deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20578
Published: 2021-09-30
Description: IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199282; https://www.ibm.com/support/pages/node/6493729; https://exchange.xforce.ibmcloud.com/vulnerabilities/199282
CVE: CVE-2021-29894
Published: 2021-09-30
Description: IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207320.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/207320; https://www.ibm.com/support/pages/node/6493729; https://exchange.xforce.ibmcloud.com/vulnerabilities/207320
CVE: CVE-2021-35198
Published: 2021-09-30
Description: NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2021-35199
Published: 2021-09-30
Description: NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2021-35200
Published: 2021-09-30
Description: NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2021-35201
Published: 2021-09-30
Description: NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2021-35202
Published: 2021-09-30
Description: NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2021-35203
Published: 2021-09-30
Description: NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-552
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2021-35204
Published: 2021-09-30
Description: NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2021-35205
Published: 2021-09-30
Description: NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2021-41288
Published: 2021-09-30
Description: Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.manageengine.com/network-monitoring/help/read-me-complete.html#build_125467; https://www.manageengine.com/network-monitoring/help/read-me-complete.html#build_125467
CVE: CVE-2021-41323
Published: 2021-09-30
Description: Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any user, via the format parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://charonv.net/Pydio-Broken-Access-Control/; https://github.com/pydio/cells/releases/tag/v2.2.12; https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212
CVE: CVE-2021-41325
Published: 2021-09-30
Description: Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be granted several admin permissions via the Roles parameter.)
CVSS Score: 6.5 (MEDIUM)
References: https://charonv.net/Pydio-Broken-Access-Control/; https://github.com/pydio/cells/releases/tag/v2.2.12; https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212
CVE: CVE-2021-33583
Published: 2021-09-30
Description: REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.compass-security.com/fileadmin/Research/Advisories/2021-12_CSNC-2021-012_timeCard_Hardcoded_Credentials.txt; https://www.compass-security.com/fileadmin/Research/Advisories/2021-12_CSNC-2021-012_timeCard_Hardcoded_Credentials.txt
CVE: CVE-2021-41101
Published: 2021-09-30
Description: wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS ` Access-Control-Allow-Origin ` header set by `nginz` is set for all subdomains of `.wire.com` (including `wire.com`). This means that if somebody were to find an XSS vector in any of the subdomains, they could use it to talk to the Wire API using the user's Cookie. A patch does not exist, but a workaround does. To make sure that a compromise of one subdomain does not yield access to the cookie of another, one may limit the `Access-Control-Allow-Origin` header to apps that actually require the cookie (account-pages, team-settings and the webapp).
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/wireapp/wire-server/security/advisories/GHSA-v7xx-cx8m-g66p; https://github.com/wireapp/wire-server/security/advisories/GHSA-v7xx-cx8m-g66p
CVE: CVE-2020-20746
Published: 2021-09-30
Description: A stack-based buffer overflow in the httpd server on Tenda AC9 V15.03.06.60_EN allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via a crafted POST request to /goform/SetStaticRouteCfg.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/121.html; https://github.com/grapefruitvul/vulinfo/blob/master/tenda/vul1.md; https://cwe.mitre.org/data/definitions/121.html
CVE: CVE-2021-41324
Published: 2021-09-30
Description: Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files belonging to any user) via the nodes parameter (for Copy and Move) or via the Path parameter (for Delete).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://charonv.net/Pydio-Broken-Access-Control/; https://github.com/pydio/cells/releases/tag/v2.2.12; https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212
CVE: CVE-2020-20796
Published: 2021-09-30
Description: FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/FlameNET/FlameCMS/issues/24; https://github.com/FlameNET/FlameCMS/issues/24
CVE: CVE-2020-20797
Published: 2021-09-30
Description: FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/FlameNET/FlameCMS/issues/26; https://github.com/FlameNET/FlameCMS/issues/26
CVE: CVE-2020-20799
Published: 2021-09-30
Description: JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the commentText parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/blackjliuyun/cvetest/issues/1; https://github.com/blackjliuyun/cvetest/issues/1
CVE: CVE-2021-33626
Published: 2021-10-01
Description: A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-829
References: https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.insyde.com/security-pledge
CVE: CVE-2021-34352
Published: 2021-10-01
Description: A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-21-38; https://www.qnap.com/en/security-advisory/qsa-21-38
CVE: CVE-2021-34354
Published: 2021-10-01
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-21-41; https://www.qnap.com/en/security-advisory/qsa-21-41
CVE: CVE-2021-34355
Published: 2021-10-01
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10 ( 2021/08/19 ) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-21-42; https://www.qnap.com/en/security-advisory/qsa-21-42
CVE: CVE-2021-34356
Published: 2021-10-01
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-21-41; https://www.qnap.com/en/security-advisory/qsa-21-41
CVE: CVE-2021-38675
Published: 2021-10-01
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-21-43; https://www.qnap.com/en/security-advisory/qsa-21-43
CVE: CVE-2021-3626
Published: 2021-10-01
Description: The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-73, CWE-284
References: https://github.com/canonical/multipass/pull/2150; https://github.com/canonical/multipass/pull/2150
CVE: CVE-2021-3709
Published: 2021-10-01
Description: Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-538, CWE-22
References: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1934308; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3709; https://ubuntu.com/security/notices/USN-5077-1
CVE: CVE-2021-3710
Published: 2021-10-01
Description: An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1933832; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3710; https://ubuntu.com/security/notices/USN-5077-1
CVE: CVE-2021-3747
Published: 2021-10-01
Description: The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://github.com/canonical/multipass/issues/2261; https://github.com/canonical/multipass/issues/2261
CVE: CVE-2021-23893
Published: 2021-10-01
Description: Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevated system privileges via exploiting an unutilized memory buffer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10361; https://kc.mcafee.com/corporate/index?page=content&id=SB10361
CVE: CVE-2021-41456
Published: 2021-10-01
Description: There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denial of service vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1911; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1911
CVE: CVE-2021-41457
Published: 2021-10-01
Description: There is a stack buffer overflow in MP4Box 1.1.0 at src/filters/dmx_nhml.c in nhmldmx_init_parsing which leads to a denial of service vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1909; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1909
CVE: CVE-2021-41459
Published: 2021-10-01
Description: There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter which leads to a denial of service vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1912; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1912
CVE: CVE-2021-35297
Published: 2021-10-01
Description: Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow. An attacker can use the Structured Exception Handler (SEH) records and redirect execution to attacker-controlled code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://govtech-csg.github.io/security-advisories/2021/09/18/CVE-2021-35297.html; https://govtech-csg.github.io/security-advisories/2021/09/18/CVE-2021-35297.html
CVE: CVE-2021-41110
Published: 2021-10-01
Description: cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/common-workflow-language/cwlviewer/commit/f6066f09edb70033a2ce80200e9fa9e70a5c29de; https://github.com/common-workflow-language/cwlviewer/security/advisories/GHSA-7g7j-f5g3-fqp7; https://www.fatalerrors.org/a/analysis-of-the-snakeyaml-deserialization-in-java-security.html
CVE: CVE-2021-40960
Published: 2021-10-01
Description: Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.galera.com.tr/; http://www.omrylmz.com/galera-webtemplate-1-0-directory-traversal-vulnerability-cve-2021-40960/; http://www.galera.com.tr/
CVE: CVE-2021-41648
Published: 2021-10-01
Description: An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/165036/PuneethReddyHC-Online-Shopping-System-Advanced-1.0-SQL-Injection.html; https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system; https://github.com/MobiusBinary/CVE-2021-41648
CVE: CVE-2021-41649
Published: 2021-10-01
Description: An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41649; https://streamable.com/aii806
CVE: CVE-2021-29108
Published: 2021-10-01
Description: There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347, CWE-347
References: https://downloads.esri.com/RESOURCES/ENTERPRISEGIS/Organization-Specific_Logins_FAQs.pdf; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/Portal-for-ArcGIS-Security-2021-Update-1-Patch/; https://downloads.esri.com/RESOURCES/ENTERPRISEGIS/Organization-Specific_Logins_FAQs.pdf
CVE: CVE-2021-29109
Published: 2021-10-01
Description: A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/Portal-for-ArcGIS-Security-2021-Update-1-Patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/Portal-for-ArcGIS-Security-2021-Update-1-Patch/
CVE: CVE-2021-29110
Published: 2021-10-01
Description: Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/Portal-for-ArcGIS-Security-2021-Update-1-Patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/Portal-for-ArcGIS-Security-2021-Update-1-Patch/
CVE: CVE-2021-3825
Published: 2021-10-01
Description: On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://pentest.blog/liderahenk-0day-all-your-pardus-clients-belongs-to-me/; https://www.usom.gov.tr/bildirim/tr-21-0795; https://pentest.blog/liderahenk-0day-all-your-pardus-clients-belongs-to-me/
CVE: CVE-2021-41647
Published: 2021-10-01
Description: An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/164422/Online-Food-Ordering-Web-App-SQL-Injection.html; https://github.com/MobiusBinary/CVE-2021-41647; https://github.com/kaushikjadhav01/Online-Food-Ordering-Web-App
CVE: CVE-2021-40921
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in _contactform.inc.php in Detector 0.8.5 and below version allows remote attackers to inject arbitrary web script or HTML via the cid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dmolsen/Detector/issues/35; https://github.com/dmolsen/Detector/issues/35
CVE: CVE-2021-40922
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the last_name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pixeline/bugs; https://github.com/pixeline/bugs/issues/552; https://github.com/pixeline/bugs
CVE: CVE-2021-40923
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pixeline/bugs; https://github.com/pixeline/bugs/issues/552; https://github.com/pixeline/bugs
CVE: CVE-2021-40924
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the first_name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pixeline/bugs; https://github.com/pixeline/bugs/issues/552; https://github.com/pixeline/bugs
CVE: CVE-2021-40925
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"] parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ladybirdweb/faveo-helpdesk; https://github.com/ladybirdweb/faveo-helpdesk/issues/5423; https://github.com/ladybirdweb/faveo-helpdesk
CVE: CVE-2021-40926
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/JamesHeinrich/getID3; https://github.com/JamesHeinrich/getID3/issues/341; https://github.com/JamesHeinrich/getID3
CVE: CVE-2021-40927
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers to inject arbitrary web script or HTML via the error parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/citelao/Spotify-for-Alfred; https://github.com/citelao/Spotify-for-Alfred/issues/137; https://github.com/citelao/Spotify-for-Alfred