deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-29781
Published: 2021-07-30
Description: IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 203091.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203091; https://www.ibm.com/support/pages/node/6476668; https://exchange.xforce.ibmcloud.com/vulnerabilities/203091
CVE: CVE-2020-10590
Published: 2021-07-30
Description: Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port (8800) on the Replicated Classic server could retrieve the TLS Keypair (Cert and Key) used to configure the Admin Console.
CVSS Score: 7.5 (HIGH)
References: https://blog.replicated.com; https://gradle.com/enterprise/releases/2019.5/#changes; https://www.replicated.com/security/advisories/CVE-2020-10590
CVE: CVE-2020-11511
Published: 2021-07-30
Description: The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: http://packetstormsecurity.com/files/163538/WordPress-LearnPress-Privilege-Escalation.html; https://cwe.mitre.org/data/definitions/862.html; https://wordpress.org/plugins/learnpress/#developers
CVE: CVE-2020-14999
Published: 2021-07-30
Description: A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection and access sensitive data.
CVSS Score: 7.5 (HIGH)
References: https://www.acronis.com/en-us/support/updates/index.html; https://www.acronis.com/en-us/support/updates/index.html
CVE: CVE-2020-15948
Published: 2021-07-30
Description: eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163687/eGain-Chat-15.5.5-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/163687/eGain-Chat-15.5.5-Cross-Site-Scripting.html
CVE: CVE-2020-16839
Published: 2021-07-30
Description: On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://support.crestron.com; https://www.crestron.com/Software-Firmware/Firmware/DigitalMedia/DM-XIO/1-0-3-802; https://www.security.crestron.com
CVE: CVE-2020-18013
Published: 2021-07-30
Description: SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?admin_banned/add.htm.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/YangSirrr/opendebug/blob/master/whatsns/Main.md; https://github.com/YangSirrr/opendebug/blob/master/whatsns/Main.md
CVE: CVE-2020-18157
Published: 2021-07-30
Description: Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/je6k/ctf-challenges/blob/master/poc.txt; https://github.com/je6k/ctf-challenges/blob/master/poc.txt
CVE: CVE-2020-18158
Published: 2021-07-30
Description: Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.cnblogs.com/echod/articles/10380909.html; https://www.cnblogs.com/echod/articles/10380909.html
CVE: CVE-2020-18175
Published: 2021-07-30
Description: SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sword1991912/metinfo/issues/1; https://github.com/sword1991912/metinfo/issues/1
CVE: CVE-2020-19118
Published: 2021-07-30
Description: Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yzmcms/yzmcms/issues/14; https://github.com/yzmcms/yzmcms/issues/14
CVE: CVE-2020-20698
Published: 2021-07-30
Description: A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://github.com/Peithon/vul/blob/master/readme.md; https://github.com/Peithon/vul/blob/master/readme.md
CVE: CVE-2020-20699
Published: 2021-07-30
Description: A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Copyright text box under Basic Settings.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Peithon/xss/blob/master/readme.md; https://github.com/Peithon/xss/blob/master/readme.md
CVE: CVE-2020-20700
Published: 2021-07-30
Description: A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Title Entry text box.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Peithon/recycle_XSS/blob/master/readme.md; https://github.com/Peithon/recycle_XSS/blob/master/readme.md
CVE: CVE-2020-20701
Published: 2021-07-30
Description: A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Peithon/site_XSS/blob/master/readme.md; https://github.com/Peithon/site_XSS/blob/master/readme.md
CVE: CVE-2020-21806
Published: 2021-07-30
Description: SQL Injection Vulnerability in ECTouch v2 via the shop page in index.php..
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/ectouch/ectouch/issues/5; https://github.com/ectouch/ectouch/issues/5
CVE: CVE-2020-21808
Published: 2021-07-30
Description: SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nukeviet/nukeviet/blob/4.3.08/CHANGELOG.txt#L11; https://nukeviet.vn/vi/news/Tin-an-ninh/huong-dan-fix-loi-bao-mat-nukeviet-4-va-module-shops-612.html; https://whitehub.net/submissions/1516
CVE: CVE-2020-21809
Published: 2021-07-30
Description: SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nukeviet/module-shops/commit/742c0e0f74364f7250c2a69f0a957d4e6317be68; https://nukeviet.vn/vi/news/Tin-an-ninh/huong-dan-fix-loi-bao-mat-nukeviet-4-va-module-shops-612.html; https://whitehub.net/submissions/1517
CVE: CVE-2020-21854
Published: 2021-07-30
Description: Cross Site Scripting vulnerabiity exists in WDScanner 1.1 in the system management page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/TideSec/WDScanner/issues/41; https://github.com/TideSec/WDScanner/issues/41
CVE: CVE-2020-22761
Published: 2021-07-30
Description: Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/flatpressblog/flatpress/issues/64; https://www.baomatcoban.info/2020/04/funnymini0day-flatpress-11-cross-site.html; https://github.com/flatpressblog/flatpress/issues/64
CVE: CVE-2020-22765
Published: 2021-07-30
Description: Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://nukeviet.vn/vi/news/Tin-tuc/nukeviet-cam-on-le-thanh-trung-da-phat-hien-loi-an-ninh-nukeviet-631.html; https://nukeviet.vn/vi/news/Tin-tuc/nukeviet-cam-on-le-thanh-trung-da-phat-hien-loi-an-ninh-nukeviet-631.html
CVE: CVE-2021-20111
Published: 2021-07-30
Description: A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tce_filemanager.php could upload a malicious javascript payload which would be triggered when another user views the file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-32; https://www.tenable.com/security/research/tra-2021-32
CVE: CVE-2021-20112
Published: 2021-07-30
Description: A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tce_select_mediafile.php could upload a malicious javascript payload which would be triggered when another user views the file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2021-32; https://www.tenable.com/security/research/tra-2021-32
CVE: CVE-2021-20113
Published: 2021-07-30
Description: An exposure of sensitive information vulnerability exists in TCExam <= 14.8.1. If a password reset request was made for an email address that was not registered with a user then we would be presented with an ‘unknown email’ error. If an email is given that is registered with a user then this error will not appear. A malicious actor could abuse this to enumerate the email addresses of
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://www.tenable.com/security/research/tra-2021-32; https://www.tenable.com/security/research/tra-2021-32
CVE: CVE-2021-20114
Published: 2021-07-30
Description: When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database backup files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://www.tenable.com/security/research/tra-2021-32; https://www.tenable.com/security/research/tra-2021-32
CVE: CVE-2021-20783
Published: 2021-07-30
Description: Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a specially crafted page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN34364599/index.html; https://jvn.jp/en/jp/JVN34364599/index.html
CVE: CVE-2021-20785
Published: 2021-07-30
Description: Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to inject an arbitrary script by sending a specially crafted request to a specific URL.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://groupsession.jp/info/info-news/security202107; https://jvn.jp/en/jp/JVN86026700/index.html; https://groupsession.jp/info/info-news/security202107
CVE: CVE-2021-20786
Published: 2021-07-30
Description: Cross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to hijack the authentication of administrators via a specially crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://groupsession.jp/info/info-news/security202107; https://jvn.jp/en/jp/JVN86026700/index.html; https://groupsession.jp/info/info-news/security202107
CVE: CVE-2021-20787
Published: 2021-07-30
Description: Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to inject an arbitrary script by sending a specially crafted request to a specific URL.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://groupsession.jp/info/info-news/security202107; https://jvn.jp/en/jp/JVN86026700/index.html; https://groupsession.jp/info/info-news/security202107
CVE: CVE-2021-20788
Published: 2021-07-30
Description: Server-side request forgery (SSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote authenticated attacker to conduct a port scan from the product and/or obtain information from the internal Web server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://groupsession.jp/info/info-news/security202107; https://jvn.jp/en/jp/JVN86026700/index.html; https://groupsession.jp/info/info-news/security202107
CVE: CVE-2021-20789
Published: 2021-07-30
Description: Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://groupsession.jp/info/info-news/security202107; https://jvn.jp/en/jp/JVN86026700/index.html; https://groupsession.jp/info/info-news/security202107
CVE: CVE-2021-25200
Published: 2021-07-30
Description: Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to \lms\student_avatar.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/TCSWT/Learning-Management-System/blob/main/README.md; https://github.com/TCSWT/Learning-Management-System/blob/main/README.md
CVE: CVE-2021-28093
Published: 2021-07-30
Description: OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html; http://seclists.org/fulldisclosure/2021/Jul/37; https://www.open-xchange.com
CVE: CVE-2021-28094
Published: 2021-07-30
Description: OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html; http://seclists.org/fulldisclosure/2021/Jul/37; https://www.open-xchange.com
CVE: CVE-2021-28095
Published: 2021-07-30
Description: OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-326
References: http://packetstormsecurity.com/files/163569/OX-Documents-7.10.5-Improper-Authorization.html; http://seclists.org/fulldisclosure/2021/Jul/37; https://www.open-xchange.com
CVE: CVE-2021-28674
Published: 2021-07-30
Description: The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the access control on Services/NodeManagement.asmx/DeleteObjNow is incorrect. To exploit this, an attacker must be authenticated and must have node management rights associated with at least one valid group on the platform.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-330, CWE-863
References: https://pastebin.com/zFUd2cCj; https://www.solarwinds.com/trust-center/security-advisories/cve-2021-28674; https://pastebin.com/zFUd2cCj
CVE: CVE-2021-28966
Published: 2021-07-30
Description: In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://hackerone.com/reports/1131465; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://hackerone.com/reports/1131465
CVE: CVE-2021-30124
Published: 2021-07-30
Description: The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/sandhje/vscode-phpmd/commit/c462bf5c6f0160d0199855d5f8ed76be8d9beac0; https://marketplace.visualstudio.com/items?itemName=ecodes.vscode-phpmd; https://vuln.ryotak.me/advisories/25
CVE: CVE-2021-30483
Published: 2021-07-30
Description: isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/isomorphic-git/isomorphic-git/pull/1339; https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.8.2; https://vuln.ryotak.me/advisories/28
CVE: CVE-2021-31799
Published: 2021-07-30
Description: In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
CVSS Score: 7.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html; https://security-tracker.debian.org/tracker/CVE-2021-31799; https://security.gentoo.org/glsa/202401-05
CVE: CVE-2021-31878
Published: 2021-07-30
Description: An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must be received after Asterisk has sent a BYE request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://downloads.asterisk.org/pub/security/AST-2021-007.html; http://packetstormsecurity.com/files/163638/Asterisk-Project-Security-Advisory-AST-2021-007.html; http://seclists.org/fulldisclosure/2021/Jul/48
CVE: CVE-2021-32558
Published: 2021-07-30
Description: An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/163639/Asterisk-Project-Security-Advisory-AST-2021-008.html; http://seclists.org/fulldisclosure/2021/Jul/49; https://downloads.asterisk.org/pub/security/AST-2021-008.html
CVE: CVE-2021-32610
Published: 2021-07-30
Description: In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://github.com/pear/Archive_Tar/commit/7789ebb2f34f9e4adb3a4152ad0d1548930a9755; https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f; https://github.com/pear/Archive_Tar/releases/tag/1.4.14
CVE: CVE-2021-34165
Published: 2021-07-30
Description: A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authentication and become Admin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49741; https://www.exploit-db.com/exploits/49741
CVE: CVE-2021-34166
Published: 2021-07-30
Description: A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authentication and become Admin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49740; https://www.exploit-db.com/exploits/49740
CVE: CVE-2021-34802
Published: 2021-07-30
Description: A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://neo4j.com; https://neo4j.com/developer/kb/neo4j-4-2-x-sec-vuln-fix/; https://neo4j.com
CVE: CVE-2021-35458
Published: 2021-07-30
Description: Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php (aka p=products) via the c or s parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/163282/Online-Pet-Shop-We-App-1.0-SQL-Injection-Shell-Upload.html; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-35458; https://www.sourcecodester.com/php/14839/online-pet-shop-we-app-using-php-and-paypal-free-source-code.html
CVE: CVE-2021-35472
Published: 2021-07-30
Description: An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication attempts, an attacker might alternately be authenticated as one of two different users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-307
References: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/8d3b763b6af2b8a9c4ad2765fbfabffec8a73af5; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2539; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/tags
CVE: CVE-2021-35478
Published: 2021-07-30
Description: Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/; https://research.nccgroup.com/?research=Technical%20advisories; https://www.nagios.com/downloads/nagios-log-server/change-log/
CVE: CVE-2021-35479
Published: 2021-07-30
Description: Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/; https://research.nccgroup.com/?research=Technical%20advisories; https://www.nagios.com/downloads/nagios-log-server/change-log/
CVE: CVE-2021-36004
Published: 2021-07-30
Description: Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability in the CoolType library. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb21-22.html; https://helpx.adobe.com/security/products/indesign/apsb21-22.html
CVE: CVE-2021-36386
Published: 2021-07-30
Description: report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-909
References: http://www.openwall.com/lists/oss-security/2021/07/28/5; http://www.openwall.com/lists/oss-security/2021/08/09/1; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGYO5AHSXTCKA4NQC2Z4H3XMMYNAGC77/