes.html; https://www.manageengine.com/products/desktop-central/improper-access-control.html; https://www.manageengine.com/products/desktop-central/help/introduction/release_notes.html
CVE: CVE-2021-37418
Published: 2021-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-31874. Reason: This candidate is a reservation duplicate of CVE-2021-31874. Notes: All CVE users should reference CVE-2021-31874 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-37423
Published: 2021-09-10
Description: Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.
CVSS Score: 9.8 (CRITICAL)
References: https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release; https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release
CVE: CVE-2021-37422
Published: 2021-09-10
Description: Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release; https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release