deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-22851
Published: 2021-01-19
Description: HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef; https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html; https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef
CVE: CVE-2021-22852
Published: 2021-01-19
Description: HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef; https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html; https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef
CVE: CVE-2020-28472
Published: 2021-01-19
Description: This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.
CVSS Score: 7.3 (HIGH)
References: https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9; https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426
CVE: CVE-2020-28477
Published: 2021-01-19
Description: This affects all versions of package immer.
CVSS Score: 7.5 (HIGH)
References: https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986; https://snyk.io/vuln/SNYK-JS-IMMER-1019369
CVE: CVE-2020-28478
Published: 2021-01-19
Description: This affects the package gsap before 3.6.0.
CVSS Score: 7.5 (HIGH)
References: https://github.com/greensock/GSAP/blob/master/src/gsap-core.js%23L147; https://snyk.io/vuln/SNYK-JS-GSAP-1054614; https://github.com/greensock/GSAP/blob/master/src/gsap-core.js%23L147
CVE: CVE-2020-20950
Published: 2021-01-19
Description: Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf; http://microchip.com; https://bi-zone.medium.com/silence-will-fall-or-how-it-can-take-2-years-to-get-your-vuln-registered-e6134846f5bb
CVE: CVE-2020-23522
Published: 2021-01-19
Description: Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/161276/Pixelimity-1.0-Cross-Site-Request-Forgery.html; https://github.com/pixelimity/pixelimity/issues/20; http://packetstormsecurity.com/files/161276/Pixelimity-1.0-Cross-Site-Request-Forgery.html
CVE: CVE-2020-23342
Published: 2021-01-19
Description: A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://anchorcms.com/; http://packetstormsecurity.com/files/161048/Anchor-CMS-0.12.7-Cross-Site-Request-Forgery.html; https://anchorcms.com/
CVE: CVE-2020-35128
Published: 2021-01-19
Description: Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://forum.mautic.org/c/announcements/16; https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786; https://labs.bishopfox.com/advisories/mautic-version-3.2.2
CVE: CVE-2020-35129
Published: 2021-01-19
Description: Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://forum.mautic.org/c/announcements/16; https://labs.bishopfox.com/advisories/mautic-version-3.2.2; https://forum.mautic.org/c/announcements/16
CVE: CVE-2020-28479
Published: 2021-01-19
Description: The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.
CVSS Score: 5.9 (MEDIUM)
References: https://github.com/clientIO/joint/releases/tag/v3.3.0; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1062040; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1062039
CVE: CVE-2020-28480
Published: 2021-01-19
Description: The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.
CVSS Score: 7.3 (HIGH)
References: https://github.com/clientIO/joint/blob/master/src/util/util.mjs%23L150; https://github.com/clientIO/joint/pull/1406; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1062037
CVE: CVE-2020-28481
Published: 2021-01-19
Description: The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: https://github.com/socketio/socket.io/issues/3671; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357
CVE: CVE-2020-28482
Published: 2021-01-19
Description: This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-732
References: https://github.com/fastify/fastify-csrf/pull/26; https://snyk.io/vuln/SNYK-JS-FASTIFYCSRF-1062044; https://github.com/fastify/fastify-csrf/pull/26
CVE: CVE-2021-3181
Published: 2021-01-19
Description: rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://www.openwall.com/lists/oss-security/2021/01/19/10; http://www.openwall.com/lists/oss-security/2021/01/27/3; https://gitlab.com/muttmua/mutt/-/commit/4a2becbdb4422aaffe3ce314991b9d670b7adf17
CVE: CVE-2021-3182
Published: 2021-01-19
Description: D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 8.0 (HIGH)
CWE: CWE-787, CWE-120
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10203; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10203
CVE: CVE-2021-3183
Published: 2021-01-19
Description: Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a removal of a login profile.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://seclists.org/fulldisclosure/2021/Jan/20; https://seclists.org/fulldisclosure/2021/Jan/20
CVE: CVE-2020-27733
Published: 2021-01-19
Description: Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com/products/applications_manager/issues.html#v14880; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-27733.html; https://www.manageengine.com/products/applications_manager/issues.html#v14880
CVE: CVE-2020-4871
Published: 2021-01-19
Description: IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 190834.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190834; https://www.ibm.com/support/pages/node/6404674; https://exchange.xforce.ibmcloud.com/vulnerabilities/190834
CVE: CVE-2020-4873
Published: 2021-01-19
Description: IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190836; https://www.ibm.com/support/pages/node/6404674; https://exchange.xforce.ibmcloud.com/vulnerabilities/190836
CVE: CVE-2020-4881
Published: 2021-01-19
Description: IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verification for SSL/TLS communication. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 190851.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190851; https://www.ibm.com/support/pages/node/6404674; https://exchange.xforce.ibmcloud.com/vulnerabilities/190851
CVE: CVE-2021-22498
Published: 2021-01-19
Description: XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. The vulnerability affects versions 12.x, 12.60 Patch 5 and earlier, 15.0.1 Patch 2 and earlier and 15.5. The vulnerability could be exploited to allow an XML External Entity Injection.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: https://softwaresupport.softwaregrp.com/doc/KM03771781; https://softwaresupport.softwaregrp.com/doc/KM03771781
CVE: CVE-2021-25323
Published: 2021-01-19
Description: The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-640
References: https://github.com/MISP/MISP/commit/afbf95a478b6e94f532ca0776c79da1b08be7eed; https://github.com/MISP/MISP/commit/afbf95a478b6e94f532ca0776c79da1b08be7eed
CVE: CVE-2021-25324
Published: 2021-01-19
Description: MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/741243f707cac7de1a3769a38e03004f037f4a3d; https://github.com/MISP/MISP/commit/741243f707cac7de1a3769a38e03004f037f4a3d
CVE: CVE-2021-25325
Published: 2021-01-19
Description: MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/829c3199ba3afdecb52e0719509f3df4463be5b4; https://github.com/MISP/MISP/commit/829c3199ba3afdecb52e0719509f3df4463be5b4
CVE: CVE-2021-3184
Published: 2021-01-19
Description: MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/8283e0fbec551f45f3f181cdb2cf29cddc23df66; https://github.com/MISP/MISP/commit/8283e0fbec551f45f3f181cdb2cf29cddc23df66
CVE: CVE-2020-27270
Published: 2021-01-19
Description: SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doesnt use adequate measures to protect encryption keys in transit which allows unauthenticated physically proximate attacker to sniff keys via (BLE).
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-522
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01
CVE: CVE-2020-27272
Published: 2021-01-19
Description: SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-i,AnyDana-A mobile apps doesn't use adequate measures to authenticate the pump before exchanging keys, which allows unauthenticated, physically proximate attackers to eavesdrop the keys and spoof the pump via BLE.
CVSS Score: 5.7 (MEDIUM)
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01
CVE: CVE-2020-27276
Published: 2021-01-19
Description: SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't use adequate measures to authenticate the communicating entities before exchanging keys, which allows unauthenticated, physically proximate attackers to eavesdrop the authentication sequence via Bluetooth Low Energy.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01
CVE: CVE-2020-35929
Published: 2021-01-19
Description: In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This information could be used by an attacker for unauthorized access to remote data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-9f7g-72h2-59g7; https://github.com/KasperskyLab/TinyCheck/security/advisories/GHSA-9f7g-72h2-59g7
CVE: CVE-2021-20190
Published: 2021-01-19
Description: A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://bugzilla.redhat.com/show_bug.cgi?id=1916633; https://github.com/FasterXML/jackson-databind/issues/2854; https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.nifi.apache.org%3E
CVE: CVE-2020-8581
Published: 2021-01-19
Description: Clustered Data ONTAP versions prior to 9.3P20 and 9.5 are susceptible to a vulnerability which could allow an authenticated but unauthorized attacker to overwrite arbitrary data when VMware vStorage support is enabled.
CVSS Score: 6.5 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-14409
Published: 2021-01-19
Description: SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://bugzilla.libsdl.org/show_bug.cgi?id=5200; https://hg.libsdl.org/SDL/rev/3f9b4e92c1d9; https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html
CVE: CVE-2020-14410
Published: 2021-01-19
Description: SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.libsdl.org/show_bug.cgi?id=5200; https://hg.libsdl.org/SDL/rev/3f9b4e92c1d9; https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html
CVE: CVE-2021-21263
Published: 2021-01-19
Description: Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74, CWE-89
References: https://blog.laravel.com/security-laravel-62011-7302-8221-released; https://github.com/laravel/framework/pull/35865; https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x
CVE: CVE-2020-27256
Published: 2021-01-19
Description: In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump allows attackers with physical access to change insulin therapy settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01
CVE: CVE-2020-27258
Published: 2021-01-19
Description: In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows unauthenticated attackers to extract the pump’s keypad lock PIN via Bluetooth Low Energy.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01
CVE: CVE-2020-27264
Published: 2021-01-19
Description: In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications use deterministic keys, which allows unauthenticated, physically proximate attackers to brute-force the keys via Bluetooth Low Energy.
CVSS Score: 8.8 (HIGH)
CWE: CWE-330, CWE-330
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01
CVE: CVE-2020-11997
Published: 2021-01-19
Description: Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://lists.apache.org/thread.html/r1a9ae9d1608c9f846875c4191cd738f95543d1be06b52dc1320e8117%40%3Cannounce.guacamole.apache.org%3E; https://lists.apache.org/thread.html/r1a9ae9d1608c9f846875c4191cd738f95543d1be06b52dc1320e8117%40%3Cannounce.guacamole.apache.org%3E
CVE: CVE-2020-27266
Published: 2021-01-19
Description: In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass user authentication checks via Bluetooth Low Energy.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-603, CWE-287
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01
CVE: CVE-2020-27268
Published: 2021-01-19
Description: In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass checks for default PINs via Bluetooth Low Energy.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-602, CWE-669
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01
CVE: CVE-2020-27269
Published: 2021-01-19
Description: In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications lacks replay protection measures, which allows unauthenticated, physically proximate attackers to replay communication sequences via Bluetooth Low Energy.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-294, CWE-294
References: https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01; https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01
CVE: CVE-2020-28707
Published: 2021-01-19
Description: The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the "e" variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,'*') for that object.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://stockdio.com; https://jondow.eu/cve-2020-28707-xss-in-stockdio-historical-chart-plugin-for-wordpress-before-version-281/; https://wordpress.org/plugins/stockdio-historical-chart/#developers
CVE: CVE-2020-29598
Published: 2021-01-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its requester. Notes: none
CVE: CVE-2020-19360
Published: 2021-01-20
Description: Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to sensitive information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://emreovunc.com/blog/en/FHEM-v6.0-LFI-Vulnerability-01.png; https://github.com/EmreOvunc/FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability; https://emreovunc.com/blog/en/FHEM-v6.0-LFI-Vulnerability-01.png
CVE: CVE-2020-19361
Published: 2021-01-20
Description: Reflected XSS in Medintux v2.16.000 CCAM.php by manipulating the mot1 parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://emreovunc.com/blog/en/Medintux-v2.16.000-Reflected-XSS-01.png; https://emreovunc.com/blog/en/Medintux-v2.16.000-Reflected-XSS-02.png; https://github.com/EmreOvunc/Medintux-V2.16.000-Reflected-XSS-Vulnerability
CVE: CVE-2020-19362
Published: 2021-01-20
Description: Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://emreovunc.com/blog/en/vtiger_crm_xss_03.png; https://github.com/EmreOvunc/Vtiger-CRM-Vulnerabilities/; https://emreovunc.com/blog/en/vtiger_crm_xss_03.png