deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24371
Published: 2021-08-02
Description: The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.
CVSS Score: 2.7 (LOW)
CWE: CWE-918
References: https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/; https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d; https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/
CVE: CVE-2021-24425
Published: 2021-08-02
Description: The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue, which will be triggered in the plugin's setting, as well as all front-page of the blog (when the Welcome bar is active)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-05-21%5D-%5BWordPress%5D-%5BCWE-79%5D-MyStickymenu-WordPress-Plugin-v2.5.1.txt; https://wpscan.com/vulnerability/14632fa8-597e-49ff-8[PII_REDACTED]a3583; https://m0ze.ru/vulnerability/%5B2021-05-21%5D-%5BWordPress%5D-%5BCWE-79%5D-MyStickymenu-WordPress-Plugin-v2.5.1.txt
CVE: CVE-2021-24428
Published: 2021-08-02
Description: The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-04-23%5D-%5BWordPress%5D-%5BCWE-79%5D-RSS-for-Yandex-Turbo-WordPress-Plugin-v1.30.txt; https://wpscan.com/vulnerability/9fcf6ebe-01d9-4730-a20e-58b192bb6d87; https://m0ze.ru/vulnerability/%5B2021-04-23%5D-%5BWordPress%5D-%5BCWE-79%5D-RSS-for-Yandex-Turbo-WordPress-Plugin-v1.30.txt
CVE: CVE-2021-24430
Published: 2021-08-02
Description: The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://m0ze.ru/vulnerability/%5B2021-05-10%5D-%5BWordPress%5D-%5BCWE-94%5D-Speed-Booster-Pack-WordPress-Plugin-v4.2.0-beta.txt; https://wpscan.com/vulnerability/945d6d2e-fa25-42c0-a7b4-b1794732a0df; https://m0ze.ru/vulnerability/%5B2021-05-10%5D-%5BWordPress%5D-%5BCWE-94%5D-Speed-Booster-Pack-WordPress-Plugin-v4.2.0-beta.txt
CVE: CVE-2021-24443
Published: 2021-08-02
Description: The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a4432acd-df49-4a4f-8184-b55cdd5d4d34; https://wpscan.com/vulnerability/a4432acd-df49-4a4f-8184-b55cdd5d4d34
CVE: CVE-2021-24444
Published: 2021-08-02
Description: The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164604/WordPress-TaxoPress-3.0.7.1-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8b; http://packetstormsecurity.com/files/164604/WordPress-TaxoPress-3.0.7.1-Cross-Site-Scripting.html
CVE: CVE-2021-24448
Published: 2021-08-02
Description: The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/81e42812-93eb-480d-a2d2-5ba5e02dd0ba; https://wpscan.com/vulnerability/81e42812-93eb-480d-a2d2-5ba5e02dd0ba
CVE: CVE-2021-24450
Published: 2021-08-02
Description: The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a8625579-fe8f-4bc1-a641-0e26ad141c92; https://wpscan.com/vulnerability/a8625579-fe8f-4bc1-a641-0e26ad141c92
CVE: CVE-2021-24455
Published: 2021-08-02
Description: The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9ef14cf1-1e04-4125-a296-9aa5388612f9; https://wpscan.com/vulnerability/9ef14cf1-1e04-4125-a296-9aa5388612f9
CVE: CVE-2021-24456
Published: 2021-08-02
Description: The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/929ad37d-9cdb-4117-8cd3-cf7130a7c9d4; https://wpscan.com/vulnerability/929ad37d-9cdb-4117-8cd3-cf7130a7c9d4
CVE: CVE-2021-24457
Published: 2021-08-02
Description: The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/97f4f7da-22a8-42a6-88ac-82e95a6c06dd; https://wpscan.com/vulnerability/97f4f7da-22a8-42a6-88ac-82e95a6c06dd
CVE: CVE-2021-24458
Published: 2021-08-02
Description: The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/8a588266-54cd-4779-adcf-f9b9e226c297; https://wpscan.com/vulnerability/8a588266-54cd-4779-adcf-f9b9e226c297
CVE: CVE-2021-24459
Published: 2021-08-02
Description: The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/3fafbec0-55e4-41cf-8402-1b57b6615225; https://wpscan.com/vulnerability/3fafbec0-55e4-41cf-8402-1b57b6615225
CVE: CVE-2021-24460
Published: 2021-08-02
Description: The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/9c0164f2-464b-4876-a48f-c0ebd63cf397; https://wpscan.com/vulnerability/9c0164f2-464b-4876-a48f-c0ebd63cf397
CVE: CVE-2021-24461
Published: 2021-08-02
Description: The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/311974b5-6d6e-4b47-a33d-6d8f468aa528; https://wpscan.com/vulnerability/311974b5-6d6e-4b47-a33d-6d8f468aa528
CVE: CVE-2021-24462
Published: 2021-08-02
Description: The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/e24dac6d-de48-42c1-bdde-4a45fb331376; https://wpscan.com/vulnerability/e24dac6d-de48-42c1-bdde-4a45fb331376
CVE: CVE-2021-24463
Published: 2021-08-02
Description: The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/994e6198-f0e9-4e30-989f-b5a3dfe95ded; https://wpscan.com/vulnerability/994e6198-f0e9-4e30-989f-b5a3dfe95ded
CVE: CVE-2021-24464
Published: 2021-08-02
Description: The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/531b3fac-48b9-4821-a3aa-4db073d43aae; https://wpscan.com/vulnerability/531b3fac-48b9-4821-a3aa-4db073d43aae
CVE: CVE-2021-24468
Published: 2021-08-02
Description: The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/4b7c61da-952c-492a-8ce6-3c2126942a7c; https://wpscan.com/vulnerability/4b7c61da-952c-492a-8ce6-3c2126942a7c
CVE: CVE-2021-24470
Published: 2021-08-02
Description: The Yada Wiki WordPress plugin before 3.4.1 did not sanitise, validate or escape the anchor attribute of its shortcode, leading to a Stored Cross-Site Scripting issue
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/b01a85cc-0e45-4183-a[PII_REDACTED]4d5d4; https://wpscan.com/vulnerability/b01a85cc-0e45-4183-a[PII_REDACTED]4d5d4
CVE: CVE-2021-24472
Published: 2021-08-02
Description: The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a; https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a
CVE: CVE-2021-24473
Published: 2021-08-02
Description: The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://wpscan.com/vulnerability/79982ea9-4733-4b1e-a43e-17629c1136de; https://wpscan.com/vulnerability/79982ea9-4733-4b1e-a43e-17629c1136de
CVE: CVE-2021-24474
Published: 2021-08-02
Description: The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/49bc46a8-9d55-4fa1-8e0d-0556a6336fa0; https://wpscan.com/vulnerability/49bc46a8-9d55-4fa1-8e0d-0556a6336fa0
CVE: CVE-2021-24476
Published: 2021-08-02
Description: The Steam Group Viewer WordPress plugin through 2.1 does not sanitise or escape its "Steam Group Address" settings before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d[PII_REDACTED]-4dd5-84be-ba4a160ee1f5; https://wpscan.com/vulnerability/d[PII_REDACTED]-4dd5-84be-ba4a160ee1f5
CVE: CVE-2021-24477
Published: 2021-08-02
Description: The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/7915070f-1d9b-43c3-b01e-fec35f633a4d; https://wpscan.com/vulnerability/7915070f-1d9b-43c3-b01e-fec35f633a4d
CVE: CVE-2021-24478
Published: 2021-08-02
Description: The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/c73818e5-0734-46c9-9703-d211b4f58664; https://wpscan.com/vulnerability/c73818e5-0734-46c9-9703-d211b4f58664
CVE: CVE-2021-24479
Published: 2021-08-02
Description: The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them back in the page, leading to an authenticated stored Cross-Site Scripting issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5fd2246a-fbd9-4f2a-8b0b-a64c3f91157c; https://wpscan.com/vulnerability/5fd2246a-fbd9-4f2a-8b0b-a64c3f91157c
CVE: CVE-2021-24480
Published: 2021-08-02
Description: The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its "Use your own " setting before outputting it in the page, leading to an authenticated (admin+) stored Cross-Site Scripting issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/243d417a-6fb9-4e17-9e12-a8c605f9af8a; https://wpscan.com/vulnerability/243d417a-6fb9-4e17-9e12-a8c605f9af8a
CVE: CVE-2021-24481
Published: 2021-08-02
Description: The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a4c352de-9815-4dfe-ac51-65b5bfb37438; https://wpscan.com/vulnerability/a4c352de-9815-4dfe-ac51-65b5bfb37438
CVE: CVE-2021-24483
Published: 2021-08-02
Description: The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/0dc931c6-1fce-4d70-a658-a4bbab10dab3; https://wpscan.com/vulnerability/0dc931c6-1fce-4d70-a658-a4bbab10dab3
CVE: CVE-2021-24484
Published: 2021-08-02
Description: The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/9ce0153d-4a8b-4215-b6b6-15ca68c4f52c; https://wpscan.com/vulnerability/9ce0153d-4a8b-4215-b6b6-15ca68c4f52c
CVE: CVE-2021-24488
Published: 2021-08-02
Description: The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1fc0aace-ba85-4939-9007-d150960add4a; https://wpscan.com/vulnerability/1fc0aace-ba85-4939-9007-d150960add4a
CVE: CVE-2021-24492
Published: 2021-08-02
Description: The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-handsome-testimonials/; https://wpscan.com/vulnerability/42760007-0e59-4d45-8d64-86bc0b8dacea; https://codevigilant.com/disclosure/2021/wp-plugin-handsome-testimonials/
CVE: CVE-2021-24496
Published: 2021-08-02
Description: The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5fd1cb7f-a036-4c5b-9557-0ffd4ef6b834; https://wpscan.com/vulnerability/5fd1cb7f-a036-4c5b-9557-0ffd4ef6b834
CVE: CVE-2021-24498
Published: 2021-08-02
Description: The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3c5a5187-42b3-4f88-9b0e-4fdfa1c39e86; https://wpscan.com/vulnerability/3c5a5187-42b3-4f88-9b0e-4fdfa1c39e86
CVE: CVE-2021-24503
Published: 2021-08-02
Description: The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/18ab1570-2b4a-48a4-86e6-c1d368563691; https://wpscan.com/vulnerability/18ab1570-2b4a-48a4-86e6-c1d368563691
CVE: CVE-2021-24504
Published: 2021-08-02
Description: The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1; https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1
CVE: CVE-2021-33526
Published: 2021-08-02
Description: In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://cert.vde.com/de-de/advisories/vde-2021-017; https://cert.vde.com/de-de/advisories/vde-2021-017
CVE: CVE-2021-33527
Published: 2021-08-02
Description: In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM that will not correctly validate the input. This can lead to an arbitrary code execution with the privileges of the service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://cert.vde.com/de-de/advisories/vde-2021-017; https://cert.vde.com/de-de/advisories/vde-2021-017
CVE: CVE-2021-34574
Published: 2021-08-02
Description: In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-669, CWE-669
References: https://cert.vde.com/en/advisories/VDE-2021-030; https://cert.vde.com/en/advisories/VDE-2022-039; https://cert.vde.com/en/advisories/VDE-2021-030
CVE: CVE-2021-34575
Published: 2021-08-02
Description: In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the server sends.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203, CWE-203
References: https://cert.vde.com/de-de/advisories/vde-2021-030; https://cert.vde.com/de-de/advisories/vde-2021-030
CVE: CVE-2021-37165
Published: 2021-08-02
Description: A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When a message is sent to the HMI TCP socket, it is forwarded to the hmiProcessMsg function through the pendingQ, and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.armis.com/PwnedPiper; https://www.swisslog-healthcare.com; https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37165-bulletin---overflow-in-hmiprocessmsg.pdf?rev=2e2678dab62b41ba999cd6d1e03974ca&hash=F465ACE2C7FAED826B52FE996E36ACEC
CVE: CVE-2021-37216
Published: 2021-08-02
Description: QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html; https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html