deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-12729
Published: 2021-07-15
Description: MagicMotion Flamingo 2 has a lack of access control for reading from device descriptors.
CVSS Score: 4.6 (MEDIUM)
References: http://www.magicsmotion.com/p-flamingo.html; http://www.magicsmotion.com/p-flamingo.html
CVE: CVE-2020-12730
Published: 2021-07-15
Description: MagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.magicsmotion.com/p-flamingo.html; https://cwe.mitre.org/data/definitions/319.html; http://www.magicsmotion.com/p-flamingo.html
CVE: CVE-2020-12731
Published: 2021-07-15
Description: The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read by other applications.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://www.magicsmotion.com/p-flamingo.html; http://www.magicsmotion.com/p-flamingo.html
CVE: CVE-2020-15495
Published: 2021-07-15
Description: Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration.
CVSS Score: 7.8 (HIGH)
References: https://kb.acronis.com/content/68061; https://www.acronis.com/en-us/support/updates/index.html; https://kb.acronis.com/content/68061
CVE: CVE-2020-25593
Published: 2021-07-15
Description: Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://kb.acronis.com/content/68396; https://www.acronis.com/en-us/blog/; https://kb.acronis.com/content/68396
CVE: CVE-2020-25736
Published: 2021-07-15
Description: Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/170246/Acronis-TrueImage-XPC-Privilege-Escalation.html; https://kb.acronis.com/content/68061; https://www.acronis.com/en-us/blog/
CVE: CVE-2021-32739
Published: 2021-07-15
Description: Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.
CVSS Score: 8.8 (HIGH)
CWE: CWE-267, CWE-269
References: https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5; https://icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10/; https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html
CVE: CVE-2020-12732
Published: 2021-07-15
Description: DEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetion_xxxxxxxx with a password of 12345678.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1188
References: https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf; https://www.depstech.com/mw001-s02-wifi-usb-digital-microscope; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf
CVE: CVE-2020-12733
Published: 2021-07-15
Description: Certain Shenzhen PENGLIXIN components on DEPSTECH WiFi Digital Microscope 3, as used by Shekar Endoscope, allow a TELNET connection with the molinkadmin password for the molink account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf; https://www.depstech.com/mw001-s02-wifi-usb-digital-microscope; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf
CVE: CVE-2020-12734
Published: 2021-07-15
Description: DEPSTECH WiFi Digital Microscope 3 allows remote attackers to change the SSID and password, and demand a ransom payment from the rightful device owner, because there is no way to reset to Factory Default settings.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf; https://www.depstech.com/mw001-s02-wifi-usb-digital-microscope; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf
CVE: CVE-2021-20439
Published: 2021-07-15
Description: IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196453; https://www.ibm.com/support/pages/node/6471903; https://exchange.xforce.ibmcloud.com/vulnerabilities/196453
CVE: CVE-2021-27845
Published: 2021-07-15
Description: A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.c
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/jasper-software/jasper/issues/194; https://github.com/jasper-software/jasper/issues/194
CVE: CVE-2021-27847
Published: 2021-07-15
Description: Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point, mask.c#L85.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/libvips/libvips/issues/1236; https://github.com/libvips/libvips/issues/1236
CVE: CVE-2021-29725
Published: 2021-07-15
Description: IBM Secure External Authentication Server 2.4.3.2, 6.0.1, 6.0.2 and IBM Secure Proxy 3.4.3.2, 6.0.1, 6.0.2 could allow a remote user to consume resources causing a denial of service due to a resource leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201102; https://www.ibm.com/support/pages/node/6471577; https://www.ibm.com/support/pages/node/6471615
CVE: CVE-2021-29749
Published: 2021-07-15
Description: IBM Secure External Authentication Server 6.0.2 and IBM Secure Proxy 6.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 201777.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201777; https://www.ibm.com/support/pages/node/6471621; https://www.ibm.com/support/pages/node/6471623
CVE: CVE-2021-32743
Published: 2021-07-15
Description: Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version 2.12.0 through version 2.12.4, some of the Icinga 2 features that require credentials for external services expose those credentials through the API to authenticated API users with read permissions for the corresponding object types. IdoMysqlConnection and IdoPgsqlConnection (every released version) exposes the password of the user used to connect to the database. IcingaDB (added in 2.12.0) exposes the password used to connect to the Redis server. ElasticsearchWriter (added in 2.8.0)exposes the password used to connect to the Elasticsearch server. An attacker who obtains these credentials can impersonate Icinga to these services and add, modify and delete information there. If credentials with more permissions are in use, this increases the impact accordingly. Starting with the 2.11.10 and 2.12.5 releases, these passwords are no longer exposed via the API. As a workaround, API user permissions can be restricted to not allow querying of any affected objects, either by explicitly listing only the required object types for object query permissions, or by applying a filter rule.
CVSS Score: 8.8 (HIGH)
CWE: CWE-202
References: https://github.com/Icinga/icinga2/security/advisories/GHSA-wrpw-pmr8-qgj7; https://icinga.com/blog/2021/07/15/releasing-icinga-2-12-5-and-2-11-10/; https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html
CVE: CVE-2021-21586
Published: 2021-07-15
Description: Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A remote authenticated malicious user could exploit this vulnerability in order to read arbitrary files on the system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-36, CWE-22
References: https://www.dell.com/support/kbdoc/000189363; https://www.dell.com/support/kbdoc/000189363
CVE: CVE-2021-21587
Published: 2021-07-15
Description: Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability. A local unauthenticated attacker could exploit this vulnerability in order to obtain the path of files and folders.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.dell.com/support/kbdoc/000189363; https://www.dell.com/support/kbdoc/000189363
CVE: CVE-2021-32750
Published: 2021-07-15
Description: MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL with an HTML image tag and the MuWire client would try to fetch that image via clearnet, thus exposing the IP address of the user. The problem is fixed in MuWire 0.8.8. As a workaround, users can disable messaging functionality to prevent other users from sending them malicious messages.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-79
References: https://github.com/zlatinb/muwire/security/advisories/GHSA-68xh-9h7w-64qg; https://github.com/zlatinb/muwire/security/advisories/GHSA-68xh-9h7w-64qg
CVE: CVE-2021-34429
Published: 2021-07-15
Description: For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-551
References: https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm; https://lists.apache.org/thread.html/r029c0c6833c8bb6acb094733fd7b75029d633f47a92f1c9d14391fc0%40%3Cnotifications.zookeeper.apache.org%3E; https://lists.apache.org/thread.html/r02f940c27e997a277ff14e79e84551382e1081e8978b417e0c2b0857%40%3Ccommits.kafka.apache.org%3E
CVE: CVE-2021-3042
Published: 2021-07-15
Description: A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. Exploiting this vulnerability requires the user to have file creation privilege in the Windows root directory (such as C:\). This issue impacts: All versions of Cortex XDR agent 6.1 without content update 181 or a later version; All versions of Cortex XDR agent 7.2 without content update 181 or a later version; All versions of Cortex XDR agent 7.3 without content update 181 or a later version. Cortex XDR agent 5.0 versions are not impacted by this issue. Content updates are required to resolve this issue and are automatically applied for the agent.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://security.paloaltonetworks.com/CVE-2021-3042; https://security.paloaltonetworks.com/CVE-2021-3042
CVE: CVE-2021-3043
Published: 2021-07-15
Description: A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. No additional action is required for these instances. This issue impacts: Prisma Cloud Compute 20.12 versions earlier than Prisma Cloud Compute 20.12.552; Prisma Cloud Compute 21.04 versions earlier than Prisma Cloud Compute 21.04.439.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2021-3043; https://security.paloaltonetworks.com/CVE-2021-3043
CVE: CVE-2020-11633
Published: 2021-07-15
Description: The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2020?applicable_category=Windows&applicable_version=2.1.2.81; https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2020?applicable_category=Windows&applicable_version=2.1.2.81
CVE: CVE-2021-20496
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation. IBM X-Force ID: 197966.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197966; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/197966
CVE: CVE-2021-20497
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 197969
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197969; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/197969
CVE: CVE-2021-20498
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197972; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/197972
CVE: CVE-2021-20499
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197973
CVSS Score: 2.7 (LOW)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197973; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/197973
CVE: CVE-2021-20500
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local privileged user. IBM X-Force ID: 197980.
CVSS Score: 4.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197980; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/197980
CVE: CVE-2021-20510
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 198299
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198299; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/198299
CVE: CVE-2021-20511
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 198300.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198300; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/198300
CVE: CVE-2021-20523
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 198660
CVSS Score: 2.7 (LOW)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198660; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/198660
CVE: CVE-2021-20524
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198661.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198661; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/198661
CVE: CVE-2021-20533
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 198813
CVSS Score: 7.2 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198813; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/198813
CVE: CVE-2021-20534
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 198814
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198814; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/198814
CVE: CVE-2021-20537
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID:198918
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198918; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/198918
CVE: CVE-2021-29699
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 could allow a remote priviled user to upload arbitrary files with a dangerous file type that could be excuted by an user. IBM X-Force ID: 200600.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200600; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/200600
CVE: CVE-2021-29742
Published: 2021-07-15
Description: IBM Security Verify Access Docker 10.0.0 could allow a user to impersonate another user on the system. IBM X-Force ID: 201483.
CVSS Score: 8.0 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201483; https://www.ibm.com/support/pages/node/6471895; https://exchange.xforce.ibmcloud.com/vulnerabilities/201483
CVE: CVE-2021-34827
Published: 2021-07-15
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12029.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-21-679/; https://www.zerodayinitiative.com/advisories/ZDI-21-679/
CVE: CVE-2021-34828
Published: 2021-07-15
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12066.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.zerodayinitiative.com/advisories/ZDI-21-680/; https://www.zerodayinitiative.com/advisories/ZDI-21-680/
CVE: CVE-2021-34829
Published: 2021-07-15
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the HNAP_AUTH HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12065.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.zerodayinitiative.com/advisories/ZDI-21-681/; https://www.zerodayinitiative.com/advisories/ZDI-21-681/
CVE: CVE-2021-34830
Published: 2021-07-15
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Cookie HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12028.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-21-682/; https://www.zerodayinitiative.com/advisories/ZDI-21-682/
CVE: CVE-2021-32770
Published: 2021-07-15
Description: Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the `auth: { }` section. Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`. One may manually edit the app.js file post-build as a workaround.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-522
References: https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-rqjw-p5vr-c695; https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-rqjw-p5vr-c695