deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24751
Published: 2021-11-29
Description: The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e0131980-d2d3-4780-8a68-a81ee8c90b7a; https://wpscan.com/vulnerability/e0131980-d2d3-4780-8a68-a81ee8c90b7a
CVE: CVE-2021-24755
Published: 2021-11-29
Description: The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/01419d03-54d6-413d-9a67-64c63c26d741; https://wpscan.com/vulnerability/01419d03-54d6-413d-9a67-64c63c26d741
CVE: CVE-2021-24768
Published: 2021-11-29
Description: The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3673e13f-7ce6-4d72-b179-ae4bab55514c; https://wpscan.com/vulnerability/3673e13f-7ce6-4d72-b179-ae4bab55514c
CVE: CVE-2021-24811
Published: 2021-11-29
Description: The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/000e65f1-89cd-4dd5-a09d-5febd9fdfbdb; https://wpscan.com/vulnerability/000e65f1-89cd-4dd5-a09d-5febd9fdfbdb
CVE: CVE-2021-24822
Published: 2021-11-29
Description: The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/db84a782-d4c8-4abf-99ea-ea672a9b806e; https://wpscan.com/vulnerability/db84a782-d4c8-4abf-99ea-ea672a9b806e
CVE: CVE-2021-24842
Published: 2021-11-29
Description: The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-863
References: https://plugins.trac.wordpress.org/changeset/2618982; https://wpscan.com/vulnerability/054bd981-dbdd-47dd-bad0-fa327e5860a2; https://plugins.trac.wordpress.org/changeset/2618982
CVE: CVE-2021-24860
Published: 2021-11-29
Description: The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/d5891973-37d0-48cb-a5a3-a26c771b3369; https://wpscan.com/vulnerability/d5891973-37d0-48cb-a5a3-a26c771b3369
CVE: CVE-2021-24876
Published: 2021-11-29
Description: The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e77c2493-993d-418d-9629-a1f07b5a2b6f; https://wpscan.com/vulnerability/e77c2493-993d-418d-9629-a1f07b5a2b6f
CVE: CVE-2021-24883
Published: 2021-11-29
Description: The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2610975; https://wpscan.com/vulnerability/c5dd3812-ea20-4e05-a5d3-84830b452822; https://www.fortiguard.com/zeroday/FG-VD-21-069
CVE: CVE-2021-24889
Published: 2021-11-29
Description: The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/55008a42-eb56-436c-bce0-10ee616d0495; https://wpscan.com/vulnerability/55008a42-eb56-436c-bce0-10ee616d0495
CVE: CVE-2021-24899
Published: 2021-11-29
Description: The Media-Tags WordPress plugin through 3.2.0.2 does not sanitise and escape any of its Labels settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_htnl capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cf4b266c-d68e-4add-892a-d01a31987a4b; https://wpscan.com/vulnerability/cf4b266c-d68e-4add-892a-d01a31987a4b
CVE: CVE-2021-24908
Published: 2021-11-29
Description: The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/77f50129-4b1f-4e50-8321-9dd32deba6e1; https://wpscan.com/vulnerability/77f50129-4b1f-4e50-8321-9dd32deba6e1
CVE: CVE-2021-24915
Published: 2021-11-29
Description: The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917; https://wpscan.com/vulnerability/45ee86a7-1497-4c81-98b8-9a8e5b3d4fac; https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917
CVE: CVE-2021-24918
Published: 2021-11-29
Description: The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jetpack.com/2021/10/29/security-issues-patched-in-smash-balloon-social-post-feed-plugin/; https://wpscan.com/vulnerability/5d252ad7-bf28-44f3-8cd0-c4fe05c48f35; https://jetpack.com/2021/10/29/security-issues-patched-in-smash-balloon-social-post-feed-plugin/
CVE: CVE-2021-24927
Published: 2021-11-29
Description: The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/86f3acc7-8902-4215-bd75-6105d601524e; https://wpscan.com/vulnerability/86f3acc7-8902-4215-bd75-6105d601524e
CVE: CVE-2021-43698
Published: 2021-11-29
Description: phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. In file example.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET['query'] then there is a XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sparc/phpWhois.org/issues/21; https://github.com/sparc/phpWhois.org/issues/21
CVE: CVE-2021-43696
Published: 2021-11-29
Description: twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability. In file list.php, the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST then there is a XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/happyman/twmap/issues/57; https://github.com/happyman/twmap/issues/57
CVE: CVE-2021-43697
Published: 2021-11-29
Description: Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET{C('VAR_JSONP_HANDLER')] then there is a XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/happyliu2014/Workerman-ThinkPHP-Redis/issues/1; https://github.com/happyliu2014/Workerman-ThinkPHP-Redis/issues/1
CVE: CVE-2021-43695
Published: 2021-11-29
Description: issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability. In file page.backup_restore.php, the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST without sanitization, then there is a XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/IssabelFoundation/issabelPBX/issues/33; https://github.com/IssabelFoundation/issabelPBX/issues/33
CVE: CVE-2021-43692
Published: 2021-11-29
Description: youtube-php-mirroring (last update Jun 9, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytproxy/index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zxq2233/youtube-php-mirroring/issues/3; https://github.com/zxq2233/youtube-php-mirroring/issues/3
CVE: CVE-2021-43693
Published: 2021-11-29
Description: vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/serghey-rodin/vesta/issues/2052; https://github.com/serghey-rodin/vesta/issues/2052
CVE: CVE-2021-39995
Published: 2021-11-29
Description: Some Huawei products use the OpenHpi software for hardware management. A function that parses data returned by OpenHpi contains an out-of-bounds read vulnerability that could lead to a denial of service. Affected product versions include: eCNS280_TD V100R005C10; eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211124-03-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211124-03-dos-en
CVE: CVE-2021-3802
Published: 2021-11-29
Description: A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from this vulnerability is to system availability.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=2003649; https://lists.debian.org/debian-lts-announce/2023/04/msg00009.html; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-045.txt
CVE: CVE-2021-43691
Published: 2021-11-29
Description: tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php. The variable src is coming from $_SERVER["argv"] then there is a path manipulation vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/toocool/tripexpress/issues/40; https://github.com/toocool/tripexpress/issues/40
CVE: CVE-2021-42358
Published: 2021-11-29
Description: The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/contact-form-with-captcha/trunk/cfwc-form.php#L17; https://wordfence.com/vulnerability-advisories/#CVE-2021-42358; https://plugins.trac.wordpress.org/browser/contact-form-with-captcha/trunk/cfwc-form.php#L17
CVE: CVE-2021-42364
Published: 2021-11-29
Description: The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.0.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/stetic/trunk/stetic.php#L129; https://wordfence.com/vulnerability-advisories/#CVE-2021-42364; https://plugins.trac.wordpress.org/browser/stetic/trunk/stetic.php#L129
CVE: CVE-2021-42365
Published: 2021-11-29
Description: The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2635143/asgaros-forum/trunk/admin/tables/admin-structure-table.php; https://wordfence.com/vulnerability-advisories/#CVE-2021-42365; https://plugins.trac.wordpress.org/changeset/2635143/asgaros-forum/trunk/admin/tables/admin-structure-table.php
CVE: CVE-2021-44198
Published: 2021-11-29
Description: DLL hijacking could lead to local privilege escalation. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-2128; https://security-advisory.acronis.com/advisories/SEC-2128
CVE: CVE-2021-44199
Published: 2021-11-29
Description: DLL hijacking could lead to denial of service. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27305, Acronis Cyber Protect Home Office (Windows) before build 39612
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-2508; https://security-advisory.acronis.com/advisories/SEC-2508
CVE: CVE-2021-44200
Published: 2021-11-29
Description: Self cross-site scripting (XSS) was possible on devices page. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-2803; https://security-advisory.acronis.com/advisories/SEC-2803
CVE: CVE-2021-44201
Published: 2021-11-29
Description: Cross-site scripting (XSS) was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-3167; https://security-advisory.acronis.com/advisories/SEC-3167
CVE: CVE-2021-44202
Published: 2021-11-29
Description: Stored cross-site scripting (XSS) was possible in activity details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-3283; https://security-advisory.acronis.com/advisories/SEC-3283
CVE: CVE-2021-44203
Published: 2021-11-29
Description: Stored cross-site scripting (XSS) was possible in protection plan details. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-3294; https://security-advisory.acronis.com/advisories/SEC-3294
CVE: CVE-2021-34800
Published: 2021-11-29
Description: Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before build 27147
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://security-advisory.acronis.com/advisories/SEC-3145; https://security-advisory.acronis.com/advisories/SEC-3145
CVE: CVE-2021-43783
Published: 2021-11-29
Description: @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend host instance. This vulnerability can in some situation also be exploited through user input when executing a template, meaning you do not need write access to the templates. This method will not allow the attacker to control the contents of the injected file however, unless the template is also crafted in a specific way that gives control of the file contents. This vulnerability is fixed in version `0.15.14` of the `@backstage/plugin-scaffolder-backend`. This attack is mitigated by restricting access and requiring reviews when registering or modifying scaffolder templates.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/backstage/backstage/commit/f9352ab606367cd9efc6ff048915c70ed3013b7f; https://github.com/backstage/backstage/security/advisories/GHSA-mg3m-f475-28hv; https://github.com/backstage/backstage/commit/f9352ab606367cd9efc6ff048915c70ed3013b7f
CVE: CVE-2021-43786
Published: 2021-11-29
Description: Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/; https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500; https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
CVE: CVE-2021-43787
Published: 2021-11-29
Description: Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-1321, CWE-79, CWE-1321
References: https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/; https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f[PII_REDACTED]61ff2ed7755e4c; https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
CVE: CVE-2021-43788
Published: 2021-11-29
Description: Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/; https://github.com/NodeBB/NodeBB/commit/c8b2fc46dc698db687379106b3f01c71b80f495f; https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
CVE: CVE-2021-44427
Published: 2021-11-29
Description: An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitlab.com/francoisjacquet/rosariosis/-/issues/328; https://gitlab.com/francoisjacquet/rosariosis/-/issues/328
CVE: CVE-2021-44428
Published: 2021-11-29
Description: Pinkie 2.15 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcode 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.exploit-db.com/exploits/50535; https://www.exploit-db.com/exploits/50535
CVE: CVE-2021-44429
Published: 2021-11-29
Description: Serva 4.4.0 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcode 1, a related issue to CVE-2013-0145.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://packetstormsecurity.com/files/165058/Serva-4.4.0-TFTP-Remote-Buffer-Overflow.html; https://packetstormsecurity.com/files/165058/Serva-4.4.0-TFTP-Remote-Buffer-Overflow.html
CVE: CVE-2021-43790
Published: 2021-11-30
Description: Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption, data race, or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. As a result of this bug, and dependent on the memory backing for the Instance objects, it is possible to trigger a use-after-free when the Instance is dropped. Users should upgrade to the main branch of the Lucet repository. Lucet no longer provides versioned releases on crates.io. There is no way to remediate this vulnerability without upgrading.
CVSS Score: 8.5 (HIGH)
CWE: CWE-416
References: https://crates.io/crates/lucet-runtime; https://github.com/bytecodealliance/lucet/commit/7c7757c772fb709c61b1442bcc1e1fbee97bf4a8; https://github.com/bytecodealliance/lucet/security/advisories/GHSA-hf79-8hjp-rrvq
CVE: CVE-2021-3725
Published: 2021-11-30
Description: Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-94
References: https://github.com/ohmyzsh/ohmyzsh/commit/06fc5fb; https://github.com/ohmyzsh/ohmyzsh/commit/06fc5fb
CVE: CVE-2021-3726
Published: 2021-11-30
Description: # Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. **Fixed in**: [a263cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac; https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac
CVE: CVE-2021-3727
Published: 2021-11-30
Description: # Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/ohmyzsh/ohmyzsh/commit/72928432; https://github.com/ohmyzsh/ohmyzsh/commit/72928432