deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-22952
Published: 2021-09-23
Description: A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk device(s) assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://community.ui.com/releases/Security-Advisory-Bulletin-020-020/8ce6a7e6-0cce-4814-8bbe-ee812cb94b1a; https://community.ui.com/releases/Security-Advisory-Bulletin-020-020/8ce6a7e6-0cce-4814-8bbe-ee812cb94b1a
CVE: CVE-2021-22953
Published: 2021-09-23
Description: A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes; https://hackerone.com/reports/1102225; https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE: CVE-2021-32959
Published: 2021-09-23
Description: Heap-based buffer overflow in SuiteLink server while processing commands 0x05/0x06
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf
CVE: CVE-2021-32963
Published: 2021-09-23
Description: Null pointer dereference in SuiteLink server while processing commands 0x03/0x10
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf
CVE: CVE-2021-32971
Published: 2021-09-23
Description: Null pointer dereference in SuiteLink server while processing command 0x07
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf
CVE: CVE-2021-32979
Published: 2021-09-23
Description: Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf
CVE: CVE-2021-32987
Published: 2021-09-23
Description: Null pointer dereference in SuiteLink server while processing command 0x0b
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf
CVE: CVE-2021-32999
Published: 2021-09-23
Description: Improper handling of exceptional conditions in SuiteLink server while processing command 0x01
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf
CVE: CVE-2021-21913
Published: 2021-09-23
Description: An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1361; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1361
CVE: CVE-2021-26750
Published: 2021-09-23
Description: DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.L.U. Panda Adaptive Defense 360 <= 8.0.17 allows attacker to escalate privileges via maliciously crafted DLL file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://hansesecure.de/2021/02/vulnerability-in-panda-security-product/?lang=en; https://hansesecure.de/2021/02/vulnerability-in-panda-security-product/?lang=en
CVE: CVE-2021-36872
Published: 2021-09-23
Description: Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type].
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/cabrerahector/wordpress-popular-posts/blob/master/changelog.md; https://patchstack.com/database/vulnerability/wordpress-popular-posts/wordpress-popular-posts-plugin-5-3-3-authenticated-persistent-cross-site-scripting-xss-vulnerability; https://github.com/cabrerahector/wordpress-popular-posts/blob/master/changelog.md
CVE: CVE-2021-3824
Published: 2021-09-23
Description: OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-84, CWE-79
References: https://openvpn.net/vpn-server-resources/release-notes/#openvpn-access-server-2-9-5; https://openvpn.net/vpn-server-resources/release-notes/#openvpn-access-server-2-9-5
CVE: CVE-2021-41381
Published: 2021-09-23
Description: Payara Micro Community 5.2021.6 and below allows Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/164365/Payara-Micro-Community-5.2021.6-Directory-Traversal.html; http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.html; http://seclists.org/fulldisclosure/2022/Nov/11
CVE: CVE-2021-41428
Published: 2021-09-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-4690
Published: 2021-09-23
Description: IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 186697.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186697; https://www.ibm.com/support/pages/node/6491125; https://exchange.xforce.ibmcloud.com/vulnerabilities/186697
CVE: CVE-2020-4803
Published: 2021-09-23
Description: IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189535; https://www.ibm.com/support/pages/node/6491625; https://exchange.xforce.ibmcloud.com/vulnerabilities/189535
CVE: CVE-2020-4805
Published: 2021-09-23
Description: IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189539; https://www.ibm.com/support/pages/node/6491633; https://exchange.xforce.ibmcloud.com/vulnerabilities/189539
CVE: CVE-2020-4809
Published: 2021-09-23
Description: IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189633; https://www.ibm.com/support/pages/node/6491631; https://exchange.xforce.ibmcloud.com/vulnerabilities/189633
CVE: CVE-2020-4941
Published: 2021-09-23
Description: IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 191941.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191941; https://www.ibm.com/support/pages/node/6491627; https://exchange.xforce.ibmcloud.com/vulnerabilities/191941
CVE: CVE-2021-20377
Published: 2021-09-23
Description: IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195569.
CVSS Score: 2.7 (LOW)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195569; https://www.ibm.com/support/pages/node/6491125; https://exchange.xforce.ibmcloud.com/vulnerabilities/195569
CVE: CVE-2021-20434
Published: 2021-09-23
Description: IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 196346.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196346; https://www.ibm.com/support/pages/node/6491651; https://exchange.xforce.ibmcloud.com/vulnerabilities/196346
CVE: CVE-2021-20435
Published: 2021-09-23
Description: IBM Security Verify Bridge 1.0.5.0 does not properly validate a certificate which could allow a local attacker to obtain sensitive information that could aid in further attacks against the system. IBM X-Force ID: 196355.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196355; https://www.ibm.com/support/pages/node/6491651; https://exchange.xforce.ibmcloud.com/vulnerabilities/196355
CVE: CVE-2021-20484
Published: 2021-09-23
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197666.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197666; https://www.ibm.com/support/pages/node/6491647; https://exchange.xforce.ibmcloud.com/vulnerabilities/197666
CVE: CVE-2021-20485
Published: 2021-09-23
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197667.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197667; https://www.ibm.com/support/pages/node/6491645; https://exchange.xforce.ibmcloud.com/vulnerabilities/197667
CVE: CVE-2021-20563
Published: 2021-09-23
Description: IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote authenciated user to obtain sensitive information. By sending a specially crafted request, the user could disclose a valid filepath on the server which could be used in further attacks against the system. IBM X-Force ID: 199234.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199234; https://www.ibm.com/support/pages/node/6491645; https://exchange.xforce.ibmcloud.com/vulnerabilities/199234
CVE: CVE-2021-22276
Published: 2021-09-23
Description: The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200, CWE-354
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A6475&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A6475&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-26794
Published: 2021-09-23
Description: Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute arbitrary code via crafted php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/philippe/FrogCMS/issues/11; https://github.com/philippe/FrogCMS/issues/11
CVE: CVE-2021-29800
Published: 2021-09-23
Description: IBM Tivoli Netcool/OMNIbus_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203906; https://www.ibm.com/support/pages/node/6491109; https://exchange.xforce.ibmcloud.com/vulnerabilities/203906
CVE: CVE-2021-36823
Published: 2021-09-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) allows Stored XSS.This issue affects AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): from n/a through 6.8.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/ag-custom-admin/wordpress-absolutely-glamorous-custom-admin-plugin-6-8-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ag-custom-admin/wordpress-absolutely-glamorous-custom-admin-plugin-6-8-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2021-36873
Published: 2021-09-23
Description: Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable parameter: &blockcountry_blockmessage.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/iq-block-country-/wordpress-iq-block-country-plugin-1-2-11-authenticated-persistent-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/iq-block-country/#developers; https://patchstack.com/database/vulnerability/iq-block-country-/wordpress-iq-block-country-plugin-1-2-11-authenticated-persistent-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-38863
Published: 2021-09-23
Description: IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a locally authenticated user. IBM X-Force ID: 208154.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208154; https://www.ibm.com/support/pages/node/6491653; https://exchange.xforce.ibmcloud.com/vulnerabilities/208154
CVE: CVE-2021-38864
Published: 2021-09-23
Description: IBM Security Verify Bridge 1.0.5.0 could allow a user to obtain sensitive information due to improper certificate validation. IBM X-Force ID: 208155.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208155; https://www.ibm.com/support/pages/node/6491651; https://exchange.xforce.ibmcloud.com/vulnerabilities/208155
CVE: CVE-2020-24327
Published: 2021-09-23
Description: Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/discourse/discourse/pull/10509; https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1; https://github.com/discourse/discourse/pull/10509
CVE: CVE-2021-29810
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204279.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204279; https://www.ibm.com/support/pages/node/6491547; https://exchange.xforce.ibmcloud.com/vulnerabilities/204279
CVE: CVE-2021-29812
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204330.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204330; https://www.ibm.com/support/pages/node/6491545; https://exchange.xforce.ibmcloud.com/vulnerabilities/204330
CVE: CVE-2021-29813
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204331.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204331; https://www.ibm.com/support/pages/node/6491543; https://exchange.xforce.ibmcloud.com/vulnerabilities/204331
CVE: CVE-2021-29814
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204334.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204334; https://www.ibm.com/support/pages/node/6491539; https://exchange.xforce.ibmcloud.com/vulnerabilities/204334
CVE: CVE-2021-29815
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204340.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204340; https://www.ibm.com/support/pages/node/6491537; https://exchange.xforce.ibmcloud.com/vulnerabilities/204340
CVE: CVE-2021-29816
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204341.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204341; https://www.ibm.com/support/pages/node/6491535; https://exchange.xforce.ibmcloud.com/vulnerabilities/204341
CVE: CVE-2021-29832
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204824.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204824; https://www.ibm.com/support/pages/node/6491529; https://exchange.xforce.ibmcloud.com/vulnerabilities/204824
CVE: CVE-2021-29833
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204825.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204825; https://www.ibm.com/support/pages/node/6491527; https://exchange.xforce.ibmcloud.com/vulnerabilities/204825
CVE: CVE-2021-29904
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI displays user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 207610.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/207610; https://www.ibm.com/support/pages/node/6491525; https://exchange.xforce.ibmcloud.com/vulnerabilities/207610
CVE: CVE-2021-29905
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207616.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/207616; https://www.ibm.com/support/pages/node/6491523; https://exchange.xforce.ibmcloud.com/vulnerabilities/207616
CVE: CVE-2021-38870
Published: 2021-09-23
Description: IBM Aspera Cloud is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208343.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208343; https://www.ibm.com/support/pages/node/6491603; https://exchange.xforce.ibmcloud.com/vulnerabilities/208343
CVE: CVE-2021-38877
Published: 2021-09-23
Description: IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208405.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208405; https://www.ibm.com/support/pages/node/6491521; https://exchange.xforce.ibmcloud.com/vulnerabilities/208405
CVE: CVE-2020-19949
Published: 2021-09-23
Description: A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/yzmcms/yzmcms/issues/21; https://github.com/yzmcms/yzmcms/issues/21
CVE: CVE-2020-19950
Published: 2021-09-23
Description: A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/yzmcms/yzmcms/issues/22; https://github.com/yzmcms/yzmcms/issues/22
CVE: CVE-2020-19951
Published: 2021-09-23
Description: A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/yzmcms/yzmcms/issues/43; https://github.com/yzmcms/yzmcms/issues/43