deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-38390
Published: 2021-08-30
Description: A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03
CVE: CVE-2021-38391
Published: 2021-08-30
Description: A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03
CVE: CVE-2021-38393
Published: 2021-08-30
Description: A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03
CVE: CVE-2021-3628
Published: 2021-08-30
Description: OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docs.openkm.com/kcenter/view/okm-6.3-com/migration-guide.html; https://github.com/openkm/document-management-system/issues/278; https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-document-management-community-vulnerable-cross-site
CVE: CVE-2021-22021
Published: 2021-08-30
Description: VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vmware.com/security/advisories/VMSA-2021-0019.html; https://www.vmware.com/security/advisories/VMSA-2021-0019.html
CVE: CVE-2021-29630
Published: 2021-08-30
Description: In FreeBSD 13.0-STABLE before n[PII_REDACTED]ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:14.ggatec.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-21:14.ggatec.asc
CVE: CVE-2021-33055
Published: 2021-08-30
Description: Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.stmcyber.com/vulns/cve-2021-33055/; https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6104-released; https://blog.stmcyber.com/vulns/cve-2021-33055/
CVE: CVE-2021-34066
Published: 2021-08-30
Description: An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/EdgeGallery/developer-be/issues/1; https://github.com/EdgeGallery/developer-be/issues/1
CVE: CVE-2021-34646
Published: 2021-08-30
Description: Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290, CWE-330
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2581212%40woocommerce-jetpack&new=2581212%40woocommerce-jetpack&sfp_email=&sfph_mail=; https://www.wordfence.com/blog/2021/08/critical-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2581212%40woocommerce-jetpack&new=2581212%40woocommerce-jetpack&sfp_email=&sfph_mail=
CVE: CVE-2021-34668
Published: 2021-08-30
Description: The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34668; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34668
CVE: CVE-2021-35061
Published: 2021-08-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary web script or HTML via all parameters to HTML form fields in all components.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sthierolf/security/blob/main/CVE-2021-35061.md; https://github.com/sthierolf/security/blob/main/CVE-2021-35061.md
CVE: CVE-2021-36370
Published: 2021-08-30
Description: An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://docs.ssh-mitm.at/CVE-2021-36370.html; https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484; https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c
CVE: CVE-2021-37416
Published: 2021-08-30
Description: Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.stmcyber.com/vulns/cve-2021-37416/; https://blog.stmcyber.com/vulns/cve-2021-37416/
CVE: CVE-2021-37417
Published: 2021-08-30
Description: Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://blog.stmcyber.com/vulns/cve-2021-37417/; https://blog.stmcyber.com/vulns/cve-2021-37417/
CVE: CVE-2021-37421
Published: 2021-08-30
Description: Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://blog.stmcyber.com/vulns/cve-2021-37421/; https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6104-released-with-an-important-security-fixes; https://blog.stmcyber.com/vulns/cve-2021-37421/
CVE: CVE-2021-38342
Published: 2021-08-30
Description: The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changing their status, reassigning their ownership, and editing other metadata.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.wordfence.com/blog/2021/08/nested-pages-pat%E2%80%A6on-vulnerability/; https://www.wordfence.com/vulnerability-advisories/; https://www.wordfence.com/blog/2021/08/nested-pages-pat%E2%80%A6on-vulnerability/
CVE: CVE-2021-38343
Published: 2021-08-30
Description: The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.wordfence.com/blog/2021/08/nested-pages-pat%E2%80%A6on-vulnerability/; https://www.wordfence.com/vulnerability-advisories/; https://www.wordfence.com/blog/2021/08/nested-pages-pat%E2%80%A6on-vulnerability/
CVE: CVE-2021-34434
Published: 2021-08-30
Description: In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a durable client is offline, then existing subscriptions for that client are not revoked.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=575324; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4WWGVF5BUFPYPCFUPPP4KRIYI5OTJN2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLUUM52Y6AEICPXPSRRXC6OBY4H5XKW7/
CVE: CVE-2021-35062
Published: 2021-08-30
Description: A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid token of a COVID-19 test result to execute shell commands with the permissions of the web server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://github.com/sthierolf/security/blob/main/CVE-2021-35062.md; https://github.com/sthierolf/security/blob/main/CVE-2021-35062.md
CVE: CVE-2021-36691
Published: 2021-08-30
Description: libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase(). When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/libjxl/libjxl/issues/422; https://github.com/libjxl/libjxl/issues/422
CVE: CVE-2021-39132
Published: 2021-08-30
Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/rundeck/rundeck/commit/850d12e21d22833bc148b7f458d7cb5949f829b6; https://github.com/rundeck/rundeck/security/advisories/GHSA-q4rf-3fhx-88pf; https://github.com/rundeck/rundeck/commit/850d12e21d22833bc148b7f458d7cb5949f829b6
CVE: CVE-2021-39133
Published: 2021-08-30
Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
CVSS Score: 7.2 (HIGH)
CWE: CWE-352
References: https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9; https://github.com/rundeck/rundeck/security/advisories/GHSA-3jmw-c69h-426c; https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9
CVE: CVE-2021-32831
Published: 2021-08-30
Description: Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/totaljs/framework/blob/e644167d5378afdc45cb[PII_REDACTED]b2c07ef235/changes.txt#L11; https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3; https://securitylab.github.com/advisories/GHSL-2021-066-totaljs-totaljs/
CVE: CVE-2021-32832
Published: 2021-08-30
Description: Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://docs.rocket.chat/guides/security/security-updates; https://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094c; https://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3
CVE: CVE-2021-36692
Published: 2021-08-30
Description: libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). When encoding a malicous APNG file using cjxl, an attacker can trigger a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/libjxl/libjxl/commit/7dfa400ded53919d986c5d3d23446a09e0cf481b; https://github.com/libjxl/libjxl/issues/308; https://github.com/libjxl/libjxl/pull/313
CVE: CVE-2021-39175
Published: 2021-08-30
Description: HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into another page. The problem is patched in version 1.9.0. There are no known workarounds aside from upgrading.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74, CWE-346, CWE-79
References: https://github.com/hedgedoc/hedgedoc/pull/1369; https://github.com/hedgedoc/hedgedoc/pull/1375; https://github.com/hedgedoc/hedgedoc/pull/1513
CVE: CVE-2020-22848
Published: 2021-08-30
Description: A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/chshcms/cscms/issues/6; https://github.com/chshcms/cscms/issues/6
CVE: CVE-2021-39177
Published: 2021-08-30
Description: Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.
CVSS Score: 7.4 (HIGH)
CWE: CWE-287
References: https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6; https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858; https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY
CVE: CVE-2021-39178
Published: 2021-08-31
Description: Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the `next.config.js` file must have `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/vercel/next.js/releases/tag/v11.1.1; https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m; https://github.com/vercel/next.js/releases/tag/v11.1.1
CVE: CVE-2021-27556
Published: 2021-08-31
Description: The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://privasec.com/blog/zentao-cms-a-monkeys-journey-to-priv-esc-remote-code-execution/; https://privasec.com/blog/zentao-cms-a-monkeys-journey-to-priv-esc-remote-code-execution/
CVE: CVE-2021-27557
Published: 2021-08-31
Description: A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a Cron job.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://privasec.com/blog/zentao-cms-a-monkeys-journey-to-priv-esc-remote-code-execution/; https://privasec.com/blog/zentao-cms-a-monkeys-journey-to-priv-esc-remote-code-execution/
CVE: CVE-2021-27558
Published: 2021-08-31
Description: A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://privasec.com/blog/zentao-cms-a-monkeys-journey-to-priv-esc-remote-code-execution/; https://privasec.com/blog/zentao-cms-a-monkeys-journey-to-priv-esc-remote-code-execution/
CVE: CVE-2020-13639
Published: 2021-08-31
Description: A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://labs.integrity.pt/advisories/CVE-2020-13639/; https://www.outsystems.com/platform/; https://labs.integrity.pt/advisories/CVE-2020-13639/
CVE: CVE-2021-36356
Published: 2021-08-31
Description: KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/166623/Kramer-VIAware-Remote-Code-Execution.html; https://write-up.github.io/kramerav/; http://packetstormsecurity.com/files/166623/Kramer-VIAware-Remote-Code-Execution.html
CVE: CVE-2021-36981
Published: 2021-08-31
Description: In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/0xBrAinsTorM/CVE-2021-36981; https://github.com/SerNet/verinice/compare/1.22.1...1.22.2; https://verinice.com/en/support/security-advisory
CVE: CVE-2021-40330
Published: 2021-08-31
Description: git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.
CVSS Score: 7.5 (HIGH)
References: https://github.com/git/git/commit/a02ea577174ab8ed18f847cf1693f213e0b9c473; https://github.com/git/git/compare/v2.30.0...v2.30.1; https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html
CVE: CVE-2021-38143
Published: 2021-08-31
Description: An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when the admin tries to see the client list. This type of XSS (stored) can lead to the extraction of the PHPSESSID cookie belonging to the admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bernardofsr.github.io/blog/2021/form-tools/; https://github.com/bernardofsr/CVEs-With-PoC/blob/main/PoCs/Form%20Tools/README.md; https://github.com/formtools/core
CVE: CVE-2021-38144
Published: 2021-08-31
Description: An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submission_id parameter, e.g., clients/forms/edit_submission.php?form_id=1&view_id=1&submission_id=[XSS].
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bernardofsr.github.io/blog/2021/form-tools/; https://github.com/bernardofsr/CVEs-With-PoC/blob/main/PoCs/Form%20Tools/README.md; https://github.com/formtools/core
CVE: CVE-2021-38145
Published: 2021-08-31
Description: An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (client) tries to export a form with data, e.g., manipulation of modules/export_manager/export.php?export_group_id=1&export_group_1_results=all&export_type_id=1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://bernardofsr.github.io/blog/2021/form-tools/; https://github.com/bernardofsr/CVEs-With-PoC/blob/main/PoCs/Form%20Tools/README.md; https://github.com/formtools/core/
CVE: CVE-2021-33555
Published: 2021-08-31
Description: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://cert.vde.com/en-us/advisories/vde-2021-027; https://cert.vde.com/en-us/advisories/vde-2021-027
CVE: CVE-2021-34559
Published: 2021-08-31
Description: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-444
References: https://cert.vde.com/en-us/advisories/vde-2021-027; https://cert.vde.com/en-us/advisories/vde-2021-027