deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39219
Published: 2021-09-17
Description: Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was used to create the `Linker` and then a different `Engine` was used to create a `Store` and then the `Linker` was used to instantiate a module into that `Store`. Cross-`Engine` usage of functions is not supported in Wasmtime and this can result in type confusion of function pointers, resulting in being able to safely call a function with the wrong type. Triggering this bug requires using at least two `Engine` values in an embedding and then additionally using two different values with a `Linker` (one at the creation time of the `Linker` and another when instantiating a module with the `Linker`). It's expected that usage of more-than-one `Engine` in an embedding is relatively rare since an `Engine` is intended to be a globally shared resource, so the expectation is that the impact of this issue is relatively small. The fix implemented is to change this behavior to `panic!()` in Rust instead of silently allowing it. Using different `Engine` instances with a `Linker` is a programmer bug that `wasmtime` catches at runtime. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime and are using more than one `Engine` in your embedding it's recommended to instead use only one `Engine` for the entire program if possible. An `Engine` is designed to be a globally shared resource that is suitable to have only one for the lifetime of an entire process. If using multiple `Engine`s is required then code should be audited to ensure that `Linker` is only used with one `Engine`.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-843
References: https://crates.io/crates/wasmtime; https://github.com/bytecodealliance/wasmtime/commit/b39f087414f27ae40c44449ed5d1154e03449bff; https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mx
CVE: CVE-2021-41380
Published: 2021-09-17
Description: RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data. NOTE: It is asserted that this issue requires social engineering a user into connecting to a fake VNC Server. The VNC Viewer application they are using will then hang, until terminated, but no memory leak occurs - the resources are freed once the hung process is terminated and the resource usage is constant during the hang. Only the process that is connected to the fake Server is affected. This is an application bug, not a security issue
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://gist.github.com/totaam/a90f2bb40f5b693ccec0ae903d021b03; https://gist.github.com/totaam/a90f2bb40f5b693ccec0ae903d021b03
CVE: CVE-2021-41383
Published: 2021-09-17
Description: setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server field.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://j-o-e-l-s.github.io/2021/09/15/Hacking-The-Netgear-R6020.html; https://j-o-e-l-s.github.io/2021/09/15/Hacking-The-Netgear-R6020.html
CVE: CVE-2020-21547
Published: 2021-09-17
Description: Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/saitoha/libsixel/issues/114; https://github.com/saitoha/libsixel/issues/114
CVE: CVE-2020-21548
Published: 2021-09-17
Description: Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/saitoha/libsixel/issues/116; https://github.com/saitoha/libsixel/issues/116
CVE: CVE-2021-39218
Published: 2021-09-17
Description: Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes. Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types`.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-125, CWE-590, CWE-787
References: https://crates.io/crates/wasmtime; https://github.com/bytecodealliance/wasmtime/commit/398a73f0dd862dbe703212ebae8e34036a18c11c; https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49
CVE: CVE-2021-41387
Published: 2021-09-17
Description: seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-426
References: https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CGJ2IZQ.HCKS1J0LSI803%40kl.wtf%3E; https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CGJ2IZQ.HCKS1J0LSI803%40kl.wtf%3E
CVE: CVE-2021-41390
Published: 2021-09-17
Description: In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Injection.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74
References: https://the-it-wonders.blogspot.com/2021/09/ericsson-ecm-enterprise-content_17.html; https://the-it-wonders.blogspot.com/2021/09/ericsson-ecm-enterprise-content_17.html
CVE: CVE-2021-41391
Published: 2021-09-17
Description: In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSS via a name, leading to session hijacking and full account takeover.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://the-it-wonders.blogspot.com/2021/09/ericsson-ecm-enterprise-content.html; https://the-it-wonders.blogspot.com/2021/09/ericsson-ecm-enterprise-content.html
CVE: CVE-2021-41392
Published: 2021-09-17
Description: static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/BoostIO/BoostNote-App/issues/856; https://github.com/BoostIO/BoostNote-App/issues/856
CVE: CVE-2021-3806
Published: 2021-09-18
Description: A path traversal vulnerability on Pardus Software Center's "extractArchive" function could allow anyone on the same network to do a man-in-the-middle and write files on the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://pentest.blog/pardus-21-linux-distro-remote-code-execution-0day-2021/; https://www.usom.gov.tr/bildirim/tr-21-0754; https://pentest.blog/pardus-21-linux-distro-remote-code-execution-0day-2021/
CVE: CVE-2021-41393
Published: 2021-09-18
Description: Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/gravitational/teleport/releases/tag/v4.4.11; https://github.com/gravitational/teleport/releases/tag/v5.2.4; https://github.com/gravitational/teleport/releases/tag/v6.2.12
CVE: CVE-2021-41394
Published: 2021-09-18
Description: Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/gravitational/teleport/releases/tag/v4.4.11; https://github.com/gravitational/teleport/releases/tag/v5.2.4; https://github.com/gravitational/teleport/releases/tag/v6.2.12
CVE: CVE-2021-41395
Published: 2021-09-18
Description: Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or username.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/gravitational/teleport/releases/tag/v6.2.12; https://github.com/gravitational/teleport/releases/tag/v7.1.1; https://github.com/gravitational/teleport/releases/tag/v6.2.12
CVE: CVE-2021-23441
Published: 2021-09-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-41073
Published: 2021-09-19
Description: loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-763
References: http://www.openwall.com/lists/oss-security/2021/09/18/2; http://www.openwall.com/lists/oss-security/2021/09/18/2; http://www.openwall.com/lists/oss-security/2022/06/04/4
CVE: CVE-2021-40690
Published: 2021-09-19
Description: All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://lists.apache.org/thread.html/r3b3f5ba9b0de8c9c125077b71af06026d344a709a8ba67db81ee9faa%40%3Ccommits.tomee.apache.org%3E; https://lists.apache.org/thread.html/r401ecb7274794f040cd757b259ebe3e8c463ae74f7961209ccad3c59%40%3Cissues.cxf.apache.org%3E; https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E
CVE: CVE-2021-38300
Published: 2021-09-20
Description: arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture.
CVSS Score: 7.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2021/09/15/5; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
CVE: CVE-2021-24396
Published: 2021-09-20
Description: A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-gseor/; https://wpscan.com/vulnerability/28[PII_REDACTED]-49e0-8905-dc[PII_REDACTED]; https://codevigilant.com/disclosure/2021/wp-plugin-gseor/
CVE: CVE-2021-24397
Published: 2021-09-20
Description: The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-microcopy/; https://wpscan.com/vulnerability/2edab2b0-d4fd-4d50-aca0-2a1b7b37c23d; https://codevigilant.com/disclosure/2021/wp-plugin-microcopy/
CVE: CVE-2021-24398
Published: 2021-09-20
Description: The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query is ran twice.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-morpheus-slider/; https://wpscan.com/vulnerability/e6fb2256-0214-4891-b4b7-e4371a1599a5; https://codevigilant.com/disclosure/2021/wp-plugin-morpheus-slider/
CVE: CVE-2021-24399
Published: 2021-09-20
Description: The check_order function of The Sorter WordPress plugin through 1.0 uses an `area_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-the-sorter/; https://wpscan.com/vulnerability/f7af0795-f111-4acc-9b1e-63cae5862f8b; https://codevigilant.com/disclosure/2021/wp-plugin-the-sorter/
CVE: CVE-2021-24400
Published: 2021-09-20
Description: The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an `id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-wp-display-users/; https://wpscan.com/vulnerability/614cf338-c8cf-4570-ae83-4f79cbdcc9d5; https://codevigilant.com/disclosure/2021/wp-plugin-wp-display-users/
CVE: CVE-2021-24401
Published: 2021-09-20
Description: The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an `editid` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugins-domain-redirect/; https://wpscan.com/vulnerability/f9ae34a9-84c9-4d48-af6a-9e6c786f856e; https://codevigilant.com/disclosure/2021/wp-plugins-domain-redirect/
CVE: CVE-2021-24402
Published: 2021-09-20
Description: The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-wp-icommerce/; https://wpscan.com/vulnerability/7840e664-907f-42d1-950d-8c919032b707; https://codevigilant.com/disclosure/2021/wp-plugin-wp-icommerce/
CVE: CVE-2021-24403
Published: 2021-09-20
Description: The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-wpagecontact/; https://wpscan.com/vulnerability/a87040c1-58fc-4bf7-8bfa-0b9712a62ba8; https://codevigilant.com/disclosure/2021/wp-plugin-wpagecontact/
CVE: CVE-2021-24404
Published: 2021-09-20
Description: The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query ran twice.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-wp-board/; https://wpscan.com/vulnerability/a86240e1-f064-4972-9f97-6b349fdd57f6; https://codevigilant.com/disclosure/2021/wp-plugin-wp-board/
CVE: CVE-2021-24511
Published: 2021-09-20
Description: The fetch_product_ajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a `product_id` POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-purple-xmls-google-product-feed-for-woocommerce/; https://wpscan.com/vulnerability/0fa114a0-29df-4312-9138-eb9f0aedb3c5; https://codevigilant.com/disclosure/2021/wp-plugin-purple-xmls-google-product-feed-for-woocommerce/
CVE: CVE-2021-24525
Published: 2021-09-20
Description: The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/7f5659bd-50c3-4725-95f4-cf88812acf1c; https://wpscan.com/vulnerability/7f5659bd-50c3-4725-95f4-cf88812acf1c
CVE: CVE-2021-24530
Published: 2021-09-20
Description: The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/caf36ca5-aafd-48bd-a1e5-30f3973d8eb8; https://wpscan.com/vulnerability/caf36ca5-aafd-48bd-a1e5-30f3973d8eb8
CVE: CVE-2021-24582
Published: 2021-09-20
Description: The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it its settings page, leading to a Stored Cross-Site Scripting issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5a5293ed-ddcb-4a63-9420-09942e7d69c2; https://wpscan.com/vulnerability/5a5293ed-ddcb-4a63-9420-09942e7d69c2
CVE: CVE-2021-24583
Published: 2021-09-20
Description: The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-352
References: https://wpscan.com/vulnerability/7aec4ef4-db3b-41fb-9177-88ce9d37bca6; https://wpscan.com/vulnerability/7aec4ef4-db3b-41fb-9177-88ce9d37bca6
CVE: CVE-2021-24584
Published: 2021-09-20
Description: The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/60eadf75-8298-49de-877e-ce103fc34d58; https://wpscan.com/vulnerability/60eadf75-8298-49de-877e-ce103fc34d58
CVE: CVE-2021-24585
Published: 2021-09-20
Description: The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://wpscan.com/vulnerability/cd288a92-903b-47c9-83ac-8e5b677e949b; https://wpscan.com/vulnerability/cd288a92-903b-47c9-83ac-8e5b677e949b
CVE: CVE-2021-24587
Published: 2021-09-20
Description: The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bb5d94ad-e1ce-44e2-8403-d73fe75a146a; https://wpscan.com/vulnerability/bb5d94ad-e1ce-44e2-8403-d73fe75a146a
CVE: CVE-2021-24596
Published: 2021-09-20
Description: The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b5def0e7-2b4a-43e0-8175-28b28aa2f8ae; https://wpscan.com/vulnerability/b5def0e7-2b4a-43e0-8175-28b28aa2f8ae
CVE: CVE-2021-24597
Published: 2021-09-20
Description: The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/37554d0e-68e2-4df9-8c59-65f5cd7f184e; https://wpscan.com/vulnerability/37554d0e-68e2-4df9-8c59-65f5cd7f184e
CVE: CVE-2021-24600
Published: 2021-09-20
Description: The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/413b3a2e-1c05-45ec-b00f-1c137a1ae33e; https://wpscan.com/vulnerability/413b3a2e-1c05-45ec-b00f-1c137a1ae33e
CVE: CVE-2021-24604
Published: 2021-09-20
Description: The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d084c5b1-45f1-4e7e-b3e9-3c98ae4bce9c; https://wpscan.com/vulnerability/d084c5b1-45f1-4e7e-b3e9-3c98ae4bce9c