deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28660
Published: 2021-03-17
Description: rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2022/11/18/1; http://www.openwall.com/lists/oss-security/2022/11/21/2; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=74b6b20df8cfe90ada777d621b54c32e69e27cd7
CVE: CVE-2020-17457
Published: 2021-03-17
Description: Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCU_FILE_INIT field of a Save Configuration XML document. The payload is triggered in the HTTP error response pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.ts.fujitsu.com/IndexDownload.asp?Softwareguid=C67A44AE-B022-4150-8621-C4393C007ED9; https://www.gruppotim.it/redteam; https://support.ts.fujitsu.com/IndexDownload.asp?Softwareguid=C67A44AE-B022-4150-8621-C4393C007ED9
CVE: CVE-2019-18231
Published: 2021-03-17
Description: Advantech Spectre RT ERT351 Versions 5.1.3 and prior logins and passwords are transmitted in clear text form, which may allow an attacker to intercept the request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://ep.advantech-bb.cz/support/router-models/download/511/sa-2021-01-fw-5.1.3-and-older-en.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-054-03; https://ep.advantech-bb.cz/support/router-models/download/511/sa-2021-01-fw-5.1.3-and-older-en.pdf
CVE: CVE-2019-18233
Published: 2021-03-17
Description: In Advantech Spectre RT Industrial Routers ERT351 5.1.3 and prior, the affected product does not neutralize special characters in the error response, allowing attackers to use a reflected XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ep.advantech-bb.cz/support/router-models/download/511/sa-2021-01-fw-5.1.3-and-older-en.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-054-03; https://ep.advantech-bb.cz/support/router-models/download/511/sa-2021-01-fw-5.1.3-and-older-en.pdf
CVE: CVE-2019-18235
Published: 2021-03-17
Description: Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may allow an attacker to gain full access using a brute-force password attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://ep.advantech-bb.cz/support/router-models/download/511/sa-2021-01-fw-5.1.3-and-older-en.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-054-03; https://ep.advantech-bb.cz/support/router-models/download/511/sa-2021-01-fw-5.1.3-and-older-en.pdf
CVE: CVE-2021-20624
Published: 2021-03-18
Description: Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Scheduler via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36866/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20625
Published: 2021-03-18
Description: Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Bulletin Board via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36874/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20626
Published: 2021-03-18
Description: Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36864/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20627
Published: 2021-03-18
Description: Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36873/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20628
Published: 2021-03-18
Description: Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36868/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20629
Published: 2021-03-18
Description: Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36867/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20630
Published: 2021-03-18
Description: Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Phone Messages via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36872/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20631
Published: 2021-03-18
Description: Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of Custom App via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36871/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20632
Published: 2021-03-18
Description: Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Bulletin Board via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36870/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20633
Published: 2021-03-18
Description: Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36869/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20634
Published: 2021-03-18
Description: Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Custom App via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/jp/JVN45797538/index.html; https://kb.cybozu.support/article/36865/; https://jvn.jp/en/jp/JVN45797538/index.html
CVE: CVE-2021-20675
Published: 2021-03-18
Description: M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D) versions prior to Ver3.0, and type E (DL8-E) versions prior to Ver3.0) allows remote authenticated attackers to cause a denial of service (DoS) condition via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN47497535/index.html; https://www.m-system.co.jp/download_w/dl_dl8updaterE.html; https://jvn.jp/en/jp/JVN47497535/index.html
CVE: CVE-2021-20676
Published: 2021-03-18
Description: M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D) versions prior to Ver3.0, and type E (DL8-E) versions prior to Ver3.0) allows remote authenticated attackers to bypass access restriction and conduct prohibited operations via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://jvn.jp/en/jp/JVN47497535/index.html; https://www.m-system.co.jp/download_w/dl_dl8updaterE.html; https://jvn.jp/en/jp/JVN47497535/index.html
CVE: CVE-2021-20678
Published: 2021-03-18
Description: SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://jvn.jp/en/jp/JVN08191557/index.html; https://wordpress.org/plugins/paid-memberships-pro/; https://www.paidmembershipspro.com/pmpro-update-2-5-6/
CVE: CVE-2021-28667
Published: 2021-03-18
Description: StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the locale is not utf-8, and there is an attempt to log Unicode data (from an action or rule name).
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://stackstorm.com/2021/03/10/stackstorm-v3-4-1-security-fix/; https://stackstorm.com/2021/03/10/stackstorm-v3-4-1-security-fix/
CVE: CVE-2021-28681
Published: 2021-03-18
Description: Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/pion/webrtc/issues/1708; https://github.com/pion/webrtc/security/advisories/GHSA-74xm-qj29-cq8p; https://github.com/pion/webrtc/issues/1708
CVE: CVE-2021-22848
Published: 2021-03-18
Description: HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege.
CVSS Score: 7.0 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/tw/cp-132-4521-a4fd8-1.html; https://www.twcert.org.tw/tw/cp-132-4521-a4fd8-1.html
CVE: CVE-2021-3141
Published: 2021-03-18
Description: In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attacker, who could gain access to the Management Server and change the Stealth configuration.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=62; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=62
CVE: CVE-2021-28417
Published: 2021-03-18
Description: A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162914/Seo-Panel-4.8.0-Cross-Site-Scripting.html; https://github.com/seopanel/Seo-Panel/issues/208; http://packetstormsecurity.com/files/162914/Seo-Panel-4.8.0-Cross-Site-Scripting.html
CVE: CVE-2021-28418
Published: 2021-03-18
Description: A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162914/Seo-Panel-4.8.0-Cross-Site-Scripting.html; https://github.com/seopanel/Seo-Panel/issues/207; http://packetstormsecurity.com/files/162914/Seo-Panel-4.8.0-Cross-Site-Scripting.html
CVE: CVE-2021-28419
Published: 2021-03-18
Description: The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/162322/SEO-Panel-4.8.0-SQL-Injection.html; https://github.com/seopanel/Seo-Panel/issues/209; http://packetstormsecurity.com/files/162322/SEO-Panel-4.8.0-SQL-Injection.html
CVE: CVE-2021-28420
Published: 2021-03-18
Description: A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162914/Seo-Panel-4.8.0-Cross-Site-Scripting.html; https://github.com/seopanel/Seo-Panel/issues/206; http://packetstormsecurity.com/files/162914/Seo-Panel-4.8.0-Cross-Site-Scripting.html
CVE: CVE-2021-23359
Published: 2021-03-18
Description: This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/tylerjpeterson/port-killer/blob/1ca3a99ad80cc9ed5498d12b185189c10329025b/index.js%23L19; https://snyk.io/vuln/SNYK-JS-PORTKILLER-1078533; https://github.com/tylerjpeterson/port-killer/blob/1ca3a99ad80cc9ed5498d12b185189c10329025b/index.js%23L19
CVE: CVE-2021-26236
Published: 2021-03-18
Description: FastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file parsing functionality (BITMAPINFOHEADER Structure, 'BitCount' file format field), that will end up corrupting the Structure Exception Handler (SEH). Attackers could exploit this issue to achieve code execution when a user opens or views a malformed/specially crafted CUR file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://voidsec.com/advisories/cve-2021-26236-faststone-image-viewer-v-7-5-stack-based-buffer-overflow/; https://voidsec.com/fuzzing-faststone-image-viewer-cve-2021-26236; https://www.exploit-db.com/exploits/49660
CVE: CVE-2021-21623
Published: 2021-03-18
Description: An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2021/03/18/5; https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-2180; http://www.openwall.com/lists/oss-security/2021/03/18/5
CVE: CVE-2021-21624
Published: 2021-03-18
Description: An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2021/03/18/5; https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-2182; http://www.openwall.com/lists/oss-security/2021/03/18/5
CVE: CVE-2021-21625
Published: 2021-03-18
Description: Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2021/03/18/5; https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-2032; http://www.openwall.com/lists/oss-security/2021/03/18/5
CVE: CVE-2021-21626
Published: 2021-03-18
Description: Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2021/03/18/5; https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-2041; http://www.openwall.com/lists/oss-security/2021/03/18/5
CVE: CVE-2021-21627
Published: 2021-03-18
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2021/03/18/5; https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-1764; http://www.openwall.com/lists/oss-security/2021/03/18/5
CVE: CVE-2021-26233
Published: 2021-03-18
Description: FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfcb, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://voidsec.com/advisories/cve-2021-26233-faststone-image-viewer-v-7-5-user-mode-write-access-violation/; https://voidsec.com/advisories/cve-2021-26233-faststone-image-viewer-v-7-5-user-mode-write-access-violation/
CVE: CVE-2021-26234
Published: 2021-03-18
Description: FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d8a, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://voidsec.com/advisories/cve-2021-26234-faststone-image-viewer-v-7-5-user-mode-write-access-violation/; https://voidsec.com/advisories/cve-2021-26234-faststone-image-viewer-v-7-5-user-mode-write-access-violation/
CVE: CVE-2021-26235
Published: 2021-03-18
Description: FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfc9, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://voidsec.com/advisories/cve-2021-26235-faststone-image-viewer-v-7-5-user-mode-write-access-violation/; https://voidsec.com/advisories/cve-2021-26235-faststone-image-viewer-v-7-5-user-mode-write-access-violation/
CVE: CVE-2021-26237
Published: 2021-03-18
Description: FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d7d, triggered when a user opens or views a malformed CUR file that is mishandled by FSViewer.exe. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://voidsec.com/advisories/cve-2021-26237-faststone-image-viewer-v-7-5-user-mode-write-access-violation/; https://voidsec.com/advisories/cve-2021-26237-faststone-image-viewer-v-7-5-user-mode-write-access-violation/
CVE: CVE-2021-28133
Published: 2021-03-18
Description: Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/161897/Zoom-5.4.3-54779.1115-5.5.4-13142.0301-Information-Disclosure.html; http://seclists.org/fulldisclosure/2021/Mar/48; https://thehackernews.com/2021/03/new-zoom-screen-sharing-bug-lets-other.html
CVE: CVE-2021-24123
Published: 2021-03-18
Description: Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), allowing high privilege accounts (admin+) being able to upload arbitrary files, such as php, leading to RCE.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://wpscan.com/vulnerability/43aa30bf-eaf8-467a-93a1-78f9bdb37b36; https://wpscan.com/vulnerability/43aa30bf-eaf8-467a-93a1-78f9bdb37b36
CVE: CVE-2021-24124
Published: 2021-03-18
Description: Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/8d0eb0b4-0cc0-44e5-b720-90b01df3a6ee; https://wpscan.com/vulnerability/8d0eb0b4-0cc0-44e5-b720-90b01df3a6ee
CVE: CVE-2021-24125
Published: 2021-03-18
Description: Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitting a filter request as a high privilege user (admin+)
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/8591b3c9-b041-4ff5-b8d9-6f9f81041178; https://wpscan.com/vulnerability/8591b3c9-b041-4ff5-b8d9-6f9f81041178
CVE: CVE-2021-24126
Published: 2021-03-18
Description: Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata (namely title) before outputting them in the generated gallery, which could lead to privilege escalation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/f3952bd1-ac2f-4007-9e19-6c44a22465f3; https://wpscan.com/vulnerability/f3952bd1-ac2f-4007-9e19-6c44a22465f3
CVE: CVE-2021-24127
Published: 2021-03-18
Description: Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was vulnerable to authenticated Stored Cross-Site Scripting (XSS), which could lead to privilege escalation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/1fbd9f7a-6f99-45a2-9d57-01631a1f35d6; https://wpscan.com/vulnerability/1fbd9f7a-6f99-45a2-9d57-01631a1f35d6
CVE: CVE-2021-24128
Published: 2021-03-18
Description: Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker (contributor+) to inject arbitrary web script or HTML via the 'Description/biography' of a member.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/11dc3325-e696-4c9e-ba10-968416d5c864; https://wpscan.com/vulnerability/11dc3325-e696-4c9e-ba10-968416d5c864
CVE: CVE-2021-24129
Published: 2021-03-18
Description: Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/c8537e5f-1948-418b-9d29-3cf50cd8f9a6; https://wpscan.com/vulnerability/c8537e5f-1948-418b-9d29-3cf50cd8f9a6