deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20745
Published: 2021-06-28
Description: Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://docs.inkdrop.app/releases/5.3.1; https://jvn.jp/en/jp/JVN29949691/index.html; https://www.inkdrop.app/
CVE: CVE-2021-20746
Published: 2021-06-28
Description: Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cabrerahector.com/; https://cabrerahector.com/wordpress/wordpress-popular-posts-5-3-improved-php-8-support-retina-display-support-and-more/#minor-updates-and-hotfixes; https://jvn.jp/en/jp/JVN63066062/index.html
CVE: CVE-2021-20749
Published: 2021-06-28
Description: Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.0 and earlier, and Fudousan Plugin Pro Multi-User Type ver5.7.0 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN93799513/index.html; https://nendeb.jp/fudou; https://www.nendeb-biz.jp/2021-0617-1200/
CVE: CVE-2021-20750
Published: 2021-06-28
Description: Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN95292458/index.html; https://www.ec-cube.net/info/weakness/weakness.php?id=78; https://www.ec-cube.net/info/weakness/weakness.php?id=79
CVE: CVE-2021-20751
Published: 2021-06-28
Description: Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN95292458/index.html; https://www.ec-cube.net/info/weakness/weakness.php?id=78; https://jvn.jp/en/jp/JVN95292458/index.html
CVE: CVE-2021-23399
Published: 2021-06-28
Description: This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://github.com/rolangom/wincred/blob/3fd39186ee32add9c12046cdccf2765d19565335/index.ts%23L20; https://snyk.io/vuln/SNYK-JS-WINCRED-1078538; https://github.com/rolangom/wincred/blob/3fd39186ee32add9c12046cdccf2765d19565335/index.ts%23L20
CVE: CVE-2021-20099
Published: 2021-06-28
Description: Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local administrator to run specific Windows executables as the Nessus host. This is different than CVE-2021-20100.
CVSS Score: 6.7 (MEDIUM)
References: https://www.tenable.com/security/tns-2021-12; https://www.tenable.com/security/tns-2021-12
CVE: CVE-2021-20100
Published: 2021-06-28
Description: Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local administrator to run specific Windows executables as the Nessus host. This is different than CVE-2021-20099.
CVSS Score: 6.7 (MEDIUM)
References: https://www.tenable.com/security/tns-2021-12; https://www.tenable.com/security/tns-2021-12
CVE: CVE-2018-1138
Published: 2021-06-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: Assigned as a duplicate of CVE-2019-14827
CVE: CVE-2021-29157
Published: 2021-06-28
Description: Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://dovecot.org/security; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
CVE: CVE-2021-32496
Published: 2021-06-28
Description: SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH interface solely used by SICK for recovering returned devices. The use of weak ciphers make it easier for an attacker to break the security that protects information transmitted from the client to the SSH server, assuming the attacker has access to the network on which the device is connected. This can increase the risk that encryption will be compromised, leading to the exposure of sensitive user information and man-in-the-middle attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-326
References: https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories; https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE: CVE-2021-35514
Published: 2021-06-28
Description: Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/whiteleaf7/narou/blob/develop/ChangeLog.md#[PII_REDACTED]7; https://vuln.ryotak.me/advisories/51; https://github.com/whiteleaf7/narou/blob/develop/ChangeLog.md#[PII_REDACTED]7
CVE: CVE-2020-15303
Published: 2021-06-28
Description: Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776
References: https://community.infoblox.com/t5/Security/NIOS-XML-Vulnerability/m-p/22437#M1995; https://www.infoblox.com/products/nios8/; https://community.infoblox.com/t5/Security/NIOS-XML-Vulnerability/m-p/22437#M1995
CVE: CVE-2020-28200
Published: 2021-06-28
Description: The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://dovecot.org/security; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
CVE: CVE-2021-31337
Published: 2021-06-28
Description: The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the service is enabled. Telnet is disabled by default on the SINAMICS Medium Voltage Products (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-131-04; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-04
CVE: CVE-2021-33515
Published: 2021-06-28
Description: The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-77
References: https://dovecot.org/security; https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
CVE: CVE-2021-21083
Published: 2021-06-28
Description: AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the current user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-15.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-15.html
CVE: CVE-2021-21084
Published: 2021-06-28
Description: AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-15.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-15.html
CVE: CVE-2021-21090
Published: 2021-06-28
Description: Adobe InCopy version 16.0 (and earlier) is affected by an path traversal vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/incopy/apsb21-25.html; https://helpx.adobe.com/security/products/incopy/apsb21-25.html
CVE: CVE-2021-21098
Published: 2021-06-28
Description: Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb21-22.html; https://helpx.adobe.com/security/products/indesign/apsb21-22.html
CVE: CVE-2021-21099
Published: 2021-06-28
Description: Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb21-22.html; https://helpx.adobe.com/security/products/indesign/apsb21-22.html
CVE: CVE-2021-21101
Published: 2021-06-28
Description: Adobe Illustrator version 25.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb21-24.html; https://helpx.adobe.com/security/products/illustrator/apsb21-24.html
CVE: CVE-2021-21102
Published: 2021-06-28
Description: Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/illustrator/apsb21-24.html; https://helpx.adobe.com/security/products/illustrator/apsb21-24.html
CVE: CVE-2021-28556
Published: 2021-06-28
Description: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb21-30.html; https://helpx.adobe.com/security/products/magento/apsb21-30.html
CVE: CVE-2021-28562
Published: 2021-06-28
Description: Acrobat Reader DC versions versions 2[PII_REDACTED]0 (and earlier), 2[PII_REDACTED]0 (and earlier) and 2[PII_REDACTED]4 (and earlier) are affected by a Use After Free vulnerability when executing search queries through Javascript. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-29.html; https://helpx.adobe.com/security/products/acrobat/apsb21-29.html
CVE: CVE-2021-28563
Published: 2021-06-28
Description: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://helpx.adobe.com/security/products/magento/apsb21-30.html; https://helpx.adobe.com/security/products/magento/apsb21-30.html
CVE: CVE-2021-28570
Published: 2021-06-28
Description: Adobe After Effects version 18.1 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An unauthenticated attacker could exploit this to to plant custom binaries and execute them with System permissions. Exploitation of this issue requires user interaction.
CVSS Score: 8.3 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/ee/security/products/after_effects/apsb21-33.html; https://helpx.adobe.com/ee/security/products/after_effects/apsb21-33.html
CVE: CVE-2021-28573
Published: 2021-06-28
Description: Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/animate/apsb21-35.html; https://helpx.adobe.com/security/products/animate/apsb21-35.html
CVE: CVE-2021-28574
Published: 2021-06-28
Description: Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/animate/apsb21-35.html; https://helpx.adobe.com/security/products/animate/apsb21-35.html
CVE: CVE-2021-28575
Published: 2021-06-28
Description: Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/animate/apsb21-35.html; https://helpx.adobe.com/security/products/animate/apsb21-35.html
CVE: CVE-2021-28576
Published: 2021-06-28
Description: Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/animate/apsb21-35.html; https://helpx.adobe.com/security/products/animate/apsb21-35.html
CVE: CVE-2021-28583
Published: 2021-06-28
Description: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-657
References: https://helpx.adobe.com/security/products/magento/apsb21-30.html; https://helpx.adobe.com/security/products/magento/apsb21-30.html
CVE: CVE-2021-28584
Published: 2021-06-28
Description: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/magento/apsb21-30.html; https://helpx.adobe.com/security/products/magento/apsb21-30.html
CVE: CVE-2021-28585
Published: 2021-06-28
Description: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/magento/apsb21-30.html; https://helpx.adobe.com/security/products/magento/apsb21-30.html
CVE: CVE-2021-28586
Published: 2021-06-28
Description: After Effects version 18.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb21-33.html; https://helpx.adobe.com/security/products/after_effects/apsb21-33.html
CVE: CVE-2021-28587
Published: 2021-06-28
Description: After Effects versions 18.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb21-33.html; https://helpx.adobe.com/security/products/after_effects/apsb21-33.html
CVE: CVE-2021-28579
Published: 2021-06-28
Description: Adobe Connect version 11.2.1 (and earlier) is affected by an Improper access control vulnerability that can lead to the elevation of privileges. An attacker with 'Learner' permissions can leverage this scenario to access the list of event participants.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/connect/apsb21-36.html; https://helpx.adobe.com/security/products/connect/apsb21-36.html
CVE: CVE-2021-28588
Published: 2021-06-28
Description: Adobe RoboHelp Server version 2019.0.9 (and earlier) is affected by a Path Traversal vulnerability when parsing a crafted HTTP POST request. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-21-660/; https://www.zerodayinitiative.com/advisories/ZDI-21-660/
CVE: CVE-2021-28597
Published: 2021-06-28
Description: Adobe Photoshop Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require user interaction.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-379, CWE-668
References: https://helpx.adobe.com/security/products/photoshop_elements/apsb21-46.html; https://helpx.adobe.com/security/products/photoshop_elements/apsb21-46.html
CVE: CVE-2021-28623
Published: 2021-06-28
Description: Adobe Premiere Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require user interaction.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-379, CWE-668
References: https://helpx.adobe.com/security/products/premiere_elements/apsb21-47.html; https://helpx.adobe.com/security/products/premiere_elements/apsb21-47.html
CVE: CVE-2021-32718
Published: 2021-06-28
Description: RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.
CVSS Score: 3.1 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2021/Dec/3; https://github.com/rabbitmq/rabbitmq-server/pull/3028; https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-rg5h-2772
CVE: CVE-2021-35456
Published: 2021-06-28
Description: Online Pet Shop We App 1.0 is vulnerable to remote SQL injection and shell upload
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/163282/Online-Pet-Shop-We-App-1.0-SQL-Injection-Shell-Upload.html; https://www.sourcecodester.com/php/14839/online-pet-shop-we-app-using-php-and-paypal-free-source-code.html; https://packetstormsecurity.com/files/163282/Online-Pet-Shop-We-App-1.0-SQL-Injection-Shell-Upload.html
CVE: CVE-2021-3556
Published: 2021-06-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: Assigned but a duplicate for CVE-2021-3559
CVE: CVE-2020-23710
Published: 2021-06-28
Description: Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LimeSurvey/LimeSurvey/pull/1441#partial-pull-merging; https://github.com/LimeSurvey/LimeSurvey/pull/1441#partial-pull-merging